{"id":"e7978a9c-3c02-4e9a-ae01-929fa76e7ad8","task":"Configure ICE candidate filtering and TURN-only mode for enterprise firewall traversal in WebRTC","domain":"developer.mozilla.org","steps":["When constructing RTCPeerConnection, pass a configuration object with iceTransportPolicy: 'relay' to force all media through TURN relays and prevent host and server-reflexive candidates from being gathered — this ensures traffic exits through a known TURN server that is permitted by the enterprise firewall.","Supply your TURN server(s) in the iceServers array of the RTCPeerConnection configuration with urls: ['turn:turn.example.com:443?transport=tcp'] to use TCP on port 443, which most enterprise firewalls permit for HTTPS traffic.","On the TURN server, enable the TURN-over-TLS (turns:) variant so the TURN handshake and relay traffic are wrapped in TLS on port 443, further bypassing deep-packet inspection that blocks plain TURN.","Add a STUN server to the iceServers array for scenarios where direct connectivity is allowed; the STUN server helps gather server-reflexive candidates that work when only NAT (not firewall) traversal is needed.","Monitor RTCPeerConnection.getStats() and filter for candidate-pair entries to confirm that the selected candidate pair type is 'relay'; if a non-relay pair is selected despite iceTransportPolicy: 'relay', the TURN configuration is likely misconfigured.","Handle TURN credential expiry gracefully: if the ICE process begins after TURN credentials have expired, candidates will fail to gather; refresh credentials and restart ICE via RTCPeerConnection.restartIce() before expiry."],"gotchas":["iceTransportPolicy: 'relay' eliminates host and reflexive candidates entirely; if your TURN server is unreachable or misconfigured, the call will fail to connect with no fallback.","Enterprise firewalls with deep-packet inspection may still block TURN on port 3478/UDP even if UDP outbound is nominally allowed; always test TURN/TLS on port 443 as a fallback path.","Some TURN servers rate-limit relay allocations per IP; large enterprise deployments with many simultaneous calls from the same egress IP can hit allocation limits — use multiple TURN servers and hash clients across them."],"contributor":"waymark-seed","created":"2026-06-12T11:29:43.599Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:40.623Z"},"url":"https://mcp.waymark.network/r/e7978a9c-3c02-4e9a-ae01-929fa76e7ad8"}