Run coTurn behind Nginx
Tags: coturn, nginx
Published: 2022-09-02 17:31:43

## Intro
* [[Xubuntu22.04] Try coTurn for WebRTC 1](https://dev.to/masanori_msl/xubuntu2204-try-coturn-for-webrtc-1-1o4h)

I will try run coTurn behind Nginx like my [WebRTC application](https://github.com/masanori840816/webappsample) with reverse proxy.

## Wireshark
Install Wireshark to see if the specified port is accessed with the specified protocol (TCP or UDP).

```
sudo apt install wireshark
```

Because my account haven't had a permission to access "/usr/bin/dumpcap" by default, I couldn't start capturing.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/umto3bu9qz1i17j2ufof.png)

```
sudo chmod +x /usr/bin/dumpcap
```

* [Fix for "couldn't run /usr/bin/dumpcap in child process: permission denied" - GitHub](https://gist.github.com/MinaMikhailcom/0825906230cbbe478faf4d08abe9d11a)

## Load balancer
According this issue comments, I can run coTurn behind Nginx by a load balancing function of Nginx.

* [Make coturn work reverse proxied through nginx #702 - coturn/coturn - GitHub](https://github.com/coturn/coturn/issues/702#issuecomment-917366000)

Before I edit nginx.conf, I added local domains into "/etc/hosts".

```
192.168.XX.YYY local-webrtc.jp
192.168.XX.YYY local-turn.jp
```

And Combine UDP and TCP listening ports into one in the turnserver.conf of coTurn.

#### turnserver.conf
```conf
...
# TURN listener port for UDP and TCP (Default: 3478).
# Note: actually, TLS & DTLS sessions can connect to the
# "plain" TCP & UDP port(s), too - if allowed by configuration.
#
listening-port=3478

# TURN listener port for TLS (Default: 5349).
# Note: actually, "plain" TCP & UDP sessions can connect to the TLS & DTLS
# port(s), too - if allowed by configuration. The TURN server
# "automatically" recognizes the type of traffic. Actually, two listening
# endpoints (the "plain" one and the "tls" one) are equivalent in terms of
# functionality; but Coturn keeps both endpoints to satisfy the RFC 5766 specs.
# For secure TCP connections, Coturn currently supports
# TLS version 1.0, 1.1 and 1.2.
# For secure UDP connections, Coturn supports DTLS version 1.
#
#tls-listening-port=5349
...
```

#### nginx.conf
```conf
user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}
stream {
    map $ssl_preread_server_name $name {
        local-webrtc.jp url_backend;
        local-turn.jp turn_server;
    }
    upstream url_backend {
        server 127.0.0.1:4444;
    }

    upstream turn_server {
        server 192.168.XX.YYY:3478;
    }
    server {
        listen 443;
        ssl_preread on;
        proxy_pass $name;
        proxy_buffer_size 10m;
    }
}
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;
    include /etc/nginx/conf.d/*.conf;
}
```

#### webrtcapp.conf
```conf
map $http_origin $cors {
    'http://localhost:8080' $http_origin;
    'https://127.0.0.1:4444' $http_origin;
    'https://local-webrtc.jp:443' $http_origin;
}
...
server {
    listen 4444 ssl;
    server_name localhost;
...
}
```

Because 443 port is shared by the Web application and coTurn, TCP protocol is used for communication with coTurn,

* [Using nginx as HTTP load balancer](http://nginx.org/en/docs/http/load_balancing.html)
* [Module ngx_stream_core_module](https://nginx.org/en/docs/stream/ngx_stream_core_module.html)
* [Module ngx_http_upstream_module](http://nginx.org/en/docs/http/ngx_http_upstream_module.html)
* [Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html)
* [TCP and UDP Load Balancing - Nginx Plus](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/)