TURN Servers for IP Cameras & Smart Intercoms

Q: Why does an IP camera or smart doorbell need TURN?

The camera sits behind a residential router's NAT. The viewer's phone may also be behind a carrier NAT. STUN often fails between two NATs. TURN provides a relay so the live feed reaches the phone regardless of network topology.

Q: Can the camera firmware do TURN directly?

Yes — most modern WebRTC stacks for embedded Linux (libwebrtc, GStreamer with webrtcbin, Pion in Go) accept standard ICE servers including TURN. The camera advertises itself; the viewer dials in; both list TURN in their iceServers.

Q: How much TURN bandwidth does a 1080p camera stream use?

At 2 Mbps, a 1080p H.264 stream relayed for one viewer hour uses ~900 MB. Cameras typically only relay during live viewing, not continuously, so real bandwidth is much lower than always-on 24/7 math suggests.

Q: Is the video encrypted in transit through TURN?

Yes. WebRTC encrypts media end-to-end with DTLS-SRTP. The TURN server only forwards already-encrypted packets and never sees the plaintext video.

Reach cameras and doorbells behind residential NAT, every time. UDP, TCP, TLS-443 fallbacks. 1 TB free, 5 TB for $9/month.

Get Free TURN Credentials

Two NATs walk into a router

The camera sits behind the user's home router. The viewer's phone is on a mobile carrier behind carrier-grade NAT. Two NATs, no public address on either side. STUN fails. The user gets a spinner. Without a TURN relay, your "view live feed" button is broken for a substantial fraction of users — particularly those on mobile or in apartments using shared CGNAT.

This is the textbook case for TURN. Both peers list a TURN server in their iceServers, ICE picks the relayed candidate, and the stream connects.

Designed for camera-phone pipelines

Standard ICE servers — works with libwebrtc, Pion, GStreamer's webrtcbin, aiortc, mediasoup, Janus.
UDP, TCP 3478 + TCP 80, TLS 443 — connects from phones on mobile carrier networks that block raw UDP.
Premium adds shared-secret auth so each pairing session gets a fresh credential — no static password baked into firmware that ships to thousands of devices.
20+ relay regions — pick the one closest to the camera or viewer.

Embedded camera example (Pion / Go)

cfg := webrtc.Configuration{
  ICEServers: []webrtc.ICEServer{
    {URLs: []string{"stun:stun.expressturn.com:3478"}},
    {
      URLs: []string{
        "turn:relay1.expressturn.com:3478?transport=udp",
        "turn:relay1.expressturn.com:3478?transport=tcp",
        "turns:relay1.expressturn.com:443?transport=tcp",
      },
      Username:   "YOUR_EXPRESSTURN_USERNAME",
      Credential: "YOUR_EXPRESSTURN_PASSWORD",
    },
  },
}
peerConnection, _ := webrtc.NewPeerConnection(cfg)

Bandwidth math for camera apps

720p H.264 @ 1 Mbps: ~450 MB/hour relayed per viewer.
1080p H.264 @ 2 Mbps: ~900 MB/hour relayed per viewer.
Audio-only doorbell or intercom (Opus): ~30 MB/hour.
Free 1 TB plan: ~1,100 hours of 1080p relayed viewing per month.
Premium 5 TB plan: ~5,500 hours.

And remember — only viewing sessions that need TURN consume relay bandwidth. Direct-connect viewers don't.

FAQ

Why does an IP camera or smart doorbell need TURN?

Both camera and viewer are typically behind NATs. STUN often fails between two NATs. TURN relays the feed regardless of network topology.

Can the camera firmware do TURN directly?

Yes. libwebrtc, GStreamer with webrtcbin, Pion, and most embedded-Linux WebRTC stacks accept standard ICE server configuration.

How much TURN bandwidth does a 1080p camera stream use?

~900 MB per relayed viewer-hour at 2 Mbps. Cameras only relay during active viewing.

Is the video encrypted in transit through TURN?

Yes. DTLS-SRTP end-to-end. The relay never sees plaintext.

Make every camera reachable from every phone.

Related: VoIP / SIP · Pion recipe