---
name: "turnserver.conf"
section: "5"
platform: "linux"
package: "turnserver"
version: "0.7.3-5"
release: "Debian 9 (Stretch)"
platforms: ["linux"]
url: "https://new.carta.tech/turnserver.conf"
---

# turnserver.conf(5)

TurnServer configuration file

## NAME

turnserver.conf - TurnServer configuration file

## SYNOPSIS

**/usr/local/etc/turnserver.conf**

## DESCRIPTION

This is the TurnServer configuration file.\
 Here are the configuration options supported.

## OPTIONS

The file contains the following definitions:

- **listen\_address** = { IPv4 address, ... }

  The public IPv4 address of any relayed address (if not set, no relay for IPv4). You can set more than one address, example: listen\_address = { "172.16.2.1", "173.17.2.1" }

  The main advantage to have multiple public IPv4 addresses is to do load sharing.

- **listen\_addressv6** = { IPv6 address, ...}

  The public IPv6 address of any relayed address (if not set, no relay for IPv6). You can set more than one address, example: listen\_addressv6 = { "2001:db8:1::1", "2001:db8:2::1" }

  The main advantage to have multiple public IPv6 addresses is to do load sharing.

- **udp\_port** = number

  The UDP port of the server to listen for incoming connections.

- **tcp\_port** = number

  The TCP port of the server to listen for incoming connections.

- **tls\_port** = number

  The TLS port of the server to listen for incoming connections.

- **tls** = boolean

  Enable or not TLS over TCP connections.

- **dtls** = boolean

  Enable or not TLS over UDP connections. It is an experimental feature of TurnServer and it is not defined by TURN standard.

- **max\_port** = number

  Maximum allocation port number.

- **min\_port** = number

  Minimum allocation port number.

- **turn\_tcp** = boolean

  Enable or not TURN-TCP extension. This extension is documented in RFC6062.

- **tcp\_buffer\_userspace** = boolean

  Enable or not userspace buffering for TURN-TCP extension. If false server will use OS buffering.

- **tcp\_buffer\_size** = number

  TURN-TCP internal buffer size. It is used to bufferize data coming from TCP peer when client does not have sent ConnectionBind.

- **daemon** = boolean

  Run the program as daemon.

- **unpriv\_user** = string

  If the program is run as root or setuid root, the program will drop its privileges to the unpriv\_user privileges.

  To use this feature, create a special user with the adduser command: adduser --system --group turnserver

- **realm** = string

  Realm value (i.e. domain.org).

- **nonce\_key** = string

  Key used to hash nonce.

- **max\_relay\_per\_username** = number

  Maximum number of allocation per username.

- **allocation\_lifetime** = number

  Lifetime of an allocation in second.

- **bandwidth\_per\_allocation** = number

  Bandwidth limit for an allocation in KBytes/s. 0 value means disable bandwidth quota.

- **restricted\_bandwidth** = number

  Bandwidth limit for restricted userse in KBytes/s. 0 value means disable bandwidth limitation.

- **denied\_address {**

  ```
   address = IPv4 | IPv6 address
   mask = bitmask number
   port = number (1 - 65535)
  }
  ```

  Defines an entry for the denied access list. This can appear multiple time. Format is defined as follow:\
   **address** is a string representing an IPv4 or IPv6 address.\
   **mask** is a number representing the bitmask (i.e. 24 is similar as 255.255.255.0, ...).\
   **port** is a number representing the network port. The 0 value means all ports.

  It is strongly recommended to restrict addresses 127.0.0.1 and ::1 if there are private services running on the TURN server.

- **ca\_file** = string

  The pathname of the Certification Authority certificate (required when tls=true).

- **cert\_file** = string

  The pathname of the server certificate (required when tls=true).

- **private\_key\_file** = string

  The pathname of the server private key (required when tls=true).

- **account\_method** = \[file \| db \| ldap ...\]

  The method to retrieve account data. Note that only the "file" method is implemented.

- **account\_file** = string

  The pathname of the account file (required when account\_method=file).

- **mod\_tmpuser** = boolean

  Enable or not mod\_tmpuser which consist of a socket that listen on localhost and external program can create or delete temporary user.

## EXAMPLE

listen\_address = { "172.16.0.1" }

listen\_addressv6 = { "2001:db8::1" }

udp\_port = 3478

tcp\_port = 3478

tls\_port = 5349

tls = true

dtls = false

max\_port = 65535

min\_port = 49152

turn\_tcp = false

tcp\_buffer\_userspace = true

tcp\_buffer\_size = 32768

daemon = false

unpriv\_user = turnserver

realm = "domain.org"

nonce\_key = "hieKedq"

max\_relay\_per\_username = 10

allocation\_lifetime = 1800

bandwidth\_per\_allocation = 150

restricted\_bandwidth = 10

denied\_address {\
   address = "172.1.0.3"\
   mask = 24\
   port = 0

}

denied\_address {\
   address = "127.0.0.1"\
   mask = 8\
   port = 0

}

denied\_address {\
   address = "::1"\
   mask = 128\
   port = 0

}

ca\_file = "/etc/ca.crt"

cert\_file = "/etc/server.crt"

private\_key\_file = "/etc/server.key"

account\_method = "file"

account\_file = "/etc/turnusers.txt

## AUTHOR

Sebastien Vincent \<sebastien.vincent@turnserver.org\>

## SEE ALSO

[**turnserver**(1)](/turnserver/1.md)