Cloudflare Docs
Calls
Edit this page
Report an issue with this page
Log into the Cloudflare dashboard
Set theme to dark (⇧+D)

TURN Service

Separately from the SFU, Calls offers a managed TURN service. TURN acts as a relay point for traffic between WebRTC clients like the browser and SFUs, particularly in scenarios where direct communication is obstructed by NATs or firewalls. TURN maintains an allocation of public IP addresses and ports for each session, ensuring connectivity even in restrictive network environments.

Using Cloudflare Calls TURN service is available free of charge when used together with the Calls SFU. Otherwise, it costs $0.05/real-time GB outbound from Cloudflare to the TURN client.

​​ Service address and ports

ProtocolPrimary addressPrimary portAlternate port
STUN over UDPstun.cloudflare.com3478/udp53/udp
TURN over UDPturn.cloudflare.com3478/udp53 udp
TURN over TCPturn.cloudflare.com3478/tcp80/tcp
TURN over TLSturn.cloudflare.com5349/tcp443/tcp

​​ Regions

Calls TURN service is available in every Cloudflare datacenter.

When a client tries to connect to turn.cloudflare.com, it automatically connects to the Cloudflare location closest to them. We achieve this using Anycast routing.

To learn more about the architecture that makes this possible, read this technical deep-dive about Calls.

​​ IP Addresses

​​ Traverse restrictive network environments and IP allowlists (whitelists)

Please allowlist Cloudflare’s published IP address ranges, both IPv4 and IPv6. Cloudflare’s TURN service will use an IP address from this list. For more details about static IPs, guarantees and other arrangements please discuss with your enterprise account team.

​​ Relay allocation IP addresses

TURN server relay allocations are done using a larger set of IP address ranges. Calls relay allocations will be in the 9024-65535 port range.

​​ Protocols and Ciphers for TURN over TLS

TLS versions supported include TLS 1.1, TLS 1.2, and TLS 1.3.

OpenSSL NameTLS 1.1TLS 1.2TLS 1.3
AEAD-AES128-GCM-SHA256NoNo
AEAD-AES256-GCM-SHA384NoNo
AEAD-CHACHA20-POLY1305-SHA256NoNo
ECDHE-ECDSA-AES128-GCM-SHA256NoNo
ECDHE-RSA-AES128-GCM-SHA256NoNo
ECDHE-RSA-AES128-SHANo
AES128-GCM-SHA256NoNo
AES128-SHANo
AES256-SHANo

​​ MTU

There is no specific MTU limit for Cloudflare Calls TURN service.

​​ Limits

Cloudflare Calls TURN service places limits on:

  • Unique IP address you can communicate with per relay allocation (>5 new IP/sec)
  • Packet rate outbound and inbound to the relay allocation (>5-10 kpps)
  • Data rate outbound and inbound to the relay allocation (>50-100 Mbps)

These limits are suitable for high-demand applications and also have burst rates higher than those documented above. Hitting these limits will result in packet drops.