Real-time / Web

ICE / STUN / TURN

ICE (Interactive Connectivity Establishment, RFC 8445) is a NAT-traversal protocol that finds a working media path between two endpoints by gathering candidate IPs/ports and trying them in priority order. STUN and TURN are the helper protocols ICE uses to discover those candidates.

Roles

• STUN (RFC 5389): a server that just tells the client 'this is the public IP/port I see you on'. The client uses that as its 'server-reflexive' candidate. STUN traffic is tiny.
• TURN (RFC 8656): a relay server. When neither side can reach the other directly, both sides relay media through TURN. TURN traffic is heavy — you pay for the bandwidth.
• ICE: the algorithm that gathers (host, server-reflexive, relayed) candidates from each endpoint, pairs them, and runs connectivity checks until a working pair is found.

Real-world cascade

1. Try direct host-to-host (works on the same LAN).
2. Try server-reflexive via STUN (works for ~80% of cone-NAT pairs).
3. Fall back to TURN relay (works for ~99% of pairs — symmetric NATs, restrictive corporate firewalls, etc.).

Modern WebRTC clients use TURN-over-TCP-port-443 as the last resort, since 443 is rarely blocked.

DIDHub managed STUN/TURN

Every DIDHub SIP trunk includes free STUN and authenticated TURN at stun.didhub.io:3478 and turn.didhub.io:443. TURN credentials are short-lived (15 minutes) and minted via the dashboard or API.

Related terms