Cloudflare TURN Service

Expert guidance for implementing Cloudflare TURN Service in WebRTC applications.

Overview

Cloudflare TURN (Traversal Using Relays around NAT) Service is a managed relay service for WebRTC applications. TURN acts as a relay point for traffic between WebRTC clients and SFUs, particularly when direct peer-to-peer communication is obstructed by NATs or firewalls. The service runs on Cloudflare's global anycast network across 310+ cities.

Key Characteristics

Anycast Architecture: Automatically connects clients to the closest Cloudflare location
Global Network: Available across Cloudflare's entire network (excluding China Network)
Zero Configuration: No need to manually select regions or servers
Protocol Support: STUN/TURN over UDP, TCP, and TLS
Free Tier: Free when used with Cloudflare Calls SFU, otherwise $0.05/GB outbound

In This Reference

File	Purpose
api.md	Credentials API, TURN key management, types, constraints
configuration.md	Worker setup, wrangler.jsonc, env vars, IP allowlisting
patterns.md	Implementation patterns, use cases, integration examples
gotchas.md	Troubleshooting, limits, security, common mistakes

Reading Order

Task	Files to Read	Est. Tokens
Quick start	README only	~500
Generate credentials	README → api	~1300
Worker integration	README → configuration → patterns	~2000
Debug connection	gotchas	~700
Security review	api → gotchas	~1500
Enterprise firewall	configuration	~600

Service Addresses and Ports

STUN over UDP

Primary: stun.cloudflare.com:3478/udp
Alternate: stun.cloudflare.com:53/udp (blocked by browsers, not recommended)

TURN over UDP

Primary: turn.cloudflare.com:3478/udp
Alternate: turn.cloudflare.com:53/udp (blocked by browsers)

TURN over TCP

Primary: turn.cloudflare.com:3478/tcp
Alternate: turn.cloudflare.com:80/tcp

TURN over TLS

Primary: turn.cloudflare.com:5349/tcp
Alternate: turn.cloudflare.com:443/tcp

Quick Start

Create TURN key via API: see api.md#create-turn-key
Generate credentials: see api.md#generate-temporary-credentials
Configure Worker: see configuration.md#cloudflare-worker-integration
Implement client: see patterns.md#basic-turn-configuration-browser

When to Use TURN

Restrictive NATs: Symmetric NATs that block direct connections
Corporate firewalls: Environments blocking WebRTC ports
Mobile networks: Carrier-grade NAT scenarios
Predictable connectivity: When reliability > efficiency

Cloudflare Calls SFU: Managed Selective Forwarding Unit (TURN free when used with SFU)
Cloudflare Stream: Video streaming with WHIP/WHEP support
Cloudflare Workers: Backend for credential generation
Cloudflare KV: Credential caching
Cloudflare Durable Objects: Session state management

README.md