TURN (Traversal Using Relays around NAT)

Some networks make direct media impossible. Symmetric NAT changes the mapping for every destination, corporate firewalls block inbound UDP, and some carriers place devices behind multiple layers of NAT. In these cases, STUN cannot produce a usable address and the two endpoints never hear each other.

TURN, defined in RFC 8656, is the fallback. The client connects to a TURN server on the public internet and asks it to allocate a relay address. The client then tells the far end to send media to that relay address. The TURN server forwards packets in both directions. Because the client initiated the connection to the relay, the NAT and firewall allow the traffic through.

The cost is that all media passes through a third server, which adds latency and consumes the server's bandwidth. TURN servers therefore require authentication and are usually run by the provider or the organisation rather than being freely available. The protocol is an extension of STUN and uses the same message format.

TURN is the last resort in ICE: ICE gathers local, STUN-derived and TURN-relayed candidates and uses the relay only when nothing more direct works. In SIP deployments the PBX often acts as a media relay instead, which achieves a similar result without a separate TURN server.