No wokring ICE candidates returned by the TURN server

ℹ️ Support 💬 Talk (spreed)
1

Turn server not working using Secret Auth
I have tested our turnserver on ICE tester using username password and it worked.
But using the test inside the tak settings. it says No wokring ICE candidates returned by the TURN server.
And on the backend i can see a user <> 401 : Unauthorized .
Please Help
CentOS 8
NextCloud 21

2

Looks like you did not add the TURN secret to the Nextcloud admin panel of the app

3

I did add the TURN static-auth-secret.

4

Got the same issue with 2 NC 21 servers, and found this : TURN "Test this server" always results in "Error: No working ICE candidates returned by the TURN server" · Issue #5563 · nextcloud/spreed · GitHub

5

You need to turn off the Cloudflare reverse proxy.

6

May hosting does not have cloudflare reverse proxy

7

Please check if it is this issue: TURN "Test this server" always results in "Error: No working ICE candidates returned by the TURN server" · Issue #5563 · nextcloud/spreed · GitHub

8

Yes it is.
But there is solution yet

9

Does not look like it. As a workaround, you could use a different browser until the issue is resolved. The GitHub issue explicitly mentions that it only occurs with Safari. If you have problems with other browsers as well, you might have a different problem not releated to this issue…

10

I actually could reproduce it with Firefox, too.

11

Hmm for me it is working fine in Firefox and i did not change anything in my TURN server config for ages. But I have to mention, that my TURN srerver is running on a diffrent server than Nextcloud outside of my local network. But beside of that i don’t think that I did something special with it…

That’s my config. Maybe it is of any help…

# Listener IP address of relay server. Multiple listeners can be specified.
external-ip=IPv4 Address of my Server
external-ip=IPv6 Address of my Server

# TURN listener port for UDP and TCP (Default: 3478).
listening-port=3478

# TURN listener port for TLS (Default: 5349).
tls-listening-port=443

# The default realm to be used for the users when no explicit origin/realm relationship was found in the database. Must be used with long-term
# credentials mechanism or with TURN REST API.
realm=turn.mydomain.tld

# Certificate file.
cert=/etc/coturn/certs/turn.mydomain.tld.fullchain.pem

# Private key file.
pkey=/etc/coturn/certs/turn.mydomain.tld.privkey.pem

# Do not allow an TLS/DTLS version of protocol
no-tlsv1
no-tlsv1_1

# Allowed OpenSSL cipher list for TLS/DTLS connections.
cipher-list="ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-CCM8:DHE-RSA-AES256-CCM:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-A$

# Use custom DH TLS key, stored in PEM format in the file.
dh-file=/etc/coturn/certs/dhparam4096.pem

# Uncomment to use long-term credential mechanism.
lt-cred-mech

# This allows TURN credentials to be accounted for a specific user id.
use-auth-secret

# 'Static' authentication secret value (a string) for TURN REST API only.
static-auth-secret=supersecretstring

# Flag that can be used to disallow peers on the loopback addresses (127.x.x.x and ::1).
no-loopback-peers

# Flag that can be used to disallow peers on well-known broadcast addresses (224.0.0.0 and above, and FFXX:*).
no-multicast-peers

# Uncomment to use fingerprints in the TURN messages.
fingerprint

# Total allocation quota.
total-quota=50

# Set this option to limit the nonce lifetime.
# It defaults to 600 secs (10 min) if no value is provided. After that delay,
12

Hey bb77

may i ask did you follow a specific guide for setup ?

Ive referenced the following with 2 articles little success.

I apologise in advance for asking but do you have any solid reference material that i could review?

would be greatly appreciated.

thank you.
G

https://morph027.gitlab.io/blog/nextcloud-spreed-signaling/

13

Hi @velocity08

I followed this guide (it’s in German) Eigener TURN Server für Jitsi Meet bereitstellen – Aus der IT – Praxis…

I have set it up primarily for Jitsi Meet. However, it also works with Nextcloud Talk without any problems

Please note the following…

  • This is not a full HPE installation, it includes only the TURN server component of the full HPE.

  • My coturn installation runs on a seperate VPS with a public IP address. If you want to run it on the same server as Nextcloud, there is a guide on how to do that in the “HowTo” section of this forum.

  • I’m not an expert on Nextcloud Talk and don’t use it very often, also I do not use it with large groups. I use mainly my Jitsi instance for that purpose…

14

Thanks bb77

appreciate the info and links :slight_smile:

ill check them out shortly.

don’t laugh but about 10 min after i posted asking you for assistance i managed to figure out the issue :slight_smile:

turned out to be a missing security key in the turn server config file.

silly mistake and now it’s all connecting without errors.

just need to test it out now with some users.

thanks again.

have a great evening.

""Cheers
G

1 Like
15

Hello,
since NC 23.0 there is no a single frame that is sent through the network when I test my turnserver from NC Talk administration section.

I used tshark on both servers not a single packet is exchanged between servers.

Do you encounter the same probleme ?