Using TURN servers with Pexip Infinity

A TURN server is a media relay/proxy that allows peers to exchange UDP or TCP media traffic whenever one or both parties are behind NAT.

ICE (Interactive Connectivity Establishment) is a framework that allows endpoints to discover paths through which they can exchange media — such as via a TURN server — where direct routing between those devices may not be possible, e.g. when a device is on a private network or is behind a NAT.

Pexip Conferencing Nodes can utilize a TURN server and negotiate TURN relays with the following ICE capable clients:

  • Skype for Business / Lync clients
  • WebRTC clients (the Infinity Connect web app on the latest browsers, and the desktop and mobile clients)

If these endpoints will be connecting to privately-addressed "on-premises" Conferencing Nodes, you must configure Pexip Infinity with the address of at least one TURN server that it can offer to ICE clients.

A TURN server is not required if your Conferencing Nodes are publicly-addressable, either directly or via static NAT. For more information, see When is a reverse proxy, TURN server or STUN server required?.

Note that the H.323 specification has no concept of ICE.

The TURN servers that you use with Pexip Infinity:

  • Must have a public address (located either on the public internet or in a DMZ).
  • Unless a separate STUN server has also been configured, they must be deployed in such a way that traffic from the Conferencing Node towards the TURN server appears as coming from the Conferencing Node's public NAT address (its server reflexive address), otherwise this will prohibit some Skype for Business / Lync communication scenarios.
  • Must be routable from your Conferencing Nodes.
  • Must be standards-based (supporting RFC 5766), for example a Pexip TURN server (see Pexip Reverse Proxy and TURN Server) or a VCS Expressway.

When using a TURN server with a Conferencing Node:

  • Conferencing Nodes only use TURN over UDP (not TCP). However, Conferencing Nodes will perform ICE TCP negotiation.
  • Conferencing Nodes always communicate with its configured TURN server over a single UDP port (default UDP/3478). UDP media is multiplexed from the Conferencing Node to that single port on the TURN server. The TURN server will reply back to the same port pair on the Conferencing Node. The TURN server never initiates a connection towards a Conferencing Node.

  • As general good practice, we always recommend deploying the TURN server in a suitably secured network segment, such as a DMZ.

Note that Microsoft A/V Edge Server does not support RFC 5766 and therefore cannot be used as a TURN server with Pexip Infinity.

Nominating the TURN servers used by Pexip Infinity

Within Pexip Infinity you specify one or more TURN servers, and then associate one of those TURN servers with each System location and Call Routing Rule. The same TURN server can be used by more than one location or rule.

  • To add, edit or delete TURN server connection details, go to Call control > TURN servers. The options are:

    Option Description
    Name The name used to refer to this TURN server in the Pexip Infinity Administrator interface.
    Description An optional description of the TURN server.
    Address The IP address or FQDN of the TURN server.
    Port

    The IP port on the TURN server to which the Conferencing Node will connect.

    Default: 3478.

    When a port is specified, Pexip Infinity performs a DNS A-record lookup on the Address.

    If a port is not specified, then a _turn._udp DNS SRV lookup on the Address is performed (and the port in the SRV record is used). There is no fallback to an A record lookup if the SRV lookup fails.
    Username and Password The credentials of an account on the TURN server that can be used to create bindings.
  • To associate a TURN server with a location, go to Platform > Locations and configure the relevant location.
  • To associate a TURN server with a Call Routing Rule, go to Services > Call routing and configure the relevant rule.

After adding the details of the TURN server, you must add it to the relevant locations and Call Routing Rules.

How Pexip Infinity decides which TURN server to offer

The TURN server offered by Pexip Infinity to ICE clients is determined as follows:

  • Conferences: uses the TURN server associated with the location of the Conferencing Node that is handling the call signaling.
  • Point-to-point calls via the Infinity Gateway: uses the TURN server associated with the Call Routing Rule that matched the call request. If there is no TURN server associated with the rule, then the TURN server associated with the location of the Conferencing Node that is handling the call is used instead. Note that rules can optionally be configured on a per-location basis.

If a TURN server is not configured for the location or rule, a TURN server relay candidate will not be offered.

When a Conferencing Node receives a call from an ICE client, it sends a request to the TURN server to allocate bindings to be used by that client. The client uses these bindings to route its call media through the firewall to the Conferencing Node. The Conferencing Node allocates up to four TURN bindings per call (made up of two TURN bindings per media stream for both audio and video).