Configure a self-hosted coturn TURN server for WebRTC NAT traversal

Steps

1. Install coturn on your server and open UDP/TCP port 3478 (STUN/TURN), port 5349 (TLS), and the relay port range 49152-65535 in your firewall.
2. Edit /etc/turnserver.conf: set listening-ip to your server's private IP, external-ip to its public IP, set min-port and max-port to your relay range, and configure realm and the TURN credential (set the shared secret or static username/credential from your dashboard).
3. Enable TLS by pointing tls-cert and tls-pkey at your certificate and key files, then restart the coturn service.
4. In your WebRTC client, supply the ICE server list with both a stun: URL and a turn: URL referencing your server; generate per-user short-lived TURN credentials using HMAC-SHA1 over the username and your shared secret rather than storing static credentials.
5. Test connectivity with a WebRTC ICE candidate trickle test or the Trickle ICE tool at https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/ and confirm relay candidates appear.
6. Monitor relay usage via coturn's built-in STUN/TURN statistics REST endpoint (enable it in config) and set bandwidth quotas per-user to prevent abuse.