Audio/Video Call Issues with STUN/TURN behind Reverse Proxy (nextcloud-aio-talk) #4592
-
|
Hi, I'm currently testing Nextcloud AIO, and the setup has been smooth so far. Since I have a reverse proxy in my network, I opted to use the SSL certificate from there instead of creating a new one on the Nextcloud instance. This worked well. However, I'm experiencing issues with Nextcloud Talk. While the app works fine for texting, I can't get audio and video calls to work. I suspect the problem is related to DNS resolution. When I use cloud.example.com, it resolves to my HAProxy instead of directly to Nextcloud AIO, where the STUN and TURN container is located. I tried setting up talk.example.com to go directly to Nextcloud AIO, but that didn't work either. Here's the output from https://webrtc.github.io/. I got some private IPs and ports as results: Would it be best to create a separate STUN/TALK container and manually configure it? If not, any suggestions on how to fix this issue? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 6 replies
-
|
You can manually overwrite the stun and turn server in the talk admin settings. E.g. adding a second subdomain and pointing that via cname at the public ip without overwriting it locally should probably make it work. |
Beta Was this translation helpful? Give feedback.
-
|
you can also port forward the stun port to the nextcloud aio server in your firewall. that also works. this however break the split dns scenario |
Beta Was this translation helpful? Give feedback.
-
|
the main issue as far as i can tell is that the reverse proxy needs to forward udp traffic; nginx is capable of from a certain version but i am unsure how the configuration would look like |
Beta Was this translation helpful? Give feedback.
-
|
I been trying to figure this out for a day now. Finally, got it to clear when I used my reverse proxy to send 3478/tcp back to the container. In my setup I have nextcloud.domain.com for nextcloud and talk.domain.com for the talk STUN and TURN server.
With this setup, Talk is working successfully. I have confirmed devices are using the internally set split DNS records to access the host machine directly and use the public records when outside to reach the firewall on port 3478. Despite the working result, the container still shows unhealthy. It seems the container only accepts a response from nextcloud.domain.com:3478/tcp for the health check to pass. I can only get it to show healthy if I add port 3478 as TCP proxy in HAproxy send it back to the host machine. This tells me the container is only checking nextcloud.domain.com:3478/tcp for the health check and not the configured STUN/TURN address or for UDP connectivity. This behavior should be corrected so health check works against the address entered in the admin panel for the STUN/TURN server as well as checking for UDP connectivity. |
Beta Was this translation helpful? Give feedback.
-
|
There is now a fix available with v9.0.0 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel |
Beta Was this translation helpful? Give feedback.
-
Just switched to beta and disabled my TCP 3478 proxy. I can confirm it now shows healthy without the need for TCP 3478 in the reverse proxy. I assume the change was to perform the health check using the address in the talk admin panel? Does it also check UDP or just TCP? |
Beta Was this translation helpful? Give feedback.
You can manually overwrite the stun and turn server in the talk admin settings. E.g. adding a second subdomain and pointing that via cname at the public ip without overwriting it locally should probably make it work.