Show HN: An Almost Free, Open Source TURN Server
53 comments
·March 28, 2025ggm
99% of this does not depend on Oracle, you can do this on any vm hosting platform you can get. The only point of using Oracle is the price point which will vanish as soon as they can cease using it to build market share. Good to show btw. Nice instructions. They're mostly platform neutral. It might be a different interface to manage on another host of course but the outcome would be much the same.
cookie_monsta
Thanks, and you're exactly right - the Oracle bit is probably the most basic, interchangeable part of the whole stack. The tricky bit there for me was all the ports/firewall configuration which like you say will be the same/very similar anywhere.
For hobby projects like this I have had no complaints with OCI but yeah, you would have to be crazy to use it in production.
markisus
This has got me reading about TURN and it just seems like a huge ugly hack. Two computers want to send UDP to each other. They are electrically connected by sets of physical cables. They could even be down the street from each other. But they don’t know how to get their routers to set the right bits in their translation tables. Instead it’s just easier to send all their traffic through a third computer in another city thousands of miles away or maybe into outer space and back. Have I got it right?
cookie_monsta
From what I understand the real ugly hack is NAT tables thanks to the shortsightedness of IPv4.Everything else flows from there.
Mostly, though, what you are describing is the internet
spease
Basically. I guess part of the issue is that NAT is also used as a security measure, so there are competing interests in making the ports chosen by outgoing UDP packets deterministic to make STUN easy, versus randomizing and restricting return traffic to the original recipient to make attacking harder and STUN impossible.
Sean-Der
For me something only qualifies as a 'huge ugly hack' if a better way exists. I think TURN does the best it can in the constraints that exist!
* TURN handles protocol bridging (TCP <-> UDP)
* TURN is useful for privacy preservation.
* TURN handles NAT Traversal (unfortunate when it comes to this)
* TURN is used for security in some cases. It sits at the edge and clients create allocations
markisus
Oh I thought TURN was mainly about the NAT traversal. Can you elaborate on the other points? Especially security and privacy?
mtud
Without TURN, two clients that want to do streaming communication connect directly to each other, letting both ends know things like IP addresses, supported protocols, and other fingerprintable features. This was the norm for a long time - “I got your IP, I know where you live”
dartos
Even if it is mainly about NAT, how else would you do NAT traversal?
thebruce87m
> They are electrically connected by sets of physical cables.
Pedantic: Fibre and wireless do not fit this criteria, but I still agree with the spirit.
mystified5016
Extra pedantic: Ethernet cables are galvanically isolated at both ends. There is no electrical connection at all.
0xFF0123
I guess we can say both instances are electromagnetically attached. But then, basically everything is.
SahAssar
That isolation is within the devices, so the devices are still electrically connected, right?
XorNot
Yep. But this is what IPv6 was supposed to solve.
alwayslikethis
NAT may go away, but stateful firewalls won't. There will still be many environments where you can't easily get a point to point connection even though the IP is addressable and there is a route.
markisus
Won’t the firewall know to let return traffic through if my computer explicitly sends a request first?
markisus
I don’t know much about IPv6 but it seems like even if we are stuck with IPv4 we could still make some sort of protocol where my computer could manipulate the NAT table entries allocated to it. Maybe something like DHCP but it deals with ports.
mindcrime
Isn't something like that what UPnP / zeroconf is supposed to do[1][2]?
[1]: https://en.wikipedia.org/wiki/Universal_Plug_and_Play
[2]: https://en.wikipedia.org/wiki/Zero-configuration_networking
Uptrenda
Respect++ for what you said about Peerjs. I used those servers myself for testing when I wrote my own TURN client and always felt a little bad about it. But it saved me tons of time before setting up my own. Now I have my own server (though not as well setup as yours -- your guide is good.)
This is a valuable contribution. IMO, the Internet needs more STUN, TURN, and MQTT servers. It's even more valuable if they support as many protocols as possible and have IPv4 / IPv6. For STUN -- running it with two IPs means it can support bind requests which is necessary for testing NAT types.
cookie_monsta
Oh, thanks that's very kind of you to say. PeerJS is great - it takes a lot of the complexity out of WebRTC and replaces it with a nice, clean API. I think it was an OK decision for them to use Google for their TURN server - really, the best use case for their cloud server is exactly as you described - get your PoC working, and then if you're serious, implement your own
keepamovin
This how to is extremely comprehensive and well written. You have a knack for writing technical tutorials and documentation that are accessible, clear and simple. Well done!
Good prose, clearly not written by AI - respect!
cookie_monsta
Cheers :) I trained and worked as a writer in my previous career, so it's nice to know that at least some of those chops remain. Like every other writer on the planet, I've tried AI for generating some base text that I could then tweak, but I find myself spending so much time rewriting that it's quicker just to do it from scratch...
miki123211
> Additionally, some people have privacy concerns about running their data through anything associated with the big G.
It's important to point out that Web RTC is E2E encrypted, so Google never actually sees your data.
As long as the server you use for signaling is secure, your TURN server may as well be run by the NSA. Since initial signaling is extremely low-bandwidth compared to the actual call, it's usually fine to handle it in your application directly.
THe actual problem with WebRTC is that, in its default setup, every call participant leaks their IP address to everybody else, and you need to upload your data n-1 times for n call participants, making it almost unusable on slow connections. You can mitigate both of these problems with an SFU, essentially a central server that takes in streams from all clients and distributes them further, but then you lose the E2E.
Sean-Der
Great write up! It isn’t free, but the price/what it offers is really great with Hetzner. I switched from digital ocean.
Did you evaluate any other TURN servers? I’m curious about your thoughts of the Elixir and Go ones. Maybe even more exist, I haven’t looked recently
cookie_monsta
oh, no - I am far too lazy to "shop around" for TURN servers and coturn just works and ticks all the open source boxes for me - lots of contributors, recent commits, lots of stars and forks (although these last two aren't as important as the first)
import
How to doc recommends using Oracle Free Tier but they recently had a breach and leaked login server data https://www.bleepingcomputer.com/news/security/oracle-custom...
telesilla
Look at Stunner as a Kubernetes friendly alternative to coturn.
https://github.com/l7mp/stunner
For those of you needing turn services without wanting to host, I can highly recommended Xirsys. Excellent service and while pricing is more than Cloudflare you get better network quality.
If you prefer Cloudflare, unless you are using GBs a day you'll most likely have a $0 monthly bill which makes it an excellent choice for small projects and testing.
nubinetwork
I'm not paying oracle for cloud services, I learned my lesson the hard way, they're still emailing me about random cloud stuff despite me telling them to stop contacting me.
nurettin
If I was tasked to get this up and running, I would probably start with porting the entire thing to postgres.
BiteCode_dev
Can't we have TURN over something like bittorrent or ifps so that it's decentralized ?
deeth_starr_v
Doesn't bittorrent have the tracker that is acting as the glue to connect to peers?
j45
This codebase seems to be a little old - does anyone have it running as is, or close to as is?
Hi HN,
I have been messing around with WebRTC for a few years now but when it comes to the TURN server I never quite got to my gold standard of free, self-hosted and open source. I decided to give it a go using Oracle Cloud Infrastructure's free tier, meaning that my total spend got down to domain name hosting. I know plenty of people have been burnt by Oracle in the past, but I have had servers running on the free tier for 5 years now without so much as a hiccup. Regardless, the concepts will be the same using any cloud based server.
This is the first time I've written up an end-to-end technical how-to like this and the audience I am writing for is really myself - I know just enough about networks and web dev and Linux, etc to get all this running and there are plenty of snippets out there on the web that tell you how to do one thing or another, but nowhere that puts it all together in one place so if I'm explaining what is obvious to you, my apologies - like I say, I'm writing to myself here.
I don't know that this even is a Show HN - @dang, if it isn't, please feel free to recategorise/edit the title.
@Everybody else, I am happy to answer questions if I can but please bear in mind that I am not claiming to be an expert on any of the tech gathered together to make this work.