TURN Server Configuration on DigitalOcean - Ensure 100% WebRTC Connectivity

The calls that fail are the ones you never see

WebRTC tries to connect two devices directly. Most of the time it works. Behind a corporate firewall, on a symmetric NAT, or on a mobile network that blocks peer-to-peer traffic, it does not — and the call simply fails. Around 15–20% of users hit this, and they do not report a bug. They decide the app does not work and stop using it.

A TURN server is the fallback that relays media when the direct path is blocked. This service sets one up properly.

🔧 What I do

- Install and configure coturn on your Ubuntu droplet

- Issue SSL certificates through Let's Encrypt, with automatic renewal set up so it does not expire in six months and take your calls down

- Lock down the server: UFW firewall rules and Fail2ban against brute-force attempts

- Configure long-term credential authentication, so your relay is not an open one strangers can use

- Test and verify from a genuinely restrictive network — not just a check that the daemon is running

- Provide the exact integration details for your app: URLs, credentials, ICE server configuration

- Hand over complete documentation

⚙️ The configuration

- Ports: 3478 (TURN), 5349 (TURNS over TLS), 49152–65535 (media relay range)

- Transport: UDP and TCP, plus TLS for networks that only allow 443-style traffic

- Encryption: TLS 1.3

- Auth: long-term credentials, with the rotation approach explained

📋 What you need

- A DigitalOcean account — you create it, you own it, you pay them directly. I will walk you through creating the droplet if you have not done it before

- SSH access for me during setup

- Your app's requirements: expected concurrent calls, and where your users are

💰 What it costs

- To DigitalOcean: $6–$24 per month depending on how much concurrent relay traffic you need. A small app starts at the bottom of that range

- To me: this one-off setup fee

- No monthly fee to me, and no dependency on me afterwards — it is your server

🔑 You own it

This matters more than it sounds. The server is in your account, under your billing, with credentials you hold. Nothing is hosted on my infrastructure and nothing stops working if we never speak again.

Works with

Flutter · React and React Native · native Android and iOS · any WebRTC implementation — the output is standard ICE server configuration, which every WebRTC stack accepts.