Why Doesn’t Google Provide a Free TURN Server?

No such thing as free lunch. Or a free TURN server.

It is now 2017 and WebRTC has been with us for over 5 years now. You'd think that by now people would know enough about WebRTC so that noob questions won't be with us anymore. But that just isn't the case.

One question that comes up from time to time is why doesn't Google (or anyone else for that matter) offer a free TURN server?

Besides the fact that you shouldn't be using free STUN or TURN servers that are out there simply because you have zero way to control them when things go wrong, lets first understand what's the difference between these two servers - or more accurately protocols, since STUN and TURN usually end up being deployed together.

How STUN works

The illustration below should give you the gist of how STUN works:

When STUN is used, the browser or any other WebRTC enabled device sends out a message to the STUN server asking him "who am I?". The idea here that STUN is used to find out your public IP address. This is something your machine doesn't know on its own as this "allocation" happens by the NAT you are behind (and you will almost always be behind a NAT). That information is also dynamic in nature - you can't really rely on the same answer being received each time - or that the pinhole generated by the query itself will stay open.

This is a simple question that the STUN can provide a single answer for. Furthermore, this takes place over UDP, making it lightweight and quick - not even requiring establishing a longstanding connection or having context in place.

Once the browser has the answer, he can share it, and if all else works as expected, he will be receiving media directly.

The STUN's role here was limited to this single question at the beginning.

How TURN works

Here's how TURN works:

When it comes to TURN, we start with a request for binding - our browser is practically asking the TURN server if he can be used as a relay point. And if the TURN server obliges, then it can now be used to receive all media from the other device on the session and relay that to our own browser.

While the initial binding request isn't taxing (though still more expensive on our TURN server than the query sent to the STUN server), the real issue is the media that gets relayed.

If you take a simple WebRTC video session that gets limited to 500kbps or so, then a 15 minute session will end up eating...

That ends up being over 50MB in traffic. Assuming we do only 10 sessions an hour on average on that TURN server, we end up with 360GB in traffic per month. And that for quite a small service. It isn't really expensive, but it does if you scale it up: use more bandwidth per session, have more sessions per hour on average - and you're going to end up with lots of data traffic.

Here's how a recent stress run we've had on testRTC ended up:

For a stress test with 500 participants, split into group of 5 browsers per multiparty call, running for only 6.5 minutes, we ended up with 52Gb of media traffic in each direction. Less than 10 minutes.

Now think what happens if all that traffic need to go through a TURN server. And that TURN server is free for all.

Putting it all together

STUN and TURN are drastically different from each other. We need both in real production WebRTC services. And we usually think of them of a single server entity deployed in the backend - for STUN we simply don't fret about the resource needs it has and focus on what we need to get TURN running in scale and in multiple geographical locations.

It is also standard practice to clamp down on your TURN server and have credentials configured for it. For WebRTC, these credentials need to be ephemeral in nature - created per session on demand and not per user (as often is the case in SIP).

So...

• If you are wondering why there are no free TURN server out there, or good code on github that has TURN already configured for it that works - don't. It makes no sense for anyone to give that for free
• If you happen to bump into a TURN server with user/password credentials that work, then please don't make use of them - someone ends up footing the bill for you - and he is probably doing it without even knowing (he wasn't aware of the abuse potential I am assuming)
• And if you still end up using that TURN server (nasty you) - expect that person to find that out at some point and just shut you out of his server - not something you want happening if you have users for your service
• Cobble up your own TURN servers or use a paid managed WebRTC TURN service. I like the managed alternative here
• Oh - and you will definitely need TURN server in WebRTC - even if you are using media servers

Want to learn more about WebRTC servers?

Tomorrow, I will be launching a free video mini-course. This course explains what servers you will need to deploy for your WebRTC product, what are their machine specifications and what are the tools that are out there to assist you developing them faster.