NextCloud Talk - coturn server - hope for some basic trouble-shooting help 🙏🏻

[jalsco]

I have been using Nextcloud on dietpi ( on rockpi 4) for about 1 year. And it has always been great and never any problems. I mostly use it as a self-hosted Dropbox replacement, for files and photos. Sometimes also for other functions like News.

A 2023 goal is to reduce, or eliminate, my Slack bills. A few weeks ago I started using Nextcloud Talk. Originally I installed it as a Nextcloud app (from inside NC ) , and it seems to also work without any problems (doing chat messages, with file/photo attachments, etc ) , and no config was even required ( I mean as I started from a working NextCloud system).. I was using NC-Talk from web-browser on laptop and also mobile devices. 2 different apps needed for mobile - NextCloud and NextCloud-Talk . The only limitation I noticed was that there is no way to send messages to yourself (something I use alot in Slack - eg to quick copy from laptop to iOS ). But that is not a showstopper.

Next trying to get working - NextCloud Talk - for video and audio calls. The calls RING on the recipient device - but attempts to "answer the call", end up with message "could not connect to the call". Further internet searching reveals that I need some turn server. And my heart filled with warmth when I notice that most of the comments on NetxCloud forums about this are by our own @MichaIng 💖😁 . Then I find the "Nextcloud Talk - already preconfigured with coturn , turn server" in Deitpi-software !! Thinking this is going to be a snap !

So I install NextCloud-Talk (with coturn) from Dietpi-Software.... I open up a Port in my firewall and forward that port to the RockPi.... and then.... it still did not work... I get basically the same result as before I installed NC-Talk-with-coturn, ie calls do ring on the destination device , but attempts to answer them are not successful. In fact, it is slightly worse, like the ringing seems to be a bit delayed, or needs a few attempts before it rings.

Are there some obvious steps that I didn't do ? Does this usually require quite alot of additional config work to make it work ?? Any comments or pointers would be much appreciated 🙏🏻

[MichaIng]

2 different apps needed for mobile - NextCloud and NextCloud-Talk .

At least on Android you can use the Nextcloud Talk app without having the Nextcloud (core) app installed. I'm doing this successfully.

The only limitation I noticed was that there is no way to send messages to yourself (something I use alot in Slack - eg to quick copy from laptop to iOS ).

I just tested it: You can create an otherwise empty conversation, write something there and can read it on the other client/app. However, for this the Notes or Tasks app is better suited.

So I install NextCloud-Talk (with coturn) from Dietpi-Software....

So you were able to do video calls between clients from within and outside of your LAN? A TURN server is required only for this while it is not required (and is not used, even if installed/configured) for video calls if all clients are within your LAN. Also there are types of NATs where TURN is not required but the (automatically pre-configured) STUN server is sufficient. A TURN server is only required if one client is behind a symmetric NAT.

In any case, Nextcloud Talk should first attempt a direct P2P connection without STUN or TURN, attempt to enable P2P with the help of the STUN server if that files, and only use the TURN server if both prior attempts fail. So a configured TURN server should not have any effect for video calls which did work before already.

The typical symptom when a TURN server is needed is that the video call between clients is established, but that there is no video (just black screen) either on both ends or on one end. If only one client is behind a symmetric NAT, then video may work if one client establishes the call, but not if the other one does it.

Please check the following things:

• In Nextcloud Talk settings, hit the little test button behind the TURN server settings line and see whether you get a green tick.
• Assure that the hostname is the external one, as this is used by the clients, not by the server.
• Assure that the port is correct and that you forward the UDP as well as TCP port in your router (as both are configured to be used by default).
• Check the Coturn service logs: journalctl -u coturn

[jalsco]

Hi @MichaIng , thanks again !!!!!! 😁😁

2 separate apps - I use iOS and one team member uses Android. After my advice to her (which you explained was not accurate) she has 2 apps installed. I will look again at that later. As I was wrong about Android (which was only guess), I will check both iOS and Android, maybe can do it all via one app. Thanks for that 👍

Messages to self - Thanks for looking into it ! I cannot easily see how to "make an empty conversation". I assume that means "addressed to is empty". I seem to have option of only: choosing an individual name from the list (ie the other users) OR a group/public conversation .... and must make that choice before I can type any message. I take your point about Notes / Tasks and will investigate those (later), as better suited anyway . Thanks for yr comments 👍

"Within the LAN or external" - I only really tested "external", because only I am inside the LAN. All the other team members are remote to the LAN, so only important for me that the external works. Confirming that "within LAN" works as a diagnostic step, will be a bit tricky because any access to my NC goes via its external address (even when I am inside the LAN). It was just easier (last year) for me to setup my reverseproxy and router forwarding like that. But I assume that LAN-only will work and the problem exists only for external-only, as LAN-only is p2p and does not use the turn server.

THANKS AGAIN - I will check each item in "do the following" after my morning work tasks are completed.

p.s. Can anything be gleaned from this symptom: the video call always RINGS on the recipient device - but when "Accept" is hit, it tries for a while and then reports it cannot connect. ???

[jalsco]

Please check the following things:

In Nextcloud Talk settings, hit the little test button behind the TURN server settings line and see whether you get a green tick.
Assure that the hostname is the external one, as this is used by the clients, not by the server.
Assure that the port is correct and that you forward the UDP as well as TCP port in your router (as both are configured to be used by default).
Check the Coturn service logs: journalctl -u coturn

1. Yes, I get Green Tick ✅
2. Yes, I am using the EXTERNAL hostname ✅
3. I am using port 13478 as my isp only allows above 5000. It is showing the correct port (13478) in NC Talk settings, and Yes, both tcp and udp are FORWARDED and open in my Router. ✅
4. Coturn service logs - shows one error:

                                          =====================================================
Jun 16 01:23:48 batopi turnserver[33682]: 0: : Domain name:
Jun 16 01:23:48 batopi turnserver[33682]: 0: : Default realm: turn.<mydomain> <-- masked for Privacy
Jun 16 01:23:48 batopi turnserver[33682]: 0: : ERROR:
                                          CONFIG ERROR: Empty cli-password, and so telnet cli interface is disabled! Please set a non empty cli-password!
Jun 16 01:23:48 batopi turnserver[33682]: 0: : WARNING: cannot find certificate file: turn_server_cert.pem (1)
Jun 16 01:23:48 batopi turnserver[33682]: 0: : WARNING: cannot start TLS and DTLS listeners because certificate file is not set properly
Jun 16 01:23:48 batopi turnserver[33682]: 0: : WARNING: cannot find private key file: turn_server_pkey.pem (1)
Jun 16 01:23:48 batopi turnserver[33682]: 0: : WARNING: cannot start TLS and DTLS listeners because private key file is not set properly
Jun 16 01:23:48 batopi turnserver[33682]: 0: : NO EXPLICIT LISTENER ADDRESS(ES) ARE CONFIGURED
Jun 16 01:23:48 batopi turnserver[33682]: 0: : ===========Discovering listener addresses: =========
Jun 16 01:23:48 batopi turnserver[33682]: 0: : Listener address to use: 127.0.0.1
Jun 16 01:23:48 batopi turnserver[33682]: 0: : Listener address to use: 192.168.33.11
Jun 16 01:23:48 batopi turnserver[33682]: 0: : =====================================================
Jun 16 01:23:48 batopi turnserver[33682]: 0: : Total: 1 'real' addresses discovered
Jun 16 01:23:48 batopi turnserver[33682]: 0: : =====================================================
Jun 16 01:23:48 batopi turnserver[33682]: 0: : NO EXPLICIT RELAY ADDRESS(ES) ARE CONFIGURED
Jun 16 01:23:48 batopi turnserver[33682]: 0: : ===========Discovering relay addresses: =============
Jun 16 01:23:48 batopi turnserver[33682]: 0: : Relay address to use: 192.168.33.11
Jun 16 01:23:48 batopi turnserver[33682]: 0: : =====================================================
Jun 16 01:23:48 batopi turnserver[33682]: 0: : Total: 1 relay addresses discovered
Jun 16 01:23:48 batopi turnserver[33682]: 0: : =====================================================
Jun 16 01:23:48 batopi turnserver[33682]: 0: : IO method (main listener thread): epoll (with changelist)
Jun 16 01:23:48 batopi turnserver[33682]: 0: : Wait for relay ports initialization...
Jun 16 01:23:48 batopi turnserver[33682]: 0: :   relay 192.168.33.11 initialization...
Jun 16 01:23:48 batopi turnserver[33682]: 0: :   relay 192.168.33.11 initialization done
Jun 16 01:23:48 batopi turnserver[33682]: 0: : Relay ports initialization done

Questions:

• Do I need to setup a SSL cert for turn.<mydomain> ?
• CLI password ?? Do I need to set something for that ( see error message above) that ?
• TELNET ?? Does it also need telnet access opened up, for turn.<mydomain on router ?
• Does it ever need to access turn.<mydomain> on any other ports besides 13478 ? eg 80, 443 or 8080 ? That I have not configured.
• turnserver.conf has #tls-listening-port=5349 and # CLI server port. Default is 5766 -- do these lines need to be uncommented and those ports also opened up ?

Symptoms are :
Audio and/or video calls can be requested. It does ring on the other device.... But either one or both parties cannot "join the call". Text based chat messages via NC Talk are working.

This : https://help.nextcloud.com/t/need-help-nextcloud-talk-always-show-blank-and-fail-to-show-video/155326/5
implies that 80 and 443 also need to be opened for turn.<mydomain> ?? Other parts of that Post am having trouble to understand 🤷🏻‍♂️😢

[jalsco]

I just added the letsencrypt certificates:

Jun 16 03:30:45 batopi systemd[1]: Stopping coTURN STUN/TURN Server...
Jun 16 03:30:45 batopi systemd[1]: coturn.service: Succeeded.
Jun 16 03:30:45 batopi systemd[1]: Stopped coTURN STUN/TURN Server.
Jun 16 03:30:45 batopi systemd[1]: coturn.service: Consumed 3.363s CPU time.
Jun 16 03:30:45 batopi systemd[1]: Starting coTURN STUN/TURN Server...
Jun 16 03:30:45 batopi turnserver[40657]: 0: : 0 bytes per second allowed, combined server capacity
Jun 16 03:30:45 batopi turnserver[40657]: 0: :
                                          RFC 3489/5389/5766/5780/6062/6156 STUN/TURN Server
                                          Version Coturn-4.5.2 'dan Eider'
Jun 16 03:30:45 batopi turnserver[40657]: 0: :
                                          Max number of open files/sockets allowed for this process: 524288
Jun 16 03:30:45 batopi turnserver[40657]: 0: :
                                          Due to the open files/sockets limitation,
                                          max supported number of TURN Sessions possible is: 262000 (approximately)
Jun 16 03:30:45 batopi turnserver[40657]: 0: :

                                          ==== Show him the instruments, Practical Frost: ====
Jun 16 03:30:45 batopi turnserver[40657]: 0: : TLS supported
Jun 16 03:30:45 batopi turnserver[40657]: 0: : DTLS supported
Jun 16 03:30:45 batopi turnserver[40657]: 0: : DTLS 1.2 supported
Jun 16 03:30:45 batopi turnserver[40657]: 0: : TURN/STUN ALPN supported
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Third-party authorization (oAuth) supported
Jun 16 03:30:45 batopi turnserver[40657]: 0: : GCM (AEAD) supported
Jun 16 03:30:45 batopi turnserver[40657]: 0: : OpenSSL compile-time version: OpenSSL 1.1.1k  25 Mar 2021 (0x101010bf)
Jun 16 03:30:45 batopi turnserver[40657]: 0: :
Jun 16 03:30:45 batopi turnserver[40657]: 0: : SQLite supported, default database location is /var/lib/turn/turndb
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Redis supported
Jun 16 03:30:45 batopi turnserver[40657]: 0: : PostgreSQL supported
Jun 16 03:30:45 batopi turnserver[40657]: 0: : MySQL supported
Jun 16 03:30:45 batopi turnserver[40657]: 0: : MongoDB is not supported
Jun 16 03:30:45 batopi turnserver[40657]: 0: :
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Default Net Engine version: 3 (UDP thread per CPU core)

                                          =====================================================
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Domain name:
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Default realm: turn.xxxxxx.xxxxx
Jun 16 03:30:45 batopi turnserver[40657]: 0: : ERROR:
                                          CONFIG ERROR: Empty cli-password, and so telnet cli interface is disabled! Please set a non empty cli-password!
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Config file found: /usr/local/etc/turn_server_cert.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Config file found: /usr/local/etc/turn_server_pkey.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : SSL23: Certificate file found: /usr/local/etc/turn_server_cert.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : SSL23: Private key file found: /usr/local/etc/turn_server_pkey.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : TLS1.0: Certificate file found: /usr/local/etc/turn_server_cert.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : TLS1.0: Private key file found: /usr/local/etc/turn_server_pkey.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : TLS1.1: Certificate file found: /usr/local/etc/turn_server_cert.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : TLS1.1: Private key file found: /usr/local/etc/turn_server_pkey.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : TLS1.2: Certificate file found: /usr/local/etc/turn_server_cert.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : TLS1.2: Private key file found: /usr/local/etc/turn_server_pkey.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : TLS cipher suite: DEFAULT
Jun 16 03:30:45 batopi turnserver[40657]: 0: : DTLS: Certificate file found: /usr/local/etc/turn_server_cert.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : DTLS: Private key file found: /usr/local/etc/turn_server_pkey.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : DTLS1.2: Certificate file found: /usr/local/etc/turn_server_cert.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : DTLS1.2: Private key file found: /usr/local/etc/turn_server_pkey.pem
Jun 16 03:30:45 batopi turnserver[40657]: 0: : DTLS cipher suite: DEFAULT
Jun 16 03:30:45 batopi turnserver[40657]: 0: : NO EXPLICIT LISTENER ADDRESS(ES) ARE CONFIGURED
Jun 16 03:30:45 batopi turnserver[40657]: 0: : ===========Discovering listener addresses: =========
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Listener address to use: 127.0.0.1
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Listener address to use: 192.168.33.11
Jun 16 03:30:45 batopi turnserver[40657]: 0: : =====================================================
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Total: 1 'real' addresses discovered
Jun 16 03:30:45 batopi turnserver[40657]: 0: : =====================================================
Jun 16 03:30:45 batopi turnserver[40657]: 0: : NO EXPLICIT RELAY ADDRESS(ES) ARE CONFIGURED
Jun 16 03:30:45 batopi turnserver[40657]: 0: : ===========Discovering relay addresses: =============
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Relay address to use: 192.168.33.11
Jun 16 03:30:45 batopi turnserver[40657]: 0: : =====================================================
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Total: 1 relay addresses discovered
Jun 16 03:30:45 batopi turnserver[40657]: 0: : =====================================================
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (main listener thread): epoll (with changelist)
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Wait for relay ports initialization...
Jun 16 03:30:45 batopi turnserver[40657]: 0: :   relay 192.168.33.11 initialization...
Jun 16 03:30:45 batopi turnserver[40657]: 0: :   relay 192.168.33.11 initialization done
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Relay ports initialization done
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (general relay thread): epoll (with changelist)
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (general relay thread): epoll (with changelist)
Jun 16 03:30:45 batopi turnserver[40657]: 0: : turn server id=1 created
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (general relay thread): epoll (with changelist)
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (general relay thread): epoll (with changelist)
Jun 16 03:30:45 batopi turnserver[40657]: 0: : turn server id=3 created
Jun 16 03:30:45 batopi turnserver[40657]: 0: : turn server id=0 created
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (general relay thread): epoll (with changelist)
Jun 16 03:30:45 batopi turnserver[40657]: 0: : turn server id=4 created
Jun 16 03:30:45 batopi turnserver[40657]: 0: : turn server id=2 created
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (general relay thread): epoll (with changelist)
Jun 16 03:30:45 batopi turnserver[40657]: 0: : turn server id=5 created
Jun 16 03:30:45 batopi turnserver[40657]: 0: : Total General servers: 6
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (auth thread): epoll (with changelist)
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (auth thread): epoll (with changelist)
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (admin thread): epoll (with changelist)
Jun 16 03:30:45 batopi turnserver[40657]: 0: : SQLite DB connection success: /var/lib/turn/turndb
Jun 16 03:30:45 batopi turnserver[40657]: 0: : IO method (auth thread): epoll (with changelist)
Jun 16 03:30:45 batopi systemd[1]: Started coTURN STUN/TURN Server.
lines 353-401/401 (END)

Certficate warnings gone now, but the symptoms still same.. and the CLI password error still showing in the LOG.

[jalsco]

Hi @MichaIng , any more thoughts on this ?