Do you need a TURN relay?

Skip this entirely for A, B and C. Nothing is streamed over the internet in those, so none of it applies. It is only for D and E.

When Unreal is somewhere else, the video does not travel down the same tunnel as the page. Instead, it finds its own way across the internet, connecting directly between the two machines if it possibly can. Usually, this works and you never think about it. When it cannot, you need a relay.

Here is the whole thing in one picture.

Your router is a receptionist.

Your PC has no public address, so the router takes messages for it.

STUN is asking "what do I look like from outside?"

Free, instant, and the answer is usually all the other side needs to reach you.

Symmetric NAT is a receptionist who invents a new alias for every caller.

The address STUN gives you is valid only for the machine you asked. Tell anyone else and it is already wrong. Corporate networks do this.

TURN is a post office in the middle.

Both sides post to it and it forwards. Always works, because neither side has to find the other.

So: STUN is free and works nearly always. TURN always works and costs you bandwidth, plus one extra hop of latency. This is why nobody uses TURN unless they must.

How to find out which you have

Do not try to research your network. Just try it, in this order:

Set it up with STUN only — that is the default, with nothing to configure.
Open the stream from the network the kiosk will actually live on. Test in the real building, on the real Wi-Fi or cable, not at your desk or on your phone.
Watch what happens. The page loads and the connection bar says it is connecting. If the avatar appears, you are done and never need TURN. If you sit on a loading state and it times out with no video, you need TURN.

That second outcome, page fine but video never arrives, is the symptom. Nothing else looks like it. If you see it, add a TURN relay and it goes away.

Two networks fail this test often enough to warn about: corporate/guest Wi-Fi, and anywhere the building’s IT has a firewall with rules about video. If your kiosk is going into an office, a bank or a hospital, assume you will need TURN and plan the extra step.

If you run your own relay

We are not security experts. Everything this guide says about relays, tokens and locking things down is what we worked out running our own installations. We wrote it down because it is better than nothing and better than guessing, but it is not a security review. If your kiosk sits on a corporate network, handles anything sensitive, or is subject to somebody’s compliance rules, have a person whose job this actually is look at it. Where we are unsure, we say so rather than sounding confident.

You can rent one, or run coturn on any small cloud VM. One thing matters more than the rest, and it is not obvious:

The relay’s password is handed to every browser that opens your stream page. It has to be, because the browser is what talks to the relay. Treat it as public: anyone who opens your page can use your relay to push their own traffic through your server, on your bandwidth bill.

This is survivable. Instead of trying to keep the password secret, configure two settings on the relay:

a per-connection bandwidth ceiling, set slightly above what your stream actually needs, so one freeloader cannot run at full speed;
switch off TCP relaying (no-tcp-relay in coturn). Video never uses this, but it is the feature making a stolen relay attractive to somebody wanting a free proxy.

Our own relay’s full configuration, with every setting commented and the reasoning written out, is in PromethistLinkPixelStreaming/Samples/Examples/TURN_Relay/, shipped with this plugin. Both settings above are already configured there, and a README covers what goes on the VM. Copy it rather than starting from a blog post.

Note that no-tcp-relay is not the same as coturn’s no-tcp. The latter switches off the TCP listener and the fallback that gets a stream out of a network where only port 443 is open. One is a hardening setting; the other breaks the thing you built the relay for.