Coturn: If external-ip is only used for aws?

[ymichaelson]

https://github.com/coturn/coturn/blob/c4477bfddd2cd51de1ad37032ca88330f3c44ed6/docker/coturn/turnserver.conf#L100

In turnserver.conf , I see a world " For Amazon EC2 users", if the external-ip is only used for aws?
I let the stun server run in the k8s cluster, and then expose it to the public network with the nodeport service, but the srflx returned by stun is a gateway address, not the external-ip which I set. My k8s cluster runs on Alibaba Cloud.
I hope someone can help me solve this problem, thank you！！！

[misi]

external-ip is a general config to help solving a coTURN service behind DNAT.

[misi]

I don't know about Alibaba cloud and k8s internal setup, and How the SLB load balancer works..

[kskewes]

So far I've been able to get coturn 4.5.1.1 to run STUN in Kubernetes exposed directly like this:

apiVersion: v1
kind: Service
metadata:
  name: coturn-stun-public-udp
spec:
  selector:
    app.kubernetes.io/name: coturn
  externalTrafficPolicy: Local
  ports:
  - name: stun
    port: 3478
    protocol: UDP
    targetPort: 3478
  - name: stun2  # for RFC 5780 but doesn't seem to make a difference
    port: 3479
    protocol: UDP
    targetPort: 3479
  type: LoadBalancer

I'm not sure all the below settings are required.

apiVersion: v1
kind: ConfigMap
metadata:
  name: coturn-stun
data:
  turnserver.conf: |
    no-cli
    cli-password="should-use-encrypted-pass-here"
    stun-only
    listening-ip=0.0.0.0
    listening-port=3478/UDP
    alt-listening-port=3479/UDP
    pidfile=

I haven't been able to get nginx-ingress to correctly rewrite the client's source IP address and coturn always sees nginx-ingress pod's IP as source.

The Deployment object doesn't have anything unusual or specific to coturn in it.

[ymichaelson]

@kskewes thank you, I solved this problem by setting this option "externalTrafficPolicy: Local" in stun service. It seems to mean that stun will use the host network which is deployed behind NAT.