Nextcloud Talk not connecting calls

3246

Hi all,

I finally got around to trying Nextcloud talk and while it appears to work fine when I try to connect with Cloudron users outside of my local network it fails.

Both Cloudron users login to Nextcloud Talk (one via web and one via iOS app)
Both users can chat and share
Either user can initiate a new call and the other tries to join
The joining times out

What am I doing wrong and where can I find more documentation about getting Talk working with Cloudron for calls with WAN users?

doodlemania2

@3246 This is likely due to firewalls and NATs from you and your peer. The default installation will require you to add at least a TURN server and, sometimes, a high performance backend. The cloudron turn server works well for getting through NATS.

If you're interested, I offer a TURN and high performance backend service - see https://www.thedoodleproject.com

necrevistonnezr

@3246 See for opened ports: https://docs.cloudron.io/security/ , „Inbound Ports“

3246

@necrevistonnezr thanks, I can see the ports are open and when I try to connect with somebody outside of the network, both of us get the message that the call could not be connected

Ref. 3478, 5349, 50000 - 51000

3246

When I use an external TURN server, it works.

I followed this guide to set it up on DO using Ubuntu 18.04 LTS: https://www.netways.de/blog/2017/08/16/setting-up-a-turn-server-for-nextcloud-video-calls/

micmc

@3246 Wow thankfully it works with external TURN, however it's pretty odd that it doesn't work with the Cloudron one. Apparently, there seems to be something that needs to be looked at more closely.

nebulon

@micmc unfortunately the TURN server on Cloudron cannot run on port 443, which is the most reliable one for webrtc, however nginx is already running there. There is some way to split traffic in nginx, but that is not part of the open source version, it needs some streams feature. So we had to fallback to other ports, which may or may not be blocked by a network. We may have to provide a feature to select which TURN server should be used for apps, internal or external, similar to how we deal with email sending.

robi

@nebulon adding stream support is done by enabling the module config.

See:
https://jitsi.github.io/handbook/docs/devops-guide/turn

Hence you can rev/fwd proxy anything as long as you can pass in the servername for nginx to pivot on.

FYI the stream_core_module is included in Ubuntu enginx-core packages.

P.S. It would be useful for @staff to be aware of the other modules for mail and other services that are available for multi-cloudron functionality.

3246

I'm playing with https://markus-blog.de/index.php/2020/11/20/how-to-run-nextcloud-talk-high-performance-backend-with-stun-turnserver-on-ubuntu-with-docker-compose/ on a Scaleway VM now to see how it works. It would be ace to get Cloudron's proxy to be able to proxy to the TURN/STUN server. Maybe my set up is too complicated (double NAT) and it works more smoothly to run Cloudron on a dedicated VM in a data centre somewhere

micmc

@nebulon said in Nextcloud Talk not connecting calls:

@micmc unfortunately the TURN server on Cloudron cannot run on port 443, which is the most reliable one for webrtc

Yeah, true I always forget this 'limitation' that TURN needs to run on port 443.

We may have to provide a feature to select which TURN server should be used for apps, internal or external, similar to how we deal with email sending.

While being at it that would be a great solution, and for several apps at the same time. +1

3246

@nebulon I just noticed that my custom TURN settings are being overwritten when the app is updated

stun_server
turn_server
TURN server schemes
turn_secret

Looks like signaling_secret is not affected.

I assume this is the expected behaviour but as a user who customises this, I would like my own settings to be honored, please

3246

@micmc said in Nextcloud Talk not connecting calls:

Yeah, true I always forget this 'limitation' that TURN needs to run on port 443.

Where does this come from or where you being sarcastic? (sorry, my translator is not enabled today)

I run my own TURN and STUN servers on port 3478. Maybe I am misunderstanding?

nebulon

@3246 this is not a real requirement but just depends on which network the clients are on. Some public wifis for example would block most ports besides the common ones. TURN on 443 is just a safe bet, since 443 is basically always open.

eganonoa

@3246 @girish mentioned public wifis. I think biggest reason for setting up turn on 443 is that very many (most?) academic and corporate IT systems block everything but 443 for ordinary users. So you'll never get a good connection if you have users accessing the internet there.

Cloudron does indeed overwrite the turn server setting in Nextcloud upon reboot/update of the app. Thankfully with Nextcoud you don't need to reboot to add the turnsever back in. So adding it works.

Sadly that's not the case with other apps - notably matrix - which means those apps will be limited in their videoconferencing capability until the ability to add an external turnserver is added to cloudron.

@girish from my perspective I don't think you need a per-app choice there. Just a global option which turnserver to use across apps. My sense is that people who need an external turnserver for one app (because of users in an academic/corporate setting or using Cloudflare, etc) will need it for them all.

list item

3246

@girish @nebulon is there a way for me to hardcode my own TURN server / HPB? I have to manually check and update three Nextcloud sites every day, which is getting a bit tedious

Pretty please