Nextcloud Talk port blocked

ā„¹ļø Support šŸ’¬ Talk (spreed)
, , ,
1

Hi all,
I have problems with Nextcloud Talk when I try to use it in other companies networks. The needed ports seem to be blocked.

Nextcloud Hub 26 Spring (34.0.1)
Custom Signaling server configured: yes, as defined in AIO
Custom TURN server configured: yes, as defined in AIO
Custom STUN server configured: yes, as defined in AIO

The issue you are facing:

Nextcloud Talk can be reached from outside, with e.g. Smartphone and video is also working.
But from within other companies networks, video is not working. The port 3478 seems to be blocked.

As I understand, the only way to fix this, is to change the ports that are used by stun and turn which then gets quite complicated and may be impossible if I only have one public ip adress.

Is there a documentation how to do it with Nextcloud AIO?

Tkank you!

2

the ports are a setting you pass to the docker image when launching it.

change it there, reconfigure hpb-backend in nextcloud and youā€™re good to go.

3

Thereā€™s a reason Iā€™m looking for instructions on how this works.

Just pretend I have no idea how this works. :wink:

4

okā€¦how do you launch the docker images?

5

Iā€™m using Portainer with this YAML:

services:
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "8080:8080"
    environment:
      - APACHE_PORT=11000
      - NEXTCLOUD_DATADIR=/run/desktop/mnt/host/c/nextcloud_data # Pfad auf C:\nextcloud_data

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer
6

in the environment section add

- TALK_PORT=

donā€™t forget to update your Firewall rules, too :nerd_face:

7

Thank you!
I will try tomorrow. :+1:

8

Unfortunately it still does not work.
MS Teams is working with this customer, but not Talk.
Do you have any idea what ports I could try?
Or does this company block anything than MS on these ports, if thatā€™s possible?

9

Is anybody using Talk on a selfhosted server successfully with large companies?

10

I have unif-network-application in another container and it needs port 3478 to adopt my APā€™s. So I was looking for the same resolution as you, although for another reason perhaps.

First hit brought me to this topic, second was GitHub - nextcloud/all-in-one: šŸ“¦ The official Nextcloud installation method. Provides easy deployment and maintenance with most features included in this one Nextcloud instance. Ā· GitHub which helped me fix it.

  • Edit your stack in portainer, and under ā€˜environmentā€™ you can uncomment and change TALK_PORT value (I set mine to 3479).
  • Restart your nextcloud-aio-mastercontainer
  • Restart your nextcloud-aio-talk I guess, but I restarted all from the AiO interface

Portainer now shows talk it is using port 3479.

11

Iā€™m not entirely sure if you want to deploy it in a large company, or if you just need participants from a large company to connect.

If itā€™s the former, Nextcloud AIO isnā€™t really aimed at large companies, nor is this forum. The community version is intended for up to 100 users. For larger organisations, there is an Enterprise version: All-in-one - Nextcloud.

Regarding the Talk High Performance backend, this doesnā€™t depend on the total number of users in the Nextcloud instance, but rather on the number of participants on a Talk call. If you have many participants, it might be a good idea to run the high-performance backend on a separate server to improve scalability.

In terms of ports, ports 443 and 3478 should be directly accessible from the internet to enable successful connections for external participants. In some environments, it may also be sensible to run a dedicated TURN server on a separate host and configure it to listen on port 443. This could improve connectivity for users behind restrictive firewalls, which is often the case in large companies.

So yes, it is indeed possible that participants from a large company will not able to connect to port 3478 from their clients, even if you correctly configured it and exposed it to the internet.

13

Iā€™m also using AIO and I have also tested with port 3479, as you suggested.
But on my client side (a large company) still only chat works, video is still blocked.

14

Sorry, I probably ran into the barrier of language.
I wanted to say, that we are a small company and we have clients that are large companies. And they are using MS Teams of course.
If I invite them to a meeting in our Netcloud Talk, we can chat but video is blocked.
In general video is working with other smaller clients.
I guess their IT is not blocking unkown adresses on Port 3478 or other ports.

15

Yes, that may well be the case. In larger companies, itā€™s quite common for internet access to be restricted via a proxy server, with outbound traffic often limited to web services on ports 80 and 443/TCP.

In that case, it might be useful to set up a dedicated TURN server listening on port 443/TCP (TLS), and configure Nextcloud Talk to use it.

See also: https://nextcloud-talk.readthedocs.io/en/latest/TURN/#turn-server-and-nextcloud-talk-high-performance-backend

16

As I understand, AIO already has a TURN server that uses port 3478.
With dedicated TRUN server you mean an additional one that listens to 443? Or change the existing one to 443?

Edit: Sorry, now I understand, I guessā€¦
You mean a dedicated TURN server on an different host. Would an additional docker image be sufficient? Do you know a documentation that has more details, how to do it?
I already read the documentation that you have mentioned, but I need more practical advise :wink:

17

Iā€™ve now had an AI generate a step-by-step guide for me:

  1. Create an additional subdomain for the TURN server
  2. Set up a Docker TURN server listening on port 443
  3. Set up a redirect in NPM from the subdomain to this server
  4. Configure Nextcloud to recognize this TURN server
  5. Then take care of the minor details, like setting up certificates

Do you think, that would work?

18

It really depends on the actual reason why users from that company canā€™t connect.

If the only restriction is that outbound connections are limited to port 443, then running a TURN server on port 443 could solve the problem.

However, if all Internet traffic has to go through an explicit HTTP(S) proxy, that may still not work. As far as I know, TURN uses its own protocol (STUN/TURN over TCP or UDP) rather than HTTP, so it generally cannot be relayed through a standard HTTP proxy. In that case, the companyā€™s IT department would need to determine whether direct outbound connections to the TURN server can be allowed.

That also means that proxying TURN through Nginx Proxy Manager most likely wonā€™t work, or at least not in the same way as a standard HTTPS reverse proxy. TURN is a different protocol and cannot simply be reverse-proxied over HTTP(S).

Ideally, you would expose the TURN server directly on port 443/TCP. If thatā€™s not possible on-premises, running the TURN server on a VPS with a public IP is another option.

But again, depending on how exatley they filter traffic, it might still not work. If all Internet traffic is forced through an explicit HTTP(S) proxy, providing a TURN server on port 443 alone may not be sufficient.

19

Yes, I guess, I have to try.
Their IT is not interested in my problems. At the end they try to force me to use Teams.
Edit:
As this all is not so easy to implement, I will need some time to test it.
I will give feedback, if I found a solution.

20

Yeah, it might be worth a try. Still, itā€™s difficult to say without knowing whatā€™s going on at the other end. Also, Iā€™m not actually an expert, since I only use and administer these things for personal use, where you donā€™t normally encounter such obstacles. :wink:

What I can say with confidence is that Nextcloud Talk works best when clients can establish direct connections to the High Performance Backend. However, restrictive firewalls, explicit HTTP(S) forward proxies, or certain types of NAT can interfere with WebRTC connections. While the signaling connection usually works over HTTPS/WebSockets, the media streams use WebRTC (ICE/STUN/TURN), which is not an HTTP-based protocol. A TURN server can help if direct media connections are not possible, provided the clients can connect to the TURN server directly. However, if the company forces all outbound traffic through an explicit HTTP(S) proxy or also blocks access to the TURN server, things become much more difficult, if not impossible.

Also, the fact that Microsoft Teams works there doesnā€™t necessarily tell us much. The company may have explicitly allowlisted Microsoftā€™s services, or they may have configured their firewall and proxy according to Microsoftā€™s published networking requirements. Teams also benefits from Microsoftā€™s global infrastructure, including relay services that are tightly integrated with the Microsoft 365 ecosystem, which can make it more resilient in restrictive enterprise environments. That doesnā€™t necessarily mean a self-hosted WebRTC application such as Nextcloud Talk will work under the same network conditions without additional configuration.