Run your own Coturn TURN and STUN server from a pre-configured image, so WebRTC and VoIP calls still connect behind strict NATs and firewalls. Media is relayed by a server in your own cloud account, with no per-minute relay fees.
Coturn is an open-source TURN and STUN server. STUN helps two devices discover their public address so they can connect directly. When a restrictive NAT or corporate firewall makes that impossible, TURN relays the media between them. Without a TURN server, those users simply get a failed call.
One server for address discovery and for relaying media when direct connections fail.
TURN over UDP and TCP on 3478, and TURN over TLS on 5349.
A static auth secret generates short-lived usernames and passwords with HMAC-SHA1.
Jitsi Meet, Janus, mediasoup, LiveKit, Pion and anything that uses standard ICE.
Point your domain at the server and secure it with a Let's Encrypt certificate.
No per-minute or per-GB relay billing, and media stays in your own account.
A manual Coturn setup means firewall rules, SSL certificates, credential settings and tuning turnserver.conf. The marketplace image ships with all of that done and tested.
Subscribe on AWS Marketplace or Google Cloud Marketplace and enter your domain, admin email, TURN realm and a strong static auth secret.
Create a DNS A record for your TURN domain with the server's public IP, and wait for it to propagate.
On AWS this happens automatically for Route 53 domains. Otherwise SSH in, run the certificate script and restart Coturn.
Generate test credentials from your secret, check them in the Trickle ICE tool, then add the TURN URLs to your WebRTC app.
An AMI on AWS Marketplace, launched into your own AWS account with a CloudFormation stack.
Launch on AWS 
The same TURN server as a Google Cloud Marketplace image, deployed into your own GCP project.
Launch on Google Cloud These are the firewall rules the Google Cloud image sets up. If calls fail to relay, check that the UDP relay range is open.
| Service | Ports | Protocol |
|---|---|---|
| STUN / TURN | 3478 | UDP and TCP |
| TURN over TLS (TURNS) | 5349 | TCP |
| Media relay range | 49152-65535 | UDP |
| Let's Encrypt HTTP challenge | 80 | TCP |
| SSH (administration) | 22 | TCP |
Server size: t3.micro on AWS or e2-small (2 GB RAM) on Google Cloud handles most setups. Choose a larger machine for high-traffic production use.
| Coturn by Meetrix | Twilio Network Traversal | Xirsys | |
|---|---|---|---|
| Hosting | Your AWS account or GCP project | Twilio's cloud | Xirsys cloud infrastructure |
| Data control | Media never leaves your account | Twilio relays your media | Xirsys relays your media |
| Pricing model | Cloud compute only, no usage fees | Per-minute relay billing | Per-GB bandwidth billing |
| Data residency | Any region you choose | Twilio data processing applies | Xirsys data processing applies |
Hosted TURN services are quick to start but bill for every relayed minute or gigabyte. Read the full Coturn on Google Cloud comparison →
A TURN server relays WebRTC media when two peers cannot connect directly, usually because of a restrictive NAT or corporate firewall. Without one, those users get a failed call with no clear error. If your app uses WebRTC, you need one.
STUN only helps two peers find their public IP and port so they can try a direct connection. TURN relays the actual media when that direct connection is not possible. It uses more bandwidth, but works on almost any network.
Port 3478 over UDP and TCP for STUN and TURN, TCP 5349 for TURN over TLS, and the UDP relay range 49152-65535. Keep TCP 80 open for the Let's Encrypt challenge and TCP 22 if you want SSH access.
Yes. Coturn is the most widely used TURN server in the Jitsi ecosystem. Point your Jitsi Meet configuration at the server's TURN URL and static auth secret.
Yes, and you should. You enter the domain at launch, point a DNS A record at the server and generate a Let's Encrypt certificate for it.
Edit static-auth-secret in /etc/turnserver.conf, then restart Coturn with sudo systemctl restart coturn.
Let's Encrypt certificates expire every 90 days. Run sudo certbot renew and restart Coturn, or set up a cron job to renew automatically.
Yes. Move to a larger machine type, or run several Coturn instances in parallel for high availability. Meetrix can help design the right setup for your traffic.
A working docker-compose example, the real turnserver.conf settings, and the host networking gotcha.
Coturn with time-limited credentials, so Jitsi calls connect from behind strict corporate firewalls.
Deploying Coturn on AWS with Meetrix: setup, cost savings and where TURN servers are used.
Our WebRTC engineers build and run real-time communication infrastructure every day, from TURN setup to Jitsi integration. Tell us what you need.
Contact us