Coturn: UDP ports firewall rules outbound only

Created on 14 May 2020 · 4Comments · Source: coturn/coturn

Hi we are building a videochat application with webRTC and coturn.
The conturn server is configured to TURN only for testing purposes.

We found that we actually don't need to open the high UDP ports (49152-65535) throw the firewall.
The connection could be established with allowing only outbound connection in these ports.

We just don't really understand why does it works without opening these ports inbound. Coturn could set up the udp connection for mediastream in these ports with hole punching or how?

question

Source

davefej

Most helpful comment

Stateful firewalls can track UDP connections in addition to TCP. If you have an outbound rule for UDP, the firewall recognizes that a device behind it initiatiated the UDP packets and therefore the return traffic is allowed.

jeffbrl on 14 May 2020

👍2

All 4 comments

jeffbrl on 14 May 2020

👍2

Thanks, well I use ufw its stateful :)

But how the TURN can initiate the UDP connection to the webRTC client?
The client is behind NAT and firewalls that's why we use turn, so the client won't respond, because it deny inbound traffic too.

Or Is it also use hole punching like peers when they set up direct connection with stun.

davefej on 14 May 2020

@davefej ICE do with stun probe test. See ICE RFC https://tools.ietf.org/html/rfc5245#section-7