Managed WebRTC TURN: The need for speed

What the announcements of Subspace and Cloudflare on their Managed WebRTC TURN services mean for the industry.

In the past couple of months we’ve seen two new entrants to the managed WebRTC TURN business. After stagnation for many years, this small market niche is becoming interesting. REALLY interesting.

TURN and the WebRTC developer ecosystem

TURN servers are used in WebRTC in order to get your sessions connected if there’s no direct route available. I am not going to go into the technical part of it, but I’d say that without TURN servers, not all of your WebRTC sessions will get connected. You don’t need it for all sessions, but for some, you won’t be able to work without it. They are an essential component that has its own category in my WebRTC Developer Tools Landscape.

At the end of the day, TURN servers act as intermediaries by relaying the media between two points.

Roughly speaking, you have 3 alternatives in how you can get these set up:

1. Self host. You can install and host your own TURN servers and manage them on your own. In most cases, this will be by using the open source coturn server
2. Managed. You can use a third party that runs its own TURN servers, giving you access to their servers, paying for the service. Don’t search for free TURN servers - if they exist, then they aren’t worth the money you aren’t paying for them
3. Everything and the kitchen sink. You could just go with a WebRTC CPaaS vendor. These will give you everything you need, including TURN servers and service. An all in one deal

In this article, I will be ignoring the “everything and the kitchen sink” approach. Not because it is bad, but because if you’re just interested in a managed WebRTC TURN, then you probably want to control a bit more of your destination (more on that later).

Challenges of using open source coturn in production

Let's start with the self hosting approach. The leading choice today is to take coturn, a popular open source TURN server, and deploy it on your own. There are one or two other alternatives, but this is by far the most common one.

The challenge though stems from the fact that for TURN the majority of the issues aren’t around integration or development but rather in configuration and maintenance. As such, it falls into the laps of ops, but requires knowledge and understanding of WebRTC.

The main culprit? The fact that you don’t need TURN for each and every session - and that there are 3 different TURN transport protocols, offering a progressive fallback mechanism.

What does that mean?

You install and configure your TURN server. But how do you test that all went well? Just conducting a WebRTC session will not tell you that. If the session succeeded, is it because it didn’t need TURN or because it used your TURN server properly? And if it did use it properly, was that on all 3 different transport protocols?

Configuring TURN is a headache:

• Testing TURN configuration it isn’t straightforward
• Scaling TURN horizontally may seem simple, but it has its own set of challenges
• Geolocating TURN servers properly is tough and tricky when you’re small
• Securing your TURN servers from abuse isn’t hard, but another necessary task. So is monitoring it
• And then there’s the hacking angle to it, as Slack found out in 2018

Managed WebRTC TURN - the early days

In the early days of WebRTC, developers had two main alternatives:

1. DIY - building everything on their own, including the installation and configuration of their TURN servers
2. CPaaS - “outsourcing” all of the WebRTC infrastructure components including their TURN servers to a third party vendor who specializes in it

You either knew what you were doing or didn’t want to know what you were doing.

The initial indication for managed WebRTC TURN service came from two vendors. It started with Xirsys and continued with Twilio.

Xirsys

Xirsys was the first vendor to offer a managed WebRTC TURN service commercially. It was limited to a data center or two when they started, but grew over time.

Today, the Xirsys Cloud service spans 7 regional data centers.

Twilio

Twilio is the most widely known CPaaS vendor out there. It is playing the best of suite game, with its large and growing portfolio of services. One of these products is their Twilio Global Network Traversal Service, a half-hidden product that enables you to leverage their TURN servers for your application without using their other CPaaS and WebRTC products.

At the time of writing, Twilio runs its media over 9 different regions, all on AWS.

Why use a managed WebRTC TURN service?

I guess it is a matter of experience and expertise. Do you really want to deal with questions such as how do you decide which TURN server to connect a user to? How to deal with WebRTC TURN geolocation?

A managed WebRTC TURN service eventually targets the exact pain points and challenges that setting up your own TURN servers pose:

• Someone else takes care of properly configuring the TURN servers (assuming they know what they are doing)
• They take care of scaling this for you, so you don’t need to deal with increases in traffic, at least not on the TURN servers
• You get someone else to decide on geolocation (and do it better than you can for the most part)
• Inherently, managed WebRTC TURN services secure their service from abuse, so that’s also a given - oh - and they’ll provide you with a nice usage dashboard as well

The best thing about managed WebRTC TURN services?

There’s no vendor lock-in.

Switching from one managed WebRTC TURN service to another or to your own self installed servers is a breeze - just change the iceServers configuration on your peer connections in WebRTC and you’re done. Theoretically, that’s a single line of code change.

It is also why I suggest anyone who is building their own WebRTC application to start by using a managed WebRTC TURN service - they can always switch to their own, and the cost of switching next year will be the same as just building it today. And as the lazy person that I am, I will always postpone to tomorrow something that I don’t have to do today.

Managed WebRTC TURN - the post-pandemic version

Then came the pandemic, with its lockdowns, quarantine and the rise in use of WebRTC and any other remote communications technology.

The market stayed roughly the same for managed WebRTC TURN servers, or at least it did until 2021. What happened is that we now have 2 more vendors in this domain: Subspace and Cloudflare. And they are different: they are bigger in the physical footprint they have and they make use of Anycast - an IP addressing and routing scheme used to connect a large set of globally spread servers via a single IP address. This type of a solution also makes things a lot simpler to whitelist when needed.

Subspace GlobalTURN

Subspace offers better connectivity than the open internet. They do that by optimizing the routes your packets go through. What you do is send your packets through their network, which will then figure out the best route.

In 2021, they decided to expand what they are doing to WebRTC as well, offering their GlobalTURN service. With around 100 cities and an Anycast addressing scheme, they offer a global footprint.

For Subspace, this isn’t the first VoIP related product they offer, but it is the first WebRTC related one. Would they move towards hosting media servers as well? I think it is an unlikely path for them.

Cloudflare WebRTC Components

Cloudflare announced their own deployment of a managed WebRTC TURN service called WebRTC Components. Besides it being a TURN service, there’s not much to go by yet.

What we do know is that it relies on Cloudflare’s anycast network spanning 250+ cities.

For Cloudflare, this is the first WebRTC related offering, which was announced alongside a slew of other capabilities, targeted at cloud vendors (their R2 storage which directly competes with AWS S3 for example). There’s a good overview of the disruption path Cloudflare is taking. The WebRTC addition to it is an interesting choice.

Interestingly, I debated the potential of using Cloudflare’s Workers as a TURN service enabler when it was announced. Seems like they decided to build it on their own 😎

Which managed WebRTC TURN service to use?

That should be the question you should ask yourself.

It isn’t about whether you should use a managed WebRTC TURN service or deploy your own - it should be which managed WebRTC TURN service to select. Why? Because this is super simple to adopt and replace with zero vendor lock-in.

Pricing is important, but also global footprint, latency and quality. Then there are things like actually doing its job - the percentage of successful connections you get with it.

It will be interesting to see if and how Xirsys and Twilio address the threat from the newcomers to this market niche. For Xirsys this should be more worrying than it is for Twilio, as that’s one of their core products, whereas for Twilio it is a small part of what they offer to their customers.

Who would have thought that in 2021 we will see competition and innovation coming to the managed WebRTC TURN service?