something wrong about NAT?

Author: ydqsbfsyiCreated Apr 24, 2026Updated Jun 13, 2026

Hi,

In my VPS, I've built my own Simplex Chat servers (all with docker): message, file and voice/audio chat ice server. Everything works except the last ice server - if devices are in the same NAT, voice/audio chat is fine, but if not, it stucks at "connecting...".

For ice server, I'm using coturn docker. I've tried both simply ip and hostname tls. The following is with hostname tls.

Could anybody please tell me what is wrong?

my docker-compose.yml:

services:
  coturn:
    image: coturn/coturn:latest
    container_name: simplex-ice
    restart: always
    ports:
      - "3478:3478/udp"
      - "3478:3478/tcp"
      - "5349:5349/udp"
      - "5349:5349/tcp"
      - "49152:65535/udp"
    volumes:
      - ./turnserver.conf:/etc/coturn/turnserver.conf:ro
      - ./turnserver-logs:/var/log/turnserver
      - /etc/letsencrypt/live/ice.****.eu.org/fullchain.pem:/etc/coturn/certs/fullchain.pem:ro
      - /etc/letsencrypt/live/ice.****.eu.org/privkey.pem:/etc/coturn/certs/privkey.pem:ro

my turnserver.conf:

listening-ip=0.0.0.0
#external-ip=142.***
realm=ice.****.eu.org
listening-port=3478
tls-listening-port=5349
cert=/etc/coturn/certs/fullchain.pem
pkey=/etc/coturn/certs/privkey.pem
fingerprint
lt-cred-mech
user=admin:admin
cli-password=admin
log-file=/var/log/turnserver/turn.log
min-port=49152
max-port=65535
stale-nonce

log file:

0: (1): INFO: log file opened: /var/log/turnserver/turn_2026-04-24.log
0: (1): WARNING: Bad configuration format: no-loopback-peers
0: (1): INFO: Listener address to use: 0.0.0.0
0: (1): WARNING: Bad configuration format: no-loopback-peers
0: (1): INFO: System cpu num is 1
0: (1): INFO: System enable num is 1
0: (1): INFO: Configured cpu num is 2
0: (1): WARNING: Bad configuration format: no-loopback-peers
0: (1): INFO: Coturn Version Coturn-4.9.0 'Gorst'
0: (1): INFO: Max number of open files/sockets allowed for this process: 524288
0: (1): INFO: Due to the open files/sockets limitation, max supported number of TURN Sessions possible is: 262000 (approximately)
0: (1): INFO: 

==== Show him the instruments, Practical Frost: ====

0: (1): INFO: OpenSSL compile-time version: OpenSSL 3.5.4 30 Sep 2025 (0x30500040)
0: (1): INFO: TLS 1.2 supported
0: (1): INFO: TLS 1.3 supported
0: (1): INFO: DTLS 1.2 supported
0: (1): INFO: TURN/STUN ALPN supported
0: (1): INFO: Third-party authorization (oAuth) supported
0: (1): INFO: GCM (AEAD) supported
0: (1): INFO: SQLite supported, default database location is /var/lib/coturn/turndb
0: (1): INFO: Redis supported
0: (1): INFO: PostgreSQL supported
0: (1): INFO: MySQL supported
0: (1): INFO: MongoDB supported
0: (1): INFO: Default Net Engine version: 3 (UDP thread per CPU core)
0: (1): INFO: Domain name: 
0: (1): INFO: Default realm: ice.****.eu.org
0: (1): ERROR: CONFIG: Empty cli-password, and so telnet cli interface is disabled! Please set a non empty cli-password!
0: (1): WARNING: cannot find private key file: /etc/coturn/certs/privkey.pem (1)
0: (1): WARNING: cannot start TLS and DTLS listeners because private key file is not set properly
0: (1): INFO: Certificate file found: /etc/coturn/certs/fullchain.pem
0: (1): INFO: Private key file found: /etc/coturn/certs/privkey.pem
0: (1): INFO: Relay address to use: 0.0.0.0
0: (1): WARNING: Cannot create pid file: /var/run/turnserver.pid
0: (1): INFO: pid file created: /var/tmp/turnserver.pid
0: (1): INFO: IO method: epoll (with changelist)
0: (1): INFO: RFC5780 disabled! /NAT behavior discovery/
0: (1): INFO: Wait for relay ports initialization...
0: (1): INFO:   relay 0.0.0.0 initialization...
0: (1): INFO:   relay 0.0.0.0 initialization done
0: (1): INFO: Relay ports initialization done
0: (1): INFO: Total General servers: 2
1: (10): DEBUG: turn server id=1 created
1: (9): DEBUG: turn server id=0 created
1: (1): INFO: Total auth threads: 3
1: (1): INFO: prometheus collector disabled, not started
299: (1): INFO: Terminating on signal 15
0: (1): INFO: log file opened: /var/log/turnserver/turn_2026-04-24.log
0: (1): WARNING: Bad configuration format: no-loopback-peers
0: (1): INFO: Listener address to use: 0.0.0.0
0: (1): WARNING: Bad configuration format: no-loopback-peers
0: (1): INFO: System cpu num is 1
0: (1): INFO: System enable num is 1
0: (1): INFO: Configured cpu num is 2
0: (1): WARNING: Bad configuration format: no-loopback-peers
0: (1): INFO: Coturn Version Coturn-4.9.0 'Gorst'
0: (1): INFO: Max number of open files/sockets allowed for this process: 524288
0: (1): INFO: Due to the open files/sockets limitation, max supported number of TURN Sessions possible is: 262000 (approximately)
0: (1): INFO: 

==== Show him the instruments, Practical Frost: ====

0: (1): INFO: OpenSSL compile-time version: OpenSSL 3.5.4 30 Sep 2025 (0x30500040)
0: (1): INFO: TLS 1.2 supported
0: (1): INFO: TLS 1.3 supported
0: (1): INFO: DTLS 1.2 supported
0: (1): INFO: TURN/STUN ALPN supported
0: (1): INFO: Third-party authorization (oAuth) supported
0: (1): INFO: GCM (AEAD) supported
0: (1): INFO: SQLite supported, default database location is /var/lib/coturn/turndb
0: (1): INFO: Redis supported
0: (1): INFO: PostgreSQL supported
0: (1): INFO: MySQL supported
0: (1): INFO: MongoDB supported
0: (1): INFO: Default Net Engine version: 3 (UDP thread per CPU core)
0: (1): INFO: Domain name: 
0: (1): INFO: Default realm: ice.****.eu.org
0: (1): ERROR: CONFIG: Empty cli-password, and so telnet cli interface is disabled! Please set a non empty cli-password!
0: (1): WARNING: cannot find private key file: /etc/coturn/certs/privkey.pem (1)
0: (1): WARNING: cannot start TLS and DTLS listeners because private key file is not set properly
0: (1): INFO: Certificate file found: /etc/coturn/certs/fullchain.pem
0: (1): INFO: Private key file found: /etc/coturn/certs/privkey.pem
0: (1): INFO: Relay address to use: 0.0.0.0
0: (1): WARNING: Cannot create pid file: /var/run/turnserver.pid
0: (1): INFO: pid file created: /var/tmp/turnserver.pid
0: (1): INFO: IO method: epoll (with changelist)
0: (1): INFO: RFC5780 disabled! /NAT behavior discovery/
0: (1): INFO: Wait for relay ports initialization...
0: (1): INFO:   relay 0.0.0.0 initialization...
0: (1): INFO:   relay 0.0.0.0 initialization done
0: (1): INFO: Relay ports initialization done
0: (1): INFO: Total General servers: 2
1: (10): DEBUG: turn server id=1 created
1: (9): DEBUG: turn server id=0 created
1: (1): INFO: Total auth threads: 3
1: (1): INFO: prometheus collector disabled, not started
262: (1): INFO: Terminating on signal 15
0: (1): INFO: log file opened: /var/log/turnserver/turn_2026-04-24.log
0: (1): WARNING: Bad configuration format: no-loopback-peers
0: (1): INFO: Listener address to use: 0.0.0.0
0: (1): WARNING: Bad configuration format: no-loopback-peers
0: (1): INFO: System cpu num is 1
0: (1): INFO: System enable num is 1
0: (1): INFO: Configured cpu num is 2
0: (1): WARNING: Bad configuration format: no-loopback-peers
0: (1): INFO: Coturn Version Coturn-4.9.0 'Gorst'
0: (1): INFO: Max number of open files/sockets allowed for this process: 524288
0: (1): INFO: Due to the open files/sockets limitation, max supported number of TURN Sessions possible is: 262000 (approximately)
0: (1): INFO: 

==== Show him the instruments, Practical Frost: ====

0: (1): INFO: OpenSSL compile-time version: OpenSSL 3.5.4 30 Sep 2025 (0x30500040)
0: (1): INFO: TLS 1.2 supported
0: (1): INFO: TLS 1.3 supported
0: (1): INFO: DTLS 1.2 supported
0: (1): INFO: TURN/STUN ALPN supported
0: (1): INFO: Third-party authorization (oAuth) supported
0: (1): INFO: GCM (AEAD) supported
0: (1): INFO: SQLite supported, default database location is /var/lib/coturn/turndb
0: (1): INFO: Redis supported
0: (1): INFO: PostgreSQL supported
0: (1): INFO: MySQL supported
0: (1): INFO: MongoDB supported
0: (1): INFO: Default Net Engine version: 3 (UDP thread per CPU core)
0: (1): INFO: Domain name: 
0: (1): INFO: Default realm: ice.****.eu.org
0: (1): ERROR: CONFIG: Empty cli-password, and so telnet cli interface is disabled! Please set a non empty cli-password!
0: (1): WARNING: cannot find private key file: /etc/coturn/certs/privkey.pem (1)
0: (1): WARNING: cannot start TLS and DTLS listeners because private key file is not set properly
0: (1): INFO: Certificate file found: /etc/coturn/certs/fullchain.pem
0: (1): INFO: Private key file found: /etc/coturn/certs/privkey.pem
0: (1): INFO: Relay address to use: 0.0.0.0
0: (1): WARNING: Cannot create pid file: /var/run/turnserver.pid
0: (1): INFO: pid file created: /var/tmp/turnserver.pid
0: (1): INFO: IO method: epoll (with changelist)
0: (1): INFO: RFC5780 disabled! /NAT behavior discovery/
0: (1): INFO: Wait for relay ports initialization...
0: (1): INFO:   relay 0.0.0.0 initialization...
0: (1): INFO:   relay 0.0.0.0 initialization done
0: (1): INFO: Relay ports initialization done
0: (1): INFO: Total General servers: 2
1: (10): DEBUG: turn server id=1 created
1: (9): DEBUG: turn server id=0 created
1: (1): INFO: Total auth threads: 3
1: (1): INFO: prometheus collector disabled, not started
0: (25): INFO: log file opened: /var/log/turnserver/turn_2026-04-24.log
0: (25): WARNING: Bad configuration format: no-loopback-peers
0: (25): INFO: Listener address to use: 0.0.0.0
0: (25): WARNING: Bad configuration format: no-loopback-peers
0: (25): INFO: System cpu num is 1
0: (25): INFO: System enable num is 1
0: (25): INFO: Configured cpu num is 2
0: (25): WARNING: Bad configuration format: no-loopback-peers
0: (25): INFO: Coturn Version Coturn-4.9.0 'Gorst'
0: (25): INFO: Max number of open files/sockets allowed for this process: 524288
0: (25): INFO: Due to the open files/sockets limitation, max supported number of TURN Sessions possible is: 262000 (approximately)
0: (25): INFO: 

==== Show him the instruments, Practical Frost: ====

0: (25): INFO: OpenSSL compile-time version: OpenSSL 3.5.4 30 Sep 2025 (0x30500040)
0: (25): INFO: TLS 1.2 supported
0: (25): INFO: TLS 1.3 supported
0: (25): INFO: DTLS 1.2 supported
0: (25): INFO: TURN/STUN ALPN supported
0: (25): INFO: Third-party authorization (oAuth) supported
0: (25): INFO: GCM (AEAD) supported
0: (25): INFO: SQLite supported, default database location is /var/lib/coturn/turndb
0: (25): INFO: Redis supported
0: (25): INFO: PostgreSQL supported
0: (25): INFO: MySQL supported
0: (25): INFO: MongoDB supported
0: (25): INFO: Default Net Engine version: 3 (UDP thread per CPU core)
0: (25): INFO: Domain name: 
0: (25): INFO: Default realm: ice.****.eu.org
0: (25): ERROR: CONFIG: Empty cli-password, and so telnet cli interface is disabled! Please set a non empty cli-password!
0: (25): WARNING: cannot find private key file: /etc/coturn/certs/privkey.pem (1)
0: (25): WARNING: cannot start TLS and DTLS listeners because private key file is not set properly
0: (25): INFO: Certificate file found: /etc/coturn/certs/fullchain.pem
0: (25): INFO: Private key file found: /etc/coturn/certs/privkey.pem
0: (25): INFO: Relay address to use: 0.0.0.0
0: (25): WARNING: Cannot create pid file: /var/run/turnserver.pid
0: (25): INFO: pid file created: /var/tmp/turnserver.pid
0: (25): INFO: IO method: epoll (with changelist)
0: (25): INFO: RFC5780 disabled! /NAT behavior discovery/
0: (25): INFO: Wait for relay ports initialization...
0: (25): INFO:   relay 0.0.0.0 initialization...
0: (25): INFO:   relay 0.0.0.0 initialization done
0: (25): INFO: Relay ports initialization done
0: (25): INFO: Total General servers: 2
1: (27): DEBUG: turn server id=1 created
1: (26): DEBUG: turn server id=0 created
1: (25): INFO: Total auth threads: 3
1: (25): INFO: prometheus collector disabled, not started
380: (25): INFO: Terminating on signal 2
892: (1): INFO: Terminating on signal 15
0: (1): INFO: log file opened: /var/log/turnserver/turn_2026-04-24.log
0: (1): INFO: Listener address to use: 0.0.0.0
0: (1): INFO: System cpu num is 1
0: (1): INFO: System enable num is 1
0: (1): INFO: Configured cpu num is 2
0: (1): INFO: Coturn Version Coturn-4.9.0 'Gorst'
0: (1): INFO: Max number of open files/sockets allowed for this process: 524288
0: (1): INFO: Due to the open files/sockets limitation, max supported number of TURN Sessions possible is: 262000 (approximately)
0: (1): INFO: 

==== Show him the instruments, Practical Frost: ====

0: (1): INFO: OpenSSL compile-time version: OpenSSL 3.5.4 30 Sep 2025 (0x30500040)
0: (1): INFO: TLS 1.2 supported
0: (1): INFO: TLS 1.3 supported
0: (1): INFO: DTLS 1.2 supported
0: (1): INFO: TURN/STUN ALPN supported
0: (1): INFO: Third-party authorization (oAuth) supported
0: (1): INFO: GCM (AEAD) supported
0: (1): INFO: SQLite supported, default database location is /var/lib/coturn/turndb
0: (1): INFO: Redis supported
0: (1): INFO: PostgreSQL supported
0: (1): INFO: MySQL supported
0: (1): INFO: MongoDB supported
0: (1): INFO: Default Net Engine version: 3 (UDP thread per CPU core)
0: (1): INFO: Domain name: 
0: (1): INFO: Default realm: ice.****.eu.org
0: (1): INFO: Certificate file found: /etc/coturn/certs/fullchain.pem
0: (1): INFO: Private key file found: /etc/coturn/certs/privkey.pem
0: (1): INFO: TLS cipher suite: ALL:!COMPLEMENTOFDEFAULT:!eNULL:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
0: (1): INFO: DTLS cipher suite: ALL:!COMPLEMENTOFDEFAULT:!eNULL:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
0: (1): INFO: Relay address to use: 0.0.0.0
0: (1): WARNING: Cannot create pid file: /var/run/turnserver.pid
0: (1): INFO: pid file created: /var/tmp/turnserver.pid
0: (1): INFO: IO method: epoll (with changelist)
0: (1): INFO: RFC5780 disabled! /NAT behavior discovery/
0: (1): INFO: Wait for relay ports initialization...
0: (1): INFO:   relay 0.0.0.0 initialization...
0: (1): INFO:   relay 0.0.0.0 initialization done
0: (1): INFO: Relay ports initialization done
0: (1): INFO: Total General servers: 2
1: (10): DEBUG: turn server id=1 created
1: (9): DEBUG: turn server id=0 created
1: (1): INFO: Total auth threads: 3
1: (1): INFO: prometheus collector disabled, not started
0: (25): INFO: log file opened: /var/log/turnserver/turn_2026-04-24.log
0: (25): INFO: Listener address to use: 0.0.0.0
0: (25): INFO: System cpu num is 1
0: (25): INFO: System enable num is 1
0: (25): INFO: Configured cpu num is 2
0: (25): INFO: Coturn Version Coturn-4.9.0 'Gorst'
0: (25): INFO: Max number of open files/sockets allowed for this process: 524288
0: (25): INFO: Due to the open files/sockets limitation, max supported number of TURN Sessions possible is: 262000 (approximately)
0: (25): INFO: 

==== Show him the instruments, Practical Frost: ====

0: (25): INFO: OpenSSL compile-time version: OpenSSL 3.5.4 30 Sep 2025 (0x30500040)
0: (25): INFO: TLS 1.2 supported
0: (25): INFO: TLS 1.3 supported
0: (25): INFO: DTLS 1.2 supported
0: (25): INFO: TURN/STUN ALPN supported
0: (25): INFO: Third-party authorization (oAuth) supported
0: (25): INFO: GCM (AEAD) supported
0: (25): INFO: SQLite supported, default database location is /var/lib/coturn/turndb
0: (25): INFO: Redis supported
0: (25): INFO: PostgreSQL supported
0: (25): INFO: MySQL supported
0: (25): INFO: MongoDB supported
0: (25): INFO: Default Net Engine version: 3 (UDP thread per CPU core)
0: (25): INFO: Domain name: 
0: (25): INFO: Default realm: ice.****.eu.org
0: (25): INFO: Certificate file found: /etc/coturn/certs/fullchain.pem
0: (25): INFO: Private key file found: /etc/coturn/certs/privkey.pem
0: (25): INFO: TLS cipher suite: ALL:!COMPLEMENTOFDEFAULT:!eNULL:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
0: (25): INFO: DTLS cipher suite: ALL:!COMPLEMENTOFDEFAULT:!eNULL:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
0: (25): INFO: Relay address to use: 0.0.0.0
0: (25): WARNING: Cannot create pid file: /var/run/turnserver.pid
0: (25): INFO: pid file created: /var/tmp/turnserver.pid
0: (25): INFO: IO method: epoll (with changelist)
0: (25): INFO: RFC5780 disabled! /NAT behavior discovery/
0: (25): INFO: Wait for relay ports initialization...
0: (25): INFO:   relay 0.0.0.0 initialization...
0: (25): INFO:   relay 0.0.0.0 initialization done
0: (25): INFO: Relay ports initialization done
0: (25): INFO: Total General servers: 2
1: (26): DEBUG: turn server id=0 created
1: (27): DEBUG: turn server id=1 created
1: (25): INFO: Total auth threads: 3
1: (25): INFO: prometheus collector disabled, not started
183: (25): INFO: Terminating on signal 2
354: (1): INFO: Terminating on signal 15
0: (1): INFO: log file opened: /var/log/turnserver/turn_2026-04-24.log
0: (1): INFO: Listener address to use: 0.0.0.0
0: (1): INFO: System cpu num is 1
0: (1): INFO: System enable num is 1
0: (1): INFO: Configured cpu num is 2
0: (1): INFO: Coturn Version Coturn-4.9.0 'Gorst'
0: (1): INFO: Max number of open files/sockets allowed for this process: 524288
0: (1): INFO: Due to the open files/sockets limitation, max supported number of TURN Sessions possible is: 262000 (approximately)
0: (1): INFO: 

==== Show him the instruments, Practical Frost: ====

0: (1): INFO: OpenSSL compile-time version: OpenSSL 3.5.4 30 Sep 2025 (0x30500040)
0: (1): INFO: TLS 1.2 supported
0: (1): INFO: TLS 1.3 supported
0: (1): INFO: DTLS 1.2 supported
0: (1): INFO: TURN/STUN ALPN supported
0: (1): INFO: Third-party authorization (oAuth) supported
0: (1): INFO: GCM (AEAD) supported
0: (1): INFO: SQLite supported, default database location is /var/lib/coturn/turndb
0: (1): INFO: Redis supported
0: (1): INFO: PostgreSQL supported
0: (1): INFO: MySQL supported
0: (1): INFO: MongoDB supported
0: (1): INFO: Default Net Engine version: 3 (UDP thread per CPU core)
0: (1): INFO: Domain name: 
0: (1): INFO: Default realm: ice.****.eu.org
0: (1): INFO: Certificate file found: /etc/coturn/certs/fullchain.pem
0: (1): INFO: Private key file found: /etc/coturn/certs/privkey.pem
0: (1): ERROR: TLS: ERROR: no certificate found
0: (1): ERROR: TLS: ERROR: no valid private key found, or invalid private key password provided
0: (1): ERROR: TLS: ERROR: invalid private key
0: (1): INFO: TLS cipher suite: ALL:!COMPLEMENTOFDEFAULT:!eNULL:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
0: (1): ERROR: DTLS: ERROR: no certificate found
0: (1): ERROR: DTLS: ERROR: no valid private key found, or invalid private key password provided
0: (1): ERROR: DTLS: ERROR: invalid private key
0: (1): INFO: DTLS cipher suite: ALL:!COMPLEMENTOFDEFAULT:!eNULL:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
0: (1): INFO: Relay address to use: 0.0.0.0
0: (1): WARNING: Cannot create pid file: /var/run/turnserver.pid
0: (1): INFO: pid file created: /var/tmp/turnserver.pid
0: (1): INFO: IO method: epoll (with changelist)
0: (1): INFO: RFC5780 disabled! /NAT behavior discovery/
0: (1): INFO: Wait for relay ports initialization...
0: (1): INFO:   relay 0.0.0.0 initialization...
0: (1): INFO:   relay 0.0.0.0 initialization done
0: (1): INFO: Relay ports initialization done
0: (1): INFO: Total General servers: 2
0: (10): DEBUG: turn server id=1 created
0: (9): DEBUG: turn server id=0 created
0: (1): INFO: Total auth threads: 3
0: (1): INFO: prometheus collector disabled, not started
386: (1): INFO: Terminating on signal 15
0: (1): INFO: log file opened: /var/log/turnserver/turn_2026-04-24.log
0: (1): WARNING: Bad configuration format: daemonize
0: (1): INFO: Listener address to use: 0.0.0.0
0: (1): WARNING: Bad configuration format: daemonize
0: (1): INFO: System cpu num is 1
0: (1): INFO: System enable num is 1
0: (1): INFO: Configured cpu num is 2
0: (1): WARNING: Bad configuration format: daemonize
0: (1): INFO: Coturn Version Coturn-4.9.0 'Gorst'
0: (1): INFO: Max number of open files/sockets allowed for this process: 524288
0: (1): INFO: Due to the open files/sockets limitation, max supported number of TURN Sessions possible is: 262000 (approximately)
0: (1): INFO: 

==== Show him the instruments, Practical Frost: ====

0: (1): INFO: OpenSSL compile-time version: OpenSSL 3.5.4 30 Sep 2025 (0x30500040)
0: (1): I

Source: coturn/coturn

View original on GitHub View discussion on GitHub