WebRTC, STUN and TURN

In short: WebRTC enables audio, video and data directly between browsers. STUN and TURN help establish connections through NAT and firewalls.

In more detail: Most devices behind a router only have private addresses. With STUN a device learns its public address. A signalling server (for example WebSocket) relays the connection data (SDP, ICE candidates). If the direct path fails, a TURN server relays the traffic.

In Depth

• ICE: Tries possible paths (local, public, relayed) and picks the best.
• NAT types: Some (symmetric NAT) prevent direct connections, then TURN is needed.
• STUN: Lightweight, only address lookup.
• TURN: Relay costs bandwidth, fallback.
• Encryption: Media via SRTP, data via DTLS, always mandatory.
• Topologies: Mesh (everyone to everyone), SFU (server forwards), MCU (server mixes).
• Privacy: IP addresses become visible to the other party (STUN).

See also: TLS handshake in detail, QUIC and HTTP/3