Having real trouble configuring TURN for Screego…

[lilopkins]

I'm trying to configure Screego to use an external TURN server (eturnal), with everything sitting behind Docker. As a quick summary of my setup:

• screego is running in a container reverse-proxied behind Traefik and points to the server's public IP as it's external TURN server.
• eturnal is running in a container in network_mode: host.

In all tests I can run, STUN, TURN and TURNS are configured correctly on the eturnal side (the Trickle ICE tester returns reasonable IPs, a mix of public and private), however when I navigate to a screego room, I get a grey screen (no "no stream available", but no video).

In my setup: on the host side, about:webrtc shows data being sent, and displays "Sending: video/H264" and on the client side, it shows a connection, but no video being received.

This works absolutely fine on app.screego.net! Using it: on the host side, about:webrtc shows data being sent, and displays "Sending: video/VP9" and on the client side, it "Receiving: video/VP9".

Surely these packets must be going somewhere! Any help would be hugely appreciated!

[jmattheis]

I think the current external turn server config was only tested with coturn. Could you provide your config for both eturnal and screego?

[lilopkins]

Upon further investigation yesterday night, it seems that one of my machines has some very unusual firewall configuration that is causing this. I'll see if I can figure out what it is and document it here for anyone who stumbles across this in the future.

Further testing on other machines seems to suggest screego+eturnal works fine without any special config.

In case it's still useful, this is the configuration I use (with everything containerised. Some details changed for security [see CHANGED:]).

compose.yaml

services:
  screego:
    image: docker.io/screego/server:1
    restart: always
    networks:
      - proxy
    environment:
      SCREEGO_SECRET: abc123 # CHANGED: real secret here
      SCREEGO_SERVER_ADDRESS: 0.0.0.0:5050
      SCREEGO_TURN_EXTERNAL_IP: 1.2.3.4 # CHANGED: real IP of TURN server
      SCREEGO_TURN_EXTERNAL_PORT: 3478
      SCREEGO_TURN_EXTERNAL_SECRET: "abcdef" # CHANGED: read secret here
      SCREEGO_TRUST_PROXY_HEADERS: "true"
      SCREEGO_AUTH_MODE: all
      SCREEGO_USERS_FILE: /screego.users
    volumes:
      - ./screego.users:/screego.users:ro
    labels:
      - traefik.enable=true
      - traefik.http.services.screen.loadbalancer.server.port=5050
      - traefik.http.routers.screen.entryPoints=websecure
      - traefik.http.routers.screen.rule=Host(`screen.example.com`) # CHANGED: real domain here
      - traefik.http.routers.screen.tls.certResolver=default
      - traefik.http.routers.screen.service=screen
      - traefik.http.routers.screen.middlewares=screen-real-ip@docker
      - traefik.http.middlewares.screen-real-ip.plugin.traefik-real-ip.excludednets=

  eturnal:
    image: ghcr.io/processone/eturnal:latest
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./eturnal.yaml:/etc/eturnal.yml:ro

networks:
  proxy:
    external: true

Eturnal configuration: eturnal.yaml

# eturnal STUN/TURN server configuration file.
#
# This file is written in YAML. The YAML format is indentation-sensitive, please
# MAKE SURE YOU INDENT CORRECTLY.
#
# See: https://eturnal.net/doc/#Global_Configuration

eturnal:

  ## Shared secret for deriving temporary TURN credentials (default: $RANDOM):
  secret: "abc" # CHANGED: real secret here

  listen:
    -
      ip: "::"
      port: 3478
      transport: udp
    -
      ip: "::"
      port: 3478
      transport: tcp
    #-
    #  ip: "::"
    #  port: 5349
    #  transport: tls

  ## TLS certificate/key files (must be readable by 'eturnal' user!):
  #tls_crt_file: /etc/eturnal/tls/crt.pem
  #tls_key_file: /etc/eturnal/tls/key.pem

  ## The server's public IPv4 address (default: autodetected):
  relay_ipv4_addr: "0.0.0.0" # CHANGED: real IPv4 address here
  ## The server's public IPv6 address (optional):
  relay_ipv6_addr: "abcd::1" # CHANGED: real IPv6 address here

  ## UDP relay port range (usually, several ports per A/V call are required):
  relay_min_port: 49152     # This is the default.
  relay_max_port: 65535     # This is the default.

  ## Reject TURN relaying to the following addresses/networks:
  blacklist_peers:
    - recommended           # Expands to various addresses/networks recommended
                            # to be blocked. This is the default.

  ## If 'true', close established calls on expiry of temporary TURN credentials:
  strict_expiry: false      # This is the default.

  ## Logging configuration:
  log_level: info           # critical | error | warning | notice | info | debug
  log_rotate_size: 10485760 # 10 MiB (default: unlimited, i.e., no rotation).
  log_rotate_count: 10      # Keep 10 rotated log files.
  log_dir: stdout           # Enable for logging to the terminal/journal.

  ## See: https://eturnal.net/doc/#Module_Configuration
  modules:
    mod_log_stun: {}        # Log STUN queries (in addition to TURN sessions).