Skip to main content

eturnal STUN/TURN Server

eturnal STUN/TURN Server is available in the NetActuate Marketplace as a one-click, open-source appliance you can deploy into any NetActuate PoP. Modern standalone STUN and TURN server for WebRTC NAT traversal, from ProcessOne. It is grouped under the Media & Streaming and Networking & Security category.

What It Does​

eturnal is a modern, feature-rich STUN and TURN server for WebRTC: the relay real-time applications need so audio, video and data connect even when peers sit behind NAT or restrictive firewalls. It is built on Erlang/OTP for high concurrency and ships as a self-contained release, so this appliance bundles its own runtime and starts serving within seconds of first boot.

Deployed from the NetActuate marketplace it boots configured from your seeded values: a generated shared secret and an authentication realm. It answers STUN and TURN on port 3478 over both UDP and TCP, and offers TLS on port 5349 with an automatically generated self-signed certificate. Pick the PoP nearest your users on the map; deploying the same listing into more PoPs takes one click per location.

Authentication uses the STUN/TURN REST credential mechanism: your application derives short-lived credentials from the shared secret (username = expiry unix timestamp, password = base64 HMAC-SHA1 of the username with the secret), so no per-user accounts live on the relay. The generated secret is stored in your secret list and is never echoed by any API. Relaying toward loopback, private and link-local ranges is refused by default, and Prometheus metrics are exposed on port 8081 for observability.

Upstream project: https://github.com/processone/eturnal (Apache-2.0 license). eturnal is an independent open-source project by ProcessOne; NetActuate packages the unmodified upstream binary release on Ubuntu 24.04 LTS and is not affiliated with or endorsed by ProcessOne.

Vendor and Project​

eturnal STUN/TURN Server is an open-source project, offered here under the Open Source listing with best-effort community support.

NetActuate supports the underlying infrastructure. Application-level support follows the listing SLA class (open-source, best effort).

Sizing​

vCPURAMDisk
Minimum11 GB10 GB
Recommended22 GB10 GB

No VPU (hardware acceleration) is required for this appliance. Choose a size at deploy based on your expected load.

Configuration Fields​

When you deploy, you provide these fields. They are written into the appliance at first boot.

FieldRequiredDefaultNotes
TURN shared secretNogeneratedGenerated for you and stored in your secret list; never echoed back. Your app derives short-lived TURN REST credentials from it. Stored write-only in your account secret list
Authentication realmYesturn.localThe realm advertised for STUN/TURN authentication (hostname-shaped). With shared-secret auth its value is not security-sensitive.

Using the Appliance​

eturnal is up. STUN/TURN listener: turn:YOUR_VM_IP:3478?transport=udp and ?transport=tcp, TLS on turns:YOUR_VM_IP:5349, realm turn.local. The generated shared secret is in your secret list; derive TURN REST credentials from it (username = expiry unix timestamp, password = base64(HMAC-SHA1(secret, username))). Prometheus metrics: http://YOUR_VM_IP:8081/metrics. Health check on the VM: /usr/local/sbin/mkt-eturnal-health.

FAQ​

Is there a software license fee? No. eturnal STUN/TURN Server is open source and free to run. You pay only for the NetActuate infrastructure and bandwidth.

Which port does the appliance serve on? The primary service is published on port 3478 by default; see the configuration fields for any adjustable ports.

Who supports it? NetActuate operates the underlying infrastructure. The application itself is community-supported open source (best-effort SLA class).

Version and Changelog​

VersionStatusReleased
1.12.2Current (default)2026-07-11

Deploy​

Need Help?​

Contact support@netactuate.com or open a support ticket from the portal.