It also seems it is trying to use udp ports on the galene side that are not in the udp-range I use in the command line: État ICE Nommé Sélectionné Candidat local Candidat distant inprogress false false my.lo.ca.lip:37763/udp(host) [non-proxied] ww.xx.yy.zz:45618/udp(relay) So it's trying to use udp 45618 on the galene side, which in not in the 18100-19100 range I specified and allowed on the firewall. Is this expected ? Franck Le jeudi 24 octobre 2024, 10:11:27 CEST Franck Routier via Galene a écrit : > Hi, > > using about:webrtc in firefox, I see quite a lot of attempts to initiate ICE / STUN communication on different addresses and ports. > It seems to finally communicate, but fails with an error: > > STUN-CLIENT(relay(IP4:my.lo.ca.lip:60534/UDP|IP4:ww.xx.yy.zz:1194/UDP)::TURN): Received response; processing > STUN-CLIENT(relay(IP4:my.lo.ca.lip:60534/UDP|IP4:ww.xx.yy.zz:1194/UDP)::TURN): XOR-MAPPED-ADDRESS is bogus > STUN-CLIENT(relay(IP4:my.lo.ca.lip:60534/UDP|IP4:ww.xx.yy.zz:1194/UDP)::TURN): Error processing response: Invalid data, stun error code 0. > Inconsistent message method: 103 expected 001 > ICE(PC:{247ed162-d0e5-4dfc-a5bc-7c7429fd06be} 1729756871462370 (id=57982058498 url=https://galene.mydomain.net/group/visio/)): Message does not correspond to any registered stun ctx > > Does this make any sense to someone ? > > Thanks > Franck > > > Le mercredi 23 octobre 2024, 08:42:33 CEST Franck Routier a écrit : > > Hi, > > > > I'm trying to setup a galene instance in the following context: > > > > * one physical server (hosted at OVH) with public IP ww.xx.yy.zz > > * on this server, incus (https://linuxcontainers.org/incus/docs/main/) is used to handle different containers: galene is in one of this containers (running Ubuntu) > > * another container is running nginx as a reverse proxy > > * dns name galene.mydomain.net points to ww.xx.yy.zz > > > > What I did is: > > > > * on the main server, forward ports tcp/1194, upd/1194 and udp/18100-19100 to same ports on galene container > > (I tested with netcat that this port forwarding is effective) > > > > * on nginx, proxypass url https://galene.mydomain.net to galene container on port 10000: > > > > server { > > if ($host = galene.mydomain.net) { > > return 301 https://$host$request_uri; > > } > > listen 80; > > server_name galene.mydomain.net; > > return 301 https://$host$request_uri; > > } > > > > server { > > listen 443 http2 ssl; > > server_name galene.mydomain.net; > > > > location / { > > proxy_pass http://10.87.94.201:10000/; > > proxy_set_header Host $http_host; > > proxy_set_header X-Forwarded-Host $host:$server_port; > > proxy_set_header X-Forwarded-Server $host; > > proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; > > proxy_set_header X-Real-IP $remote_addr; > > proxy_set_header Upgrade $http_upgrade; 188.165.192.106:45618/udp(relay) > > proxy_set_header Connection "Upgrade"; > > } > > > > ssl_certificate /etc/letsencrypt/live/several.mydomain.net/fullchain.pem; # managed by Certbot > > ssl_certificate_key /etc/letsencrypt/live/several.mydomain.net/privkey.pem; # managed by Certbot > > > > * on galene container, systemd service is launched with 'galene -http 10.87.94.201:10000 -insecure -turn ww.xx.yy.zz > > :1194 -udp-range 18100-19100' > > > > systemctl status galene says: > > > > ● galene.service - Galene > > Loaded: loaded (/etc/systemd/system/galene.service; enabled; preset: enabled) > > Drop-In: /run/systemd/system/service.d > > └─zzz-lxc-service.conf > > Active: active (running) since Tue 2024-10-22 11:57:07 UTC; 18h ago > > Main PID: 535 (galene) > > Tasks: 17 (limit: 76943) > > Memory: 4.9M (peak: 9.5M) > > CPU: 2.413s > > CGroup: /system.slice/galene.service > > └─535 /home/ubuntu/galene/galene -http 10.87.94.201:10000 -insecure -turn ww.xx.yy.zz:1194 -udp-range 18100-19100 > > > > Oct 22 11:57:07 galene galene[535]: 2024/10/22 11:57:07 Starting built-in TURN server on ww.xx.yy.zz:1194 > > Oct 22 11:57:07 galene galene[535]: 2024/10/22 11:57:07 Relay test successful in 12.038506ms, RTT = 162.921µs > > Oct 22 14:54:17 galene galene[535]: turn ERROR: 2024/10/22 14:54:17 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header > > Oct 22 18:00:47 galene galene[535]: turn ERROR: 2024/10/22 18:00:47 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header > > Oct 22 21:26:00 galene galene[535]: turn ERROR: 2024/10/22 21:26:00 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header > > Oct 22 22:37:18 galene galene[535]: turn ERROR: 2024/10/22 22:37:18 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header > > Oct 22 23:57:07 galene galene[535]: 2024/10/22 23:57:07 Relay test successful in 18.841846ms, RTT = 203.679µs > > Oct 23 01:02:12 galene galene[535]: turn ERROR: 2024/10/23 01:02:12 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header > > Oct 23 05:03:13 galene galene[535]: turn ERROR: 2024/10/23 05:03:13 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header > > Oct 23 06:29:59 galene galene[535]: turn ERROR: 2024/10/23 06:29:59 Failed to handle datagram: failed to create stun message from packet: unexpected EOF: not enough bytes to read header > > > > Now, I can access the web UI, but it seems RTC cannot be established. > > > > What am I missed ? > > I'm not a network wizard, any help is appreciated :-) > > > > Franck > > > > > >