Phone to phone audio/video not established if both phones use mobile connection

[sando38]

Environment

• ejabberd version: 21.07
• OS: Linux (Debian Buster)
• Installed from: docker/ecs

Errors from error.log/crash.log

No errors

Bug description

I am unable to establish an audio/ video connection between two phones using both LTE connection. The tested phones work, either when being in WLAN and the other phone LTE connected or the other way around. also both phones within the same or in different WLAN work. But switching both to LTE connection, they cannot connect for whatever reason. It has been tested also with other mobile phones, so it is not limited to two phones only.
It seems not be an issue of STUN/TURN. Also I have tested between different mobile phone provides: Telekom and Vodfaone with same result.
Any ideas?

The loggin shows, that STUN/TURN is offered and also connection established.

If any further information are needed, I would be pleased to provide them.

Thank you very much in advance!

[licaon-kter]

This is SIP? Which agents?
This is XMPP? Which clients?

Paste your config on https://gist.github.com

[weiss]

I can't help with Docker-specific issues, but yes this sounds as if TURN wasn't working. For TURN to work, the UDP port range 49152-65535 needs to be accessible (the range is configurable with the ejabberd_stun listener options turn_min_port and turn_max_port, you need a few ports per call). I seem to remember large ranges being problematic with Docker?

[sando38]

Dear licaon-kter,

thanks for your answer.
it is not SIP, it is xmpp calling with Conversations IM (Android), Siskin IM (iOS) or Beagle IM (macOS).
https://gist.github.com/sando38/13142e647b74590a4629e4b4d4664c20

Dear weiss,
thanks for your answer.
yes, I specified turn range exactly what you have posted.
Regarding the long range, not sure, although calling works with the named clients, if either one phone is in an home WLAN for example and another is connected through LTE/ mobile connection.

[licaon-kter]

The long range is needed when TURN is needed, if you didn't open ports like 49000-60000 UDP then you don't use TURN, if it fails...then it means you need TURN :) so open them,

[sando38]

Yes, they are open. I specified them in ejabberd config as well as in docker container as well as in firewall of the system. :)

[weiss]

I would try a smaller range, e.g. turn_min_port: 50000 and turn_max_port: 50500. As I said, someone mentioned Docker not coping with large (UDP) port ranges.

[sando38]

Thanks, I will try and provide feedback as soon as possible.

[sando38]

I changed port range for turn to 49152-49300, but still the same result.

Connection work:
WLAN-WLAN (same or different)
WLAN-Mobil
Mobil-WLAN

Connection
Mobil-to-Mobil doesn't work.

[weiss]

So the TURN server still isn't reachable.

[sando38]

Thank you for your hint. I will further try to investigate. Will provide feedback in the meantime.

[sando38]

Okay, I did some further testing. I disvoered a page https://icetest.info/ and check wether stun/turn answer correctly according to the test's definition.
Here is the screenshot from the test.

Turn seems to answer, however, I am still unable to create a phone to phone connection when both phones use their mobil connection. The test shows results when I connect through TURN and TURNS.
Any further hint, where I should investigate? Thank you in advance already for any idea.

[weiss]

Turn seems to answer

The TURN server probably does answer on port 3478 (UDP or TCP), or whatever port(s) your ejabberd_stun is listening on. Next step is your client asking your TURN server to allocate a dedicated UDP port within the UDP port range (49152-49300 or whatever) for relaying a stream. icetest.info is probably not testing whether that port is accessible as well. My guess would still be that it isn't, and that would explain your problem.

[sando38]

Thanks for the quick reply. I will check and provide feedback! Wishing a great weekend.

[sando38]

Closing the issue because it is more related to a non-ejabberd-related configuration issue, will provide feedback once the turn server issue (most likely related to firewall/connectivity) is solved.

[sando38]

Last note on the issue:
it now works. Problem was, that iptable rules for turn range for whatever reason have been ignored. I completely recreated rule-sets in iptables, and let docker-compose recreate its related rules newly as well: voila, issue solved.
Thanks again for the help and hints for investigation.