STUN returns local ip

[nodminger]

I am using Coturn on my local network. When I use STUN server to get my public IP, instead of public IP, I get my local ip in the result.

is this normal since I am working on local network?

[eakraly]

Yes, STUN returns whatever address it sees the binding request comes from
If you run your tests inside your LAN that makes sense

[A-Aurel]

Hello !

Without necro-bumping, I think this relates a lot to the above.

We have VoIP currently working in the following setup.
SERVER2 hold the VoIP server which is used for putting clients in contact.
It currently works using a third-party STUN server on the internet.

I am trying to setup an STUN-only server using coturn to avoid depending on external server.
The setup can seem a bit complex for historical reasons, but that's to not be blocked the input by ISP2 as no control over that firewall.
Routing-wise, all works, I can reach SERVER2 web & mail servers from any entry point inside the setup and outside.

So I tried the coturn installation with the following options:

• always with: stun-only
• external-ip sequentially as:
  5.5.5.5
  then
  5.5.5.5/192.168.1.10
  then
  5.5.5.5/192.168.1.10
  5.5.5.5/192.168.100.1

I analyzed packets with "tshark -i any -Y stun" during call establishment attempt.
As above, all packets on local setup (i.e. on LOCAL, VPN1, VPN2, VPN3) get their insider's address back.
That makes sense as stated.
However, the concern is that calls between:

• devices inside the setup work,
• between external internet work,
• between inside and outside DO NOT WORK.

But the remote external device does not get communicated the 5.5.5.5 by the VoIP server, instead it communicated the private address of the device.
tshark confirms that. And that makes sense.

I would have imagined that the "external-ip" option was there exactly for replying with the public ip rather than the private.
On coturn STUN, it does not seem so.

Is there an option to set that can achieve that ?
I guess an nftables rule could change the source address of all insider's STUN packets to trick coturn.
But that would be very dirty and potentially some unexpected behaviours.

Anyone with some similar experience and sticking with STUN ?

Thank you very much in advance !
Regards