By default, TURN will not relay traffic to private IPs. If you need to relay traffic to private IPs, please use allow_restricted_peer_cidrs which is explained in config-sample.yaml and replicated below.
# # list of restricted peer CIDRs (loopback, link-local (unicast, multicast), multicast, private, unspecified) to allow access to.
# # By default (i. e. empty list), all restricted peer CIDRs are denied access.
# # When not empty, only the specified CIDRs are allowed access.
# # Note that this check is applied to restricted peer CIDRs only.
# allow_restricted_peer_cidrs:
# - 10.0.0.0/8
# - 192.168.0.0/16
That list can be paired with a deny list which takes precedence if there is an overlap.
# # list of peer CIDRs to deny access to.
# # This applies to all peer CIDRs, including restricted ones.
# # Deny list takes precedence over allow list.
# deny_peer_cidrs:
# - 10.0.0.0/8
# - 192.168.0.0/16
TURN credentials now have a TTL (Time-To-Live) beyond which they are not valid to join a room. We recommend rotating your TURN authentication secrets to ensure older credentials are rendered stale and not usable.
# # TTL of the TURN credentials in seconds - defaults to 300
# ttl_seconds: 300
Please note that the TTL is always used in constructing the credentials. So, a value of 0 will create credentials that expire immediately.
