Slyber
Slyber Turn Server · Fast auto configuration

Set up a TURN server in 1 minute

Ultra fast next generation TURN/STUN server featuring built-in HTTP API token issuance, automatic NAT discovery, multi core socket scaling, and SSRF protection.

$ curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/install.sh | sudo bash
Documentation Slyber Turn Server on GitHub (Installer and README)
SLYBER TURN :3478 UDP / TLS :443 HMAC REST AUTH SYMMETRIC NAT BYPASSED
30 Second Deployment
No external databases or configuration mazes—install the systemd service, firewall rules, and sysctl tuning with a single command.
Built in HTTP API
Ready to use /api/turn-credentials REST endpoint with CORS and Rate Limiting support.
SSRF Attack Protection
Core level blocking of RFC 1918 private networks, loopback, and cloud metadata with full TURN Hairpinning support.
Built in Doctor & Benchmark
Built in slyber_turn doctor and slyber_turn bench utilities for testing network connectivity, packet loss, RTT, and RFC 3550 jitter.
Architectural Excellence

Everything You Need for Flawless WebRTC Connectivity in a Single Binary

From Linux network socket handling to cryptography and telemetry-engineered in Go for minimal latency.

01 / 03
Kernel & Network Tuning

Extreme Performance Powered by Go and SO_REUSEPORT

Scaling UDP listeners across CPU cores via SO_REUSEPORT, auto-tuning socket buffers up to 8 MB, and lock-free traffic shaping.

Zero-allocation authentication (~0 heap allocations per packet)
Zero Trust Security

Bulletproof Protection Against SSRF and Infrastructure Attacks

Multi-layered peer filtering blocks access to loopback, RFC 1918 local subnets, and cloud provider metadata.

Automatic tracking of attacking IPs
Turnkey REST API

Built-in HTTP/HTTPS Credential Issuance API

Ready-to-use /api/turn-credentials endpoint with subdomain CORS validation and IP filters.

Supports X-Turn-Secret, Bearer tokens, and CIDR masks
QA & Diagnostics

Doctor Self-Diagnostics and Built-in Media Benchmark

Built-in slyber_turn doctor and slyber_turn bench commands for NAT verification, port allocation testing, and RFC 3550 jitter measurement.

Export benchmark reports to console or JSON for CI/CD
Observability & Persistence

Deep Telemetry, Prometheus Metrics, and Smart Roaming

Prometheus metrics export (/metrics), live session list (/api/node-stats), event deduplication, and disk persistence.

Smart Wi-Fi ↔ 4G/5G network handover detection in 5 seconds
Zero-Config NAT & TLS

STUN Auto-Discovery and TLS Hot Reload

Automatic public IP discovery via STUN and seamless TLS certificate reloading without dropping calls.

Bypass strict corporate firewalls over TCP/TLS
4-Step Integration

How to Deploy and Integrate Slyber Turn

From a clean Linux machine to a fully hardened production TURN server with monitoring and a load test report—in under 1 minute.

01 / 02
STEP 01 · Installation

Deploy the Server with a Single Command

The script detects your CPU architecture (amd64/arm64), verifies the SHA256 checksum, increases sysctl kernel network buffers, generates a cryptographically secure TURN_SECRET in /opt/slyber_turn/.env, opens firewall ports, and starts the systemd service.

STEP 01 
curl -fsSL https://raw.githubusercontent.com/slyber-app/slyber-turn-server/main/install.sh | sudo bash
STEP 02 · Diagnostics

Verify Network and NAT with Built-in Doctor

The doctor utility automatically validates your configuration, verifies your external IP against public STUN servers, polls the /healthz endpoint, and performs a real test TURN allocation from the 49152–65535 port pool.

STEP 02 
sudo slyber_turn doctor
STEP 03 · Code Integration

Connect WebRTC Clients via HTTP API

Issue temporary credentials directly via the server's CORS-protected HTTP endpoint, or use the official pkg/turnclient package in your Go backend for instant local token generation.

STEP 03 
// Option A: Fetch ICE config on the frontend via the built-in HTTP API
const res = await fetch('https://turn.yourdomain.com:8080/api/turn-credentials?user_id=user_777');
const ice = await res.json();
const pc = new RTCPeerConnection({
  iceServers: [{ urls: ice.uris, username: ice.username, credential: ice.password }]
});
STEP 04 · Benchmark & Monitoring

Load-Test and Enable Telemetry

Run the built-in load benchmark to verify throughput, packet loss, RTT (p50/p95/p99), and media jitter before routing live traffic, then hook up /metrics to Prometheus or query live statistics from /api/node-stats.

STEP 04 
sudo slyber_turn bench -clients 20 -duration 5s -size 1200 -pps 50
Specifications

Complete Technical Specifications of Slyber Turn Server

System requirements, supported RFC standards, and telemetry.

Supported Protocols & Standards
STUN (RFC 5389), TURN Relay UDP / TCP / TLS (RFC 5766, RFC 6062), TURN REST API (ephemeral HMAC-SHA1), RFC 3550 Jitter Calculation
Default Network Ports
3478/UDP & 3478/TCP (STUN/TURN), 5349/TCP (TURNS / TLS 1.2+), 8080/TCP (HTTP/HTTPS API), 49152–65535/UDP (relay port pool — 16,384 sessions)
Socket Optimization & Concurrency
Scaling UDP listeners via SO_REUSEPORT across CPU cores (TURN_THREADS), kernel SO_RCVBUF/SO_SNDBUF buffers up to 8 MB (control) and 1 MB (relay)
Authentication & Cryptography
Stateless HMAC-SHA1 (timestamp:user_id format) with zero heap allocations, Constant-Time X-Turn-Secret / Bearer verification, configurable TTL (7200 sec default)
SSRF Protection & Network Filtering
Blocks 127.0.0.0/8, ::1, 0.0.0.0/8, Cloud Metadata (169.254.0.0/16, fd00:ec2::254/128), RFC 1918, CGNAT (100.64.0.0/10), and host IPs; supports TURN Hairpinning and IP/CIDR Allowlists
Bandwidth Management (QoS)
Non-blocking (Lock-Free CAS) Token Bucket traffic shaper per allocation (MAX_KBPS_PER_SESSION / MAX_BPS_PER_ALLOCATION) with a 10 ms window
TLS & Certificate Management
TLS 1.2+ for TURNS and HTTPS API; automatic every-minute certificate Hot Reload from disk without restarts; single-flag Self-Signed ECDSA P-256 generation
Built-in HTTP API & Monitoring
GET /api/turn-credentials, GET /api/node-stats (JSON telemetry & 24h history), GET /metrics (Prometheus format), GET /events (Smart Event Logger), GET /healthz
CLI Tools & Self-Diagnostics
slyber_turn server (main daemon), slyber_turn doctor (STUN NAT check, Self-Test, and Live Probe), slyber_turn bench (RTT/Loss/Jitter load test with JSON output)
Supported Platforms & Deployment
Linux (x86_64 / amd64, aarch64 / arm64), automated systemd installer with SHA256SUMS verification, automatic UFW / firewalld setup, and disk state persistence
Use Cases

Where Slyber Turn Delivers Maximum Impact

01 / 03
01 UCaaS & Enterprise Comms

Video Conferencing and Secure Enterprise Messengers

Guaranteed connectivity for employees inside restricted banking and corporate networks where UDP traffic is blocked, powered by automatic fallback to TURN over TCP and TLS (port 5349).

02 Telehealth & EdTech

Telemedicine and Interactive EdTech Platforms

Uninterrupted doctor-patient video consultations and online classes when a user's smartphone switches from home Wi-Fi to 4G/5G mobile data, thanks to rapid socket handover detection.

03 Low Latency Streaming

Cloud Gaming, Remote Desktops (VDI), and Live Streaming

Ultra-low jitter and zero buffering when streaming interactive video and control inputs, enabled by enlarged 8 MB kernel socket buffers and SO_REUSEPORT multi-threading.

04 AI Voice & Video Agents

Real-Time Voice and Video AI Agents

Reliable, ultra-low-latency bidirectional audio streaming between a user's browser or mobile app and server-side voice AI assistants (Realtime Multimodal AI Agents).

05 IoT & Robotics

Video Surveillance, Smart Home, and Drone Telemetry

Secure video stream relaying from IP cameras, smart intercoms, drones, and industrial robots operating behind symmetric cellular carrier CGNAT worldwide.

06 FinTech & Remote KYC

Banking Video KYC and Contact Centers

Controlled per-session bandwidth (MAX_KBPS_PER_SESSION), strict internal infrastructure isolation against SSRF attacks, and a complete authentication audit trail for security compliance.

Knowledge Base & FAQ

Frequently Asked Questions About Slyber Turn

Answers to frequent technical questions from engineers regarding architecture, security, load testing, and migrating from classic TURN servers.

How does Slyber Turn Server differ from classic coturn? +
Unlike legacy coturn, which requires complex configuration of dozens of flags, external scripts for token issuance, and third-party exporters, Slyber Turn ships as a single all-inclusive static Go binary. Out of the box, it includes a built-in HTTP/HTTPS API for issuing temporary credentials (/api/turn-credentials), automatic external IP detection via STUN (PUBLIC_IP=auto), strict built-in SSRF protection, an integrated load-testing benchmark (slyber_turn bench), a self-diagnostics utility (slyber_turn doctor), and native Prometheus telemetry.
How do I issue temporary TURN credentials to browser and mobile app clients? +
The server supports two operating modes. The first is the built-in HTTP API (/api/turn-credentials), which is protected by CORS validation (Origin matching with subdomain support), IP/CIDR allowlists, a built-in Rate Limiter (Token Bucket), and the X-Turn-Secret header. The second is completely local (stateless) generation on your backend using our Go SDK (pkg/turnclient) following the TURN REST API standard (HMAC-SHA1 of timestamp:user_id) without making a single network request to the TURN server.
Is the server protected against SSRF attacks and internal cloud network scanning? +
Yes, SSRF (Server-Side Request Forgery) protection is built into the core (PeerFilter) and enabled by default. The server automatically blocks any relay attempts to loopback addresses (127.0.0.1, ::1), RFC 1918 private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), CGNAT, and AWS/GCP/DigitalOcean cloud metadata endpoints (169.254.169.254, fd00:ec2::254), while also protecting the host's own local network interfaces. At the same time, TURN Hairpinning is properly supported so two clients can communicate through the public IP of the same server.
How much load can the server handle, and how is it optimized for high-throughput media traffic? +
On Linux, Slyber Turn scales sockets via SO_REUSEPORT, creating independent UDP listeners matching the number of CPU cores (the TURN_THREADS parameter), and automatically tunes kernel SO_RCVBUF and SO_SNDBUF buffers up to 8 MB for control sockets and up to 1 MB for each relay port. Traffic accounting is batched in 64 KB chunks, and bandwidth limiting (MAX_KBPS_PER_SESSION) is implemented via a non-blocking, lock-free atomic CAS Token Bucket algorithm without mutexes.
How can I test actual throughput, latency (RTT), and jitter before going to production? +
Slyber Turn includes a built-in professional load-testing utility: simply run "slyber_turn bench -clients 40 -duration 10s". It spins up real concurrent TURN allocations, drives bidirectional UDP traffic, and outputs a detailed report (in text or JSON format) covering allocation setup time, throughput in Mbps, packet loss percentage, latency percentiles (RTT p50/p95/p99), one-way relay latency, and RFC 3550 media jitter.
How does the server handle network handovers (Wi-Fi ↔ 4G/5G) during a call? +
When a mobile client switches from Wi-Fi to 4G/5G (ICE Restart), standard TURN servers keep holding onto the old "dead" socket until a long timeout expires, skewing statistics and tying up ports. Slyber Turn tracks stream activity in real time: as soon as the same user_id establishes a fresh active socket on the new network, the silent old socket is automatically marked as superseded after just 5 seconds of inactivity.
Is TLS encryption (turns:) supported, and do I need to restart the server when renewing SSL certificates? +
The server supports full TURN over TLS (turns: on port 5349 by default) and HTTPS for the built-in API. The reloadableCert module automatically checks certificate file modification timestamps on disk once a minute and performs a hot reload of Let's Encrypt keys without restarting the process or dropping active audio/video calls. For staging environments, automatic generation of a self-signed ECDSA P-256 certificate is also available via the TLS_SELF_SIGNED=true flag.
How do I configure the server behind cloud NAT (AWS, GCP, Hetzner) when the public IP is not known in advance? +
If your server is behind 1:1 NAT (for example, in AWS EC2, Google Cloud, or Yandex Cloud), you do not need to look up and hardcode the external IP manually. Simply leave PUBLIC_IP=auto in your .env file. On startup, Slyber Turn automatically queries a pool of fast STUN servers (Google, Cloudflare), discovers its external IPv4 address via XOR-MAPPED-ADDRESS, and verifies network mapping accuracy through the slyber_turn doctor utility.
WebRTC NAT Traversal Architecture & Guide

Why Modern WebRTC Projects in 2026 Need a Purpose-Built Go TURN Server

WebRTC (Web Real-Time Communication) technology enables low-latency audio, video, and arbitrary data (DataChannels) streaming directly between browsers and mobile devices. In real-world networks, however, up to 20–30% of direct P2P connections are blocked due to Symmetric NAT, mobile carrier CGNAT (4G/5G), and strict corporate firewalls that block inbound UDP traffic. This is where Slyber Turn Server plays a critical role—a high-performance multiprotocol STUN/TURN relay that guarantees media stream delivery under any network conditions.

The Problem with Legacy Solutions and the Slyber Turn Advantage

For a long time, C-based coturn remained the de facto standard. In modern cloud infrastructure, operating it comes with high overhead: maintaining a separate backend service just to generate ephemeral HMAC keys, manually configuring dozens of private subnet blacklists to mitigate SSRF vulnerabilities, lacking built-in channel quality testing tools, and dealing with complex diagnostics when deploying behind cloud NAT. Slyber Turn Server solves these challenges at the architectural level:

  • Single Zero-Dependency Binary: Written in Go on top of the battle-tested pion/turn/v4 stack, the server compiles into a single executable for linux/amd64 and linux/arm64. The built-in installer automatically tunes Linux kernel socket buffers (net.core.rmem_max=8388608, net.core.wmem_max=8388608), opens ports in ufw or firewalld, and registers a resilient systemd service with a file descriptor limit of LimitNOFILE=1048576.
  • Built-in HTTP/HTTPS API and Go Client SDK: The /api/turn-credentials endpoint returns a ready-to-use JSON payload containing temporary credentials and an array of URIs (stun:, turn:?transport=udp, turn:?transport=tcp, turns:?transport=tcp). Access is secured by an Origin validator with automatic subdomain matching, IP/CIDR allowlists, Token Bucket Rate Limiting, and constant-time X-Turn-Secret key verification (subtle.ConstantTimeCompare).
  • Uncompromising SSRF (Server-Side Request Forgery) Protection: By nature, a TURN server acts as a network proxy. Without proper safeguards, an attacker can abuse it to scan your internal data center network or steal credentials from cloud metadata services (AWS IMDS 169.254.169.254 / fd00:ec2::254). In Slyber Turn, the core-level PeerFilter blocks loopback, link-local, multicast, RFC 1918 subnets, and local host interfaces while cleanly separating benign browser LAN candidate skips (ICE_LAN_SKIP) from actual attack attempts (SSRF_BLOCK) in telemetry.
  • Intelligent Mobile Network Handover and Observability: When a smartphone transitions from Wi-Fi to LTE/5G, Slyber Turn immediately detects the user's new socket and hides the stale allocation after just 5 seconds of silence, keeping metrics accurate across /api/node-stats and /metrics (Prometheus). All counters, 24-hour load history, and the event log are atomically persisted to disk every 10 seconds, surviving any server restarts.
Production-Ready WebRTC Infrastructure

Ready to achieve a 99.9% WebRTC connection success rate?

Forget complex coturn configurations, socket leaks, and manual token generation. Deploy the single Slyber Turn binary with a built-in HTTP API, SSRF protection, and turnkey analytics right now.

Install Documentation