Add full TURN relay support for reliable calls from any network
Problem: Calls via FQDN work "sometimes" because STUN-only mode fails behind strict NAT (cellular, Proton VPN, hotel WiFi, corporate firewalls). STUN tells clients their public IP, but can't relay media when direct UDP paths are blocked. TURN relays media as a fallback. Changes: coturn (docker-compose.yml): - Upgraded from STUN-only to full STUN+TURN relay - Uses long-term credential mechanism (--lt-cred-mech) - Credentials shared between coturn and Asterisk automatically - Relay port range 49152-49252 (configurable, ~50 concurrent relayed calls) - Always-on (removed --profile stun gate) - Conditional --external-ip (only set when PUBLIC_IP is provided) Entrypoint (docker/entrypoint.sh): - Auto-detects public IP (ifconfig.me → icanhazip.com → api.ipify.org) - Auto-generates TURN password on first startup (saved to config) - Configures rtp.conf with icesupport + stunaddr + turnaddr + credentials - Updates pjsip.conf external_*_address if public IP changes - Always enables ICE, STUN, and TURN for Docker deployments Main script (easy-asterisk-v0.10.0.sh): - Added TURN_ENABLED, TURN_SERVER, TURN_USERNAME, TURN_PASSWORD to load_config/save_config - repair_core_configs: rtp.conf now includes turnaddr/turnusername/turnpassword when TURN is enabled - Bash device creation: Docker mode defaults to FQDN (TLS) for all new devices - Python device creation: reads TURN_ENABLED, auto-selects FQDN in Docker - Main menu shows TURN status .env.example: - Comprehensive documentation for every setting - DOMAIN_NAME is the only required setting - Port forwarding requirements clearly listed - TURN credentials and relay port range documented The result: `docker compose up -d` gives you a fully working PBX where any SIP client on any network can connect reliably via FQDN:5061. https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
This commit is contained in:
Claude
+68
-33
@@ -1,57 +1,92 @@
|
||||
# ================================================================
|
||||
# Easy Asterisk - Environment Configuration
|
||||
#
|
||||
# Copy this file to .env and modify as needed:
|
||||
# cp .env.example .env
|
||||
# Setup:
|
||||
# 1. cp .env.example .env
|
||||
# 2. Set DOMAIN_NAME (the only required setting)
|
||||
# 3. docker compose up -d
|
||||
# 4. docker exec -it easy-asterisk easy-asterisk
|
||||
#
|
||||
# Then start with:
|
||||
# docker compose up -d # Asterisk only
|
||||
# docker compose --profile stun up -d # Asterisk + STUN server
|
||||
# Port forwarding required on your router:
|
||||
# 5061/tcp → SIP TLS signaling
|
||||
# 3478/udp → STUN/TURN (NAT traversal + media relay)
|
||||
# 3478/tcp → TURN TCP fallback (for restrictive networks)
|
||||
# 10000-20000/udp → RTP media (or your custom range below)
|
||||
#
|
||||
# How it works:
|
||||
# - All SIP clients connect to DOMAIN_NAME:5061 (TLS)
|
||||
# - coturn handles NAT traversal (STUN) and media relay (TURN)
|
||||
# - Works from any network: LAN, cellular, Proton VPN, hotel WiFi
|
||||
# - TURN credentials are auto-generated if TURN_PASSWORD is empty
|
||||
# ================================================================
|
||||
|
||||
# ── Network Mode ─────────────────────────────────────────────
|
||||
# Leave DOMAIN_NAME empty for LAN/VPN mode (recommended for VPN setups)
|
||||
# Set to your FQDN for internet calling mode (requires TLS certs)
|
||||
# ── Domain Name (REQUIRED) ────────────────────────────────────
|
||||
# The FQDN that points to this server's public IP.
|
||||
# This is what SIP clients use to connect.
|
||||
# Example: asterisk.yourdomain.com
|
||||
DOMAIN_NAME=
|
||||
ENABLE_TLS=n
|
||||
|
||||
# Primary network CIDR (auto-detected if empty)
|
||||
# ── Public IP ─────────────────────────────────────────────────
|
||||
# Your server's public IP address.
|
||||
# Leave empty to auto-detect (uses ifconfig.me).
|
||||
# Set manually if auto-detection fails (e.g., behind double NAT).
|
||||
PUBLIC_IP=
|
||||
|
||||
# ── TLS ───────────────────────────────────────────────────────
|
||||
# Always "y" for remote access. Self-signed certs are auto-generated.
|
||||
# For trusted certs (no client warnings), mount your Let's Encrypt
|
||||
# certs into /etc/asterisk/certs/ via docker compose volumes.
|
||||
ENABLE_TLS=y
|
||||
|
||||
# ── Local Network ─────────────────────────────────────────────
|
||||
# Your LAN CIDR. Auto-detected if empty.
|
||||
# Example: 192.168.1.0/24
|
||||
LOCAL_CIDR=
|
||||
|
||||
# ── VPN / VLAN Subnets ──────────────────────────────────────
|
||||
# Set HAS_VLANS=y and list your VPN/VLAN subnets (space-separated)
|
||||
# This tells Asterisk to treat these as local networks
|
||||
# ── Additional Subnets (optional) ─────────────────────────────
|
||||
# Only needed for site-to-site VPNs or VLANs where the server
|
||||
# has a direct route to client IPs (e.g., WireGuard, Tailscale).
|
||||
#
|
||||
# NOT needed for client-side VPNs (Proton, NordVPN, etc.)
|
||||
# - Those clients appear with random public IPs
|
||||
# - TURN handles media relay for them automatically
|
||||
#
|
||||
# Examples:
|
||||
# WireGuard: 10.8.0.0/24
|
||||
# OpenVPN: 10.10.0.0/24
|
||||
# Tailscale: 100.64.0.0/10
|
||||
# Third-party: Check your VPN client for the assigned subnet
|
||||
# WireGuard: VLAN_SUBNETS=10.8.0.0/24
|
||||
# Tailscale: VLAN_SUBNETS=100.64.0.0/10
|
||||
# Multiple: VLAN_SUBNETS=10.8.0.0/24 10.10.0.0/24
|
||||
HAS_VLANS=n
|
||||
VLAN_SUBNETS=
|
||||
|
||||
# ── STUN Server ──────────────────────────────────────────────
|
||||
# For self-hosted coturn (recommended for DNS-filtered networks):
|
||||
# 1. Start with: docker compose --profile stun up -d
|
||||
# 2. Set STUN_SERVER to your server's VPN IP:3478
|
||||
# Example: STUN_SERVER=10.8.0.1:3478
|
||||
# ── TURN/STUN Credentials ────────────────────────────────────
|
||||
# Used by coturn for TURN relay authentication.
|
||||
# If TURN_PASSWORD is empty, a random password is generated on
|
||||
# first startup and saved to /etc/easy-asterisk/config.
|
||||
#
|
||||
# For Google STUN (requires DNS access to stun.l.google.com):
|
||||
# STUN_SERVER=stun.l.google.com:19302
|
||||
#
|
||||
# Leave empty if VPN provides direct routing (no NAT between endpoints)
|
||||
STUN_SERVER=
|
||||
VPN_ICE_ENABLED=n
|
||||
CUSTOM_STUN_SERVER=
|
||||
# These credentials are shared between coturn and Asterisk.
|
||||
# SIP clients do NOT need these - only the server uses them.
|
||||
TURN_USERNAME=easyasterisk
|
||||
TURN_PASSWORD=
|
||||
|
||||
# ── RTP Port Range ───────────────────────────────────────────
|
||||
# ── TURN Relay Port Range ─────────────────────────────────────
|
||||
# Ports coturn uses for media relay. Forward this range on your router.
|
||||
# Default is 100 ports (enough for ~50 simultaneous relayed calls).
|
||||
# Most calls use direct paths; TURN relay is the fallback.
|
||||
TURN_RELAY_MIN=49152
|
||||
TURN_RELAY_MAX=49252
|
||||
|
||||
# ── RTP Port Range ────────────────────────────────────────────
|
||||
# Asterisk's own RTP media ports. Forward this range on your router.
|
||||
# Default: 10000-20000 (10,000 ports)
|
||||
# For constrained environments, reduce to e.g. 10000-10100
|
||||
# For constrained environments: 10000-10200
|
||||
RTP_START=10000
|
||||
RTP_END=20000
|
||||
|
||||
# ── Web Admin ────────────────────────────────────────────────
|
||||
# ── Web Admin ─────────────────────────────────────────────────
|
||||
# HTTP management interface. Access via browser at:
|
||||
# http://your-server:8080/clients
|
||||
#
|
||||
# For HTTPS: put this behind Caddy or nginx reverse proxy,
|
||||
# then set WEB_ADMIN_AUTH_DISABLED=true (let the proxy handle auth).
|
||||
WEB_ADMIN_PORT=8080
|
||||
# Set to true if using a reverse proxy with its own auth
|
||||
WEB_ADMIN_AUTH_DISABLED=false
|
||||
|
||||
Reference in New Issue
Block a user