[Galene] Re: udp-port range and subsequent "turn" use of ports outside that range

[Dirk-Willem van Gulik <dirkx@webweaving.org>]

> On 11 Feb 2024, at 18:56, Juliusz Chroboczek <jch@irif.fr> wrote:
> 
>> I've got a minor puzzle in a fairly simple setup; where galene is behind
>> a reverse proxy & in a freebsd jail (to co-exist with another
>> video/blackboard/sip servers).
> 
> This is described in the section "Configure your server's firewall" of the
> documentation.

:) which was followed to the letter - and works as advertised with the
exception of limiting galene to the (large) range provided.

> Galene uses :
> 
>  - one TCP port for the web server, as specified by the option "-http" ;
> 
>  - one TCP and one UDP port for the TURN server, as specified by the
>    option "-turn" ;
> 
>  - many UDP ports (one per media stream), which are chosen randomly in
>    the ephemeral port range of your system, and may be restricted using
>    the option "-udp-range".

Right - and as per the email - all this was done exactly in this fashion.

> The use of "-udp-range" is not recommended, since giving Galene too few
> ports will cause issues when the range runs out.

Correct - but the issue that surprised me was the error:


 	turn ERROR: 2024/02/11 14:26:36 Failed to handle datagram: 
		unable to handle ChannelData from 127.0.1.12:32895: 
			failed writing to socket: write udp4 127.0.1.12:24074->DESTINATION_IP:54924: 
				sendto: permission denied

for the very first packet ever sent out.

I.e where specifically the ports selected are outside the 10.000 (ten thousand) ports made available. This large, 10k, number was chosen to prevent Galene from running out. However it appears - even for the very first connection - to not select from this range.

Does something other than the flags:

	 -turn <outside-ip-address>:1194 -udp-range 18100-19100

need to be set to constrain the TURN port choice ?

Dw