Android端React客户端视频通话中Coturn无法正常工作

我们的React视频通话应用遇到异常：使用Metered等付费TURN服务器时完全正常，但切换到自建Coturn服务器后，数据包发送成功，但客户端接收不到数据。该Coturn服务器已通过Trickle Ice检测，我们几乎测试了/etc/turnserver.conf所有配置项并反复检查日志，以下是当前配置和日志内容，求协助排查。

Coturn配置文件 #

min-port=10000
max-port=20000
fingerprint
user=USER:PASSWORD
lt-cred-mech
realm=OUR_DOMAIN
log-file=/var/log/turnserver/turnserver.log
verbose
external-ip=OUR_IP
cli-password=OUR_CLI_PASSWORD

Coturn服务器日志 #

: handle_udp_packet: New UDP endpoint: local addr OUR_IP:9127, remote addr PEER2:26679
3: session 000000000000000001: realm <OUR_DOMAIN> user <>: incoming packet BINDING processed, success
28: handle_udp_packet: New UDP endpoint: local addr OUR_IP:9127, remote addr PEER2:26682
28: handle_udp_packet: New UDP endpoint: local addr OUR_IP:9127, remote addr PEER2:26681
28: session 001000000000000001: realm <OUR_DOMAIN> user <>: incoming packet BINDING processed, success
28: session 000000000000000002: realm <OUR_DOMAIN> user <>: incoming packet BINDING processed, success
28: session 001000000000000001: realm <OUR_DOMAIN> user <>: incoming packet message processed, error 401: Unauthorized
28: session 000000000000000002: realm <OUR_DOMAIN> user <>: incoming packet message processed, error 401: Unauthorized
28: IPv4. Local relay addr: OUR_IP:19045
28: session 000000000000000002: new, realm=<OUR_DOMAIN>, username=<USER>, lifetime=600
28: session 000000000000000002: realm <OUR_DOMAIN> user <USER>: incoming packet ALLOCATE processed, success
28: IPv4. Local relay addr: OUR_IP:12749
28: session 001000000000000001: new, realm=<OUR_DOMAIN>, username=<USER>, lifetime=600
28: session 001000000000000001: realm <OUR_DOMAIN> user <USER>: incoming packet ALLOCATE processed, success
32: session 000000000000000002: refreshed, realm=<OUR_DOMAIN>, username=<USER>, lifetime=0
32: session 000000000000000002: realm <OUR_DOMAIN> user <USER>: incoming packet REFRESH processed, success
32: handle_udp_packet: New UDP endpoint: local addr OUR_IP:9127, remote addr PEER1:38872
32: session 001000000000000002: realm <OUR_DOMAIN> user <>: incoming packet message processed, error 401: Unauthorized
32: IPv4. Local relay addr: OUR_IP:11002
32: session 001000000000000002: new, realm=<OUR_DOMAIN>, username=<USER>, lifetime=600  
32: session 001000000000000002: realm <OUR_DOMAIN> user <USER>: incoming packet ALLOCATE processed, success
32: session 001000000000000002: realm <OUR_DOMAIN> user <USER>: incoming packet BINDING processed, success
32: session 001000000000000001: peer 21.202.221.104 lifetime updated: 300
32: session 001000000000000001: realm <OUR_DOMAIN> user <USER>: incoming packet CREATE_PERMISSION processed, success
32: session 001000000000000001: peer OUR_IP lifetime updated: 300
32: session 001000000000000001: realm <OUR_DOMAIN> user <USER>: incoming packet CREATE_PERMISSION processed, success
33: session 001000000000000001: peer PEER1 lifetime updated: 300
33: session 001000000000000001: realm <OUR_DOMAIN> user <USER>: incoming packet CREATE_PERMISSION processed, success
33: session 000000000000000002: closed (2nd stage), user <USER> realm <OUR_DOMAIN> origin <>, local OUR_IP:9127, remote PEER2:26682, reason: allocation timeout
42: session 001000000000000002: realm <OUR_DOMAIN> user <USER>: incoming packet BINDING processed, success
38: session 001000000000000001: realm <OUR_DOMAIN> user <USER>: incoming packet BINDING processed, success
48: session 001000000000000001: realm <OUR_DOMAIN> user <USER>: incoming packet BINDING processed, success
52: session 001000000000000002: realm <OUR_DOMAIN> user <USER>: incoming packet BINDING processed, success
59: session 001000000000000001: realm <OUR_DOMAIN> user <USER>: incoming packet BINDING processed, success

排查方向 #

1. 防火墙/端口转发问题 #

• 确认服务器防火墙已放行TURN服务端口：9127（UDP/TCP），以及10000-20000范围内的所有UDP端口。
• 如果服务器在NAT环境下，检查路由器是否做了正确的端口转发：将外部IP的9127和10000-20000端口转发到Coturn服务器的对应端口。
• 测试用nc -u OUR_IP 19045（任选一个中继端口）发送数据包，验证客户端是否能收到，或抓包确认中继端口的数据包流向。

2. Coturn配置遗漏项 #

• 配置中未开启TCP支持，部分网络环境下UDP可能被拦截，建议添加：

  listening-port=9127
  tcp-listening-port=9127
  

• 尝试添加relay-ip=OUR_IP明确指定中继IP，避免Coturn绑定到错误的网卡。
• 检查external-ip是否正确设置为服务器的公网IP，若服务器有多个网卡，确保该IP是对外可达的。

3. 会话权限与中继转发问题 #

• 日志中看到PEER1的CREATE_PERMISSION成功，但未看到PEER2针对PEER1的权限请求。需确认两端客户端是否都正确创建了对对方地址的权限。
• 查看是否有数据包通过中继转发的日志，比如handle_udp_packet: relay message相关条目，若没有则说明Coturn未收到需要转发的数据包，可能是客户端发送的目标地址错误。

4. 客户端ICE配置问题 #

• 对比付费TURN服务和自建服务的ICE配置参数，确保TURN URI格式正确：turn:OUR_DOMAIN:9127?transport=udp，并且用户名密码与Coturn配置一致。
• 检查客户端是否正确处理了ICE候选，确认最终选中的是relay类型的候选（而非host或srflx）。

5. 服务器网络环境限制 #

• 部分云服务商可能限制UDP端口的转发，需确认云服务器安全组已开放10000-20000UDP端口。
• 测试服务器到客户端的网络连通性，用traceroute -U PEER1_IP 38872查看UDP路径是否有丢包。

内容的提问来源于stack exchange，提问作者Mohammadsadegh