Nextcloud TURN is not healthy, talk calls will not connect off of local network

wwe · February 16, 2026, 8:11pm

chances are high tailscale doesn’t (properly) forward UDP.

I’m not familiar with it but many VPN solutions brake TURN for one or another reason. And even if it would work through VPN - VPN setup is not recommended as you want to setup the shortest possible network path for media - any additional network hop, encryption etc reduces audio and video quality. For this reason I would recommend you expose the TURN server directly, host it separated from your Nextcloud or use paid service e.g. Free WebRTC TURN Server - Open Relay Project | Open Relay Project - Free WebRTC TURN Server

Check if you find something useful in https://github.com/nextcloud/all-in-one/discussions/5439 and

Talk HPB with NPM reverse proxy

If you look at how WebRTC is supposed to work, WebRTC Group Video Call - The Complete Guide for Developers there are three separate roles:

Signaling: just exchanges session info

STUN: helps clients discover their public IP/ports

TURN: relays media when direct peer-to-peer fails

In real-world networks, especially across the internet, many clients can’t connect directly due to NAT or firewalls, so a publicly reachable TURN server is required to relay media.

A reverse proxy like Nginx Proxy Manager doesn’t solve this, because TURN primarily uses UDP and dynamic ports, not just HTTP/TCP.

That’s also why nextcloud.example.com:3478 doesn’t work for you. Even if the port is open on the router, the UDP traffic isn’t actually being forwarded properly to a TURN service that can relay media.

The practical fixes:

Run a real TURN server (e.g., coturn) with a public address

Forward UDP 3478 (and the relay port range) from your router to it

Configure Nextcloud Talk to use that public TURN server

Once that’s in place, WebRTC will try direct P2P first, and when that fails, it will correctly fall back to TURN relay, which is what makes external calls reliable.