Network and Federation Settings, STUN/TURN Servers

TrueConfAbout 15 min

Network and federation settings, STUN/TURN servers

Here are the minimum steps needed to set up a working corporate communication system:

  1. Select a machine (PC, physical or virtual server) with suitable hardware.

  2. Install TrueConf Server.

  3. Log in to the control panel.

  4. Register the server.

  5. Configure HTTPS (it is used for many key features such as integration with the AI server, conference scheduling, etc.) and specify the external server address (the address of the guest page).

  6. Configure the server availability for the users within the corporate network and, if necessary, for the users from an external network (outside the secure corporate network). ◀️ You are here!

  7. Create user accounts or integrate the server with a directory service via the LDAP/LDAPS protocol.

  8. Install client applications for users and show them how to connect to your server (check the documentation for the desktop application).

In section Network, you can configure certain TrueConf Server settings related to the network:

  • connecting client applications and third-party devices (SIP, H.323, etc.)

  • sending email notifications for users and administrator

  • connection with other instances of TrueConf Server.

Network Settings

In section Network → Network settings, you can specify the IP addresses and ports that the client applications downloaded from TrueConf Server will use to try to connect. By default, only the IP address of the machine where TrueConf Server is installed is used for this purpose.

Client applications always connect to TrueConf Server over the only TCP port (4307is used by default). It is the only port used for signalling, sending authentification data and audio or video streams. An HTTPS port (443 selected by default) is used for displaying the scheduler, accessing real-time meeting management and for API calls. To learn more about this topic, check out the article in our knowledge base.

You can specify a different port when editing the list of IP addresses.

No UDP port can be used for communication between TrueConf Server and a client application.

/docs/server/media/network_settings/en.png

The Internal addresses list contains the addresses and ports that the server will monitor for client application connections. These should be the network interface addresses of the machine where TrueConf Server is installed, or its internal DNS name that resolves to one of the network interfaces by IP. When the Listen on all IP addresses checkbox is selected (it is checked by default), the list is automatically compiled from all such addresses, including virtual ones.

To edit the Internal addresses list:

  1. Clear the checkbox Listen on all IP addresses.

  2. To change the parameters for the specific connection, just click on the line with the selected address.

  3. Use the buttons at the end of the list to add a new address and to save or discard changes.

Addresses from the External addresses list are added in an encrypted form to the name of TrueConf for Windows installer downloaded from the server guest page (refer to application settings). These addresses will be used when the application is launched for the first time. Users of your server and guests, who try to join a webinar, will be unable to connect to the server if the external address will be unavailable to them (however, they will be able to connect, if they specify a correct address in application settings). So, we suggest that in the External addresses list, you should specify the addresses accessible to all users both within the corporate network and from outside. This list can include addresses configured for forwarding to internal addresses, the IP address of your NAT, DNS name, or addresses to which you plan to migrate TrueConf Server in the future (so that the applications which were downloaded before, could connect to the server via the new IP address). If the server will be used only within a local network, this list will not be needed.

If you plan to migrate the server to another IP address, all you need to do is to add the new IP address to the External addresses list beforehand. This will help client apps to store the new address right after the next connection to the server in advance.

To edit the External addresses list, check the Specify checkbox.

After you have changed the address to an external one, go to the section Web → Settings of the server control panel and change the external website address to the public IP (which you specified in the list External addresses). Then, restart the server to allow external users to connect from outside.

This guide does not cover TCP port forwarding or DNS names. You can learn more about these topics in your network equipment manuals.

Federation

Federation mode enables users TrueConf Server to make calls and join conferences with users from other TrueConf Server, as well as exchange chat messages. Federation is available only in the full version of TrueConf Server (for example, when purchasing additional licenses of any type). There is no limit to the number of servers that can be federated. The limitations on conducting group conferences will correspond to the limitations of the TrueConf Server initiating the connection.

/docs/server/media/federation/en.png

Requirements for the correct work of federation:

  1. The server has to be registered with an existing DNS name or you have to specify the real server address with the help of DNS SRV records.

  2. Each federated server has to be accessible to another server by its DNS (FQDN) name, specified during registration, via the main port for the TrueConf protocol (4307 is selected by default). Moreover, it has to be accessible via an HTTPS port (443 is used by default). If a different HTTPS port is configured on one of the servers or a different port is selected for the communication protocol, access to this server should be configured via the selected port instead of the standard one.

  3. Each federated server has to be available to all users of both servers (whose participation in calls and conferences is expected). Each server has to be accessible via an HTTPS port (443 is selected by default) by its domain name which should match the external server name specified during the registration.

  4. IMPORTANT! If you are using a server which is below 5.4.0, it also has to be accessible to all federated users via the main port for the TrueConf protocol (4307 is used by default).

For more details on how the client application can locate the server, refer to the section on configuring automatic connection.

Federation has to be configured on both servers to ensure that they are accessible to each other according to the rules mentioned above. To do it:

  1. In the drop-down list, select the federation mode:

    • Disabled;
    • Allowed for whitelisted servers – meaning federation is available to all servers specified in the list, and only to them;
    • Allowed for all but blacklisted servers – Federation with the server is available to any servers not listed here.

2. Enter the IP addresses or domain names (FQDNs) of the required servers into one of the lists (depending on the federation mode) and click Add.

IP addresses do not have to be specified for federation; only DNS (FQDN) names are needed. Besides, the masks containing an asterisk * are supported, for example, *.example.com, v*.example.com, example.*, *.example.*.

3. Click the Apply button to restart TrueConf Server and save the changes.

Examples of federation in operation

Federated users can access the chat of a virtual room if they were added as participants when the room was created or edited, but not if they were added "on the fly" after the event had already started.

Let us take a look at some examples.

Case 1

To configure federation with a different TrueConf Server instance, e.g., videoserver.example.com, you will need to:

  1. Add videoserver.example.com to the white list

  2. Activate federation on the side of videoserver.example.com in one of the following ways:

    • Add the domain name of your server to the its white list

    • Allow federation with all the servers that have not been added to the black list (make sure that your server is not added to the black list).

3. Make sure that both servers and client applications connected to them, are accessible to each other by domain names.

Case 2

If the server videoserver.example.com is added to the blacklist, you will block all calls between users of your server and all users whose ID takes this form id@videoserver.example.com.

Connection to a conference in federation mode

Connection to a conference (including the cases when federation is used) is fully described in the "Conference page" section.

TURN/STUN servers settings

If needed, specify the addresses of the STUN/TURN servers in section Network → TURN/STUN for fine-tuning NAT traversal.

You can find more information about how WebRTC works in the article on the website.

When adding STUN/TURN, one should consider how this mechanism works:

  1. TrueConf Server acts both as an authorization server and a WebRTC client (a conference participant) at the same time.

  2. For a STUN or TURN server, different parameters can be set for Assigned for: for TrueConf Server, for the browser (WebRTC client), and for client applications TrueConf.

  3. Depending on the role of STUN/TURN, its use will yield different results:

    • If STUN/TURN is assigned for TrueConf Server, it will allow TrueConf Server to obtain an external IP address;

    • If STUN/TURN is assigned for a WebRTC client, participants using browsers will be able to get an external IP address.

    • If STUN/TURN is assigned for the native TrueConf application, then participants using desktop applications, mobile applications, TrueConf Room software terminal, and TrueConf Kiosk application will be able to obtain an external IP address.

4. STUN/TURN can be assigned simultaneously for TrueConf Server and for the WebRTC client (both options are selected in the Assigned for dropdown list).

5. Only one configuration can be added with assignment to TrueConf Server.

6. There is no limit on the number of STUN/TURN servers assigned to a browser and TrueConf client applications.

If the STUN/TURN server role is assigned to users (a browser or a native application), these users will connect to the server in the following way:

  1. Initially, an attempt is made to connect using local addresses TrueConf Server.

  2. If the attempt is unsuccessful, the browser client or native app tries to use external addresses obtained with the help of STUN servers.

  3. If Step 2 also fails, the browser client attempts to establish a connection using TURN servers to proxy secure DTLS traffic.