Pion TURN

A toolkit for building TURN clients and servers in Go

Pion TURN is a Go toolkit for building TURN servers and clients. We wrote it to solve problems we had when building RTC projects.

• Deployable - Use modern tooling of the Go ecosystem. Stop generating config files.
• Embeddable - Include pion/turn in your existing applications. No need to manage another service.
• Extendable - TURN as an API so you can easily integrate with your existing monitoring and metrics.
• Maintainable - pion/turn is simple and well documented. Designed for learning and easy debugging.
• Portable - Quickly deploy to multiple architectures/platforms just by setting an environment variable.
• Safe - Stability and safety is important for network services. Go provides everything we need.
• Scalable - Create allocations and mutate state at runtime. Designed to make scaling easy.

Using

pion/turn is an API for building STUN/TURN clients and servers, not a binary you deploy then configure. It may require copying our examples and making minor modifications to fit your need, no knowledge of Go is required however. You may be able to download the pre-made binaries of our examples if you wish to get started quickly.

The advantage of this is that you don't need to deal with complicated config files, or custom APIs to modify the state of Pion TURN. After you instantiate an instance of a Pion TURN server or client you interact with it like any library. The quickest way to get started is to look at the examples or GoDoc

Examples

We try to cover most common use cases in examples. If more examples could be helpful please file an issue, we are always looking to expand and improve pion/turn to make it easier for developers.

To build any example you just need to run go build in the directory of the example you care about. It is also very easy to cross compile Go programs.

You can also see pion/turn usage in pion/ice

FAQ

Also take a look at the Pion WebRTC FAQ

Will pion/turn also act as a STUN server?

Yes.

How do I implement token-based authentication?

Replace the username with a token in the AuthHandler. The password sent by the client can be any non-empty string, as long as it matches that used by the GenerateAuthKey function.

How do I implement mTLS (mutual TLS) authentication?

You can use client certificates for authentication by checking the TLS connection state in your AuthHandler. See the mutual-tls-auth example for a complete implementation that validates client certificates and matches the certificate's Common Name to the TURN username.

Will WebRTC prioritize using STUN over TURN?

Yes.

RFCs

Implemented

• RFC 5389: Session Traversal Utilities for NAT (STUN)
• RFC 5766: Traversal Using Relays around NAT (TURN): Relay Extensions to Session Traversal Utilities for NAT (STUN)
• RFC 6062: Traversal Using Relays around NAT (TURN) Extensions for TCP Allocations
• RFC 6156: Traversal Using Relays around NAT (TURN) Extension for IPv6

Roadmap

The library is used as a part of our WebRTC implementation. Please refer to that roadmap to track our major milestones.

Community

Pion has an active community on the Discord.

Follow the Pion Bluesky or Pion Twitter for project updates and important WebRTC news.

We are always looking to support your projects. Please reach out if you have something to build! If you need commercial support or don't want to use public methods you can contact us at team@pion.ly

Contributing

Check out the contributing wiki to join the group of amazing people making this project possible

License

MIT License - see LICENSE for full text