wirecore / scripts / setup-turn-server-nat.sh

#!/bin/bash
#
# Wirecore TURN Server Setup Script (NAT-aware)
# For Tabertron behind 7rnx.net network
#
# Usage: sudo bash setup-turn-server-nat.sh
#

set -e

echo "🔗 Wirecore TURN Server Setup (NAT-aware)"
echo "=========================================="
echo ""

if [ "$EUID" -ne 0 ]; then
  echo "❌ Please run as root: sudo bash setup-turn-server-nat.sh"
  exit 1
fi

SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

# Install coturn
echo "📦 Installing coturn..."
apt update
apt install -y coturn curl net-tools

# Enable coturn
echo "✅ Enabling coturn..."
sed -i 's/#TURNSERVER_ENABLED=1/TURNSERVER_ENABLED=1/' /etc/default/coturn

# Detect IPs
echo "🌐 Detecting network configuration..."
INTERNAL_IP=$(ip route get 1.1.1.1 | grep -oP 'src \K\S+')
PUBLIC_IP=$(curl -4 -s ifconfig.me)

echo ""
echo "📍 Network Details:"
echo "   Internal IP: $INTERNAL_IP"
echo "   Public IP:   $PUBLIC_IP"
echo ""

# Check if behind NAT
if [[ "$INTERNAL_IP" != "$PUBLIC_IP" ]]; then
  echo "⚠️  NAT DETECTED"
  echo "   Tabertron is behind a router/firewall"
  echo "   You will need to configure port forwarding!"
  echo ""
  BEHIND_NAT=true
else
  echo "✅ Direct public IP detected"
  BEHIND_NAT=false
fi

# Generate password
TURN_PASSWORD="wirecore$(openssl rand -hex 8)"
echo "🔐 Generated password: $TURN_PASSWORD"

# Create config
echo "📝 Creating TURN configuration..."

cat > /etc/turnserver.conf << EOF
# Wirecore TURN Server Configuration
# Generated: $(date)

# Listening address (internal IP)
listening-ip=$INTERNAL_IP

# Ports
listening-port=3478
tls-listening-port=5349

# External IP (for NAT)
external-ip=$PUBLIC_IP

# Realm
realm=$PUBLIC_IP

# Server name
server-name=wirecore-turn

# Credentials
user=wirecore:$TURN_PASSWORD
lt-cred-mech

# Relay settings
no-tcp-relay
min-port=49152
max-port=65535

# Logging
verbose
log-file=/var/log/turnserver/turnserver.log

# Security
fingerprint
no-multicast-peers
no-cli
no-loopback-peers

# Rate limiting
user-quota=10
total-quota=100
max-bps=1000000

# Mobility support
mobility
EOF

# Create log directory
mkdir -p /var/log/turnserver
chown turnserver:turnserver /var/log/turnserver 2>/dev/null || true

# Firewall on Tabertron
echo "🔥 Configuring local firewall..."
if command -v ufw &> /dev/null; then
  ufw allow 3478/tcp
  ufw allow 3478/udp
  ufw allow 5349/tcp
  ufw allow 49152:65535/udp
fi

# Start service
echo "🚀 Starting coturn..."
systemctl daemon-reload
systemctl enable coturn
systemctl restart coturn

sleep 2

if systemctl is-active --quiet coturn; then
  echo ""
  echo "✅ TURN server is running!"
  echo ""
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "📝 TURN Server Credentials:"
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "Public IP:     $PUBLIC_IP"
  echo "Internal IP:   $INTERNAL_IP"
  echo "TURN Port:     3478 (UDP/TCP)"
  echo "TURN TLS:      5349 (TCP)"
  echo "Username:      wirecore"
  echo "Password:      $TURN_PASSWORD"
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

  if [ "$BEHIND_NAT" = true ]; then
    echo ""
    echo "⚠️  IMPORTANT: PORT FORWARDING REQUIRED!"
    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
    echo "You need to forward these ports on 7rnx.net gateway:"
    echo ""
    echo "  External $PUBLIC_IP:3478 → $INTERNAL_IP:3478 (UDP/TCP)"
    echo "  External $PUBLIC_IP:5349 → $INTERNAL_IP:5349 (TCP)"
    echo "  External $PUBLIC_IP:49152-65535 → $INTERNAL_IP:49152-65535 (UDP)"
    echo ""
    echo "If you have gateway access, run these commands ON THE GATEWAY:"
    echo ""
    echo "  # Enable forwarding"
    echo "  echo 1 > /proc/sys/net/ipv4/ip_forward"
    echo ""
    echo "  # TURN main port (UDP)"
    echo "  iptables -t nat -A PREROUTING -d $PUBLIC_IP -p udp --dport 3478 \\"
    echo "    -j DNAT --to-destination $INTERNAL_IP:3478"
    echo ""
    echo "  # TURN main port (TCP)"
    echo "  iptables -t nat -A PREROUTING -d $PUBLIC_IP -p tcp --dport 3478 \\"
    echo "    -j DNAT --to-destination $INTERNAL_IP:3478"
    echo ""
    echo "  # TURN TLS"
    echo "  iptables -t nat -A PREROUTING -d $PUBLIC_IP -p tcp --dport 5349 \\"
    echo "    -j DNAT --to-destination $INTERNAL_IP:5349"
    echo ""
    echo "  # Relay range"
    echo "  iptables -t nat -A PREROUTING -d $PUBLIC_IP -p udp --dport 49152:65535 \\"
    echo "    -j DNAT --to-destination $INTERNAL_IP:49152-65535"
    echo ""
    echo "  # Save rules"
    echo "  iptables-save > /etc/iptables/rules.v4"
    echo ""
    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  fi

  echo ""
  echo "📋 Next Steps:"
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "1. Configure port forwarding (if behind NAT)"
  echo ""
  echo "2. Update Wirecore config:"
  echo "   cd $SCRIPT_DIR"
  echo "   bash update-turn-config.sh $PUBLIC_IP $TURN_PASSWORD"
  echo ""
  echo "3. Test TURN server:"
  echo "   https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/"
  echo "   - Add: turn:$PUBLIC_IP:3478"
  echo "   - Username: wirecore"
  echo "   - Password: $TURN_PASSWORD"
  echo ""
  echo "4. Monitor logs:"
  echo "   sudo tail -f /var/log/turnserver/turnserver.log"
  echo ""

  # Save credentials
  cat > "$SCRIPT_DIR/turnserver-credentials.txt" << EOF
TURN Server Credentials (NAT Configuration)
============================================

Public IP:     $PUBLIC_IP
Internal IP:   $INTERNAL_IP
TURN Port:     3478 (UDP/TCP)
TURN TLS:      5349 (TCP)
Username:      wirecore
Password:      $TURN_PASSWORD

Behind NAT:    $BEHIND_NAT

Port Forwarding Required:
- 3478/udp: $PUBLIC_IP:3478 → $INTERNAL_IP:3478
- 3478/tcp: $PUBLIC_IP:3478 → $INTERNAL_IP:3478
- 5349/tcp: $PUBLIC_IP:5349 → $INTERNAL_IP:5349
- 49152-65535/udp: $PUBLIC_IP:49152-65535 → $INTERNAL_IP:49152-65535

Config: /etc/turnserver.conf
Logs:   /var/log/turnserver/turnserver.log

Installed: $(date)
EOF

  chmod 600 "$SCRIPT_DIR/turnserver-credentials.txt"
  echo "💾 Credentials saved to: turnserver-credentials.txt"
  echo ""

else
  echo "❌ Failed to start coturn"
  echo "Check logs: sudo journalctl -u coturn -n 50"
  exit 1
fi