1# Cloudflare TURN Service
2 
3Expert guidance for implementing Cloudflare TURN Service in WebRTC applications.
4 
5## Overview
6 
7Cloudflare TURN (Traversal Using Relays around NAT) Service is a managed relay service for WebRTC applications. TURN acts as a relay point for traffic between WebRTC clients and SFUs, particularly when direct peer-to-peer communication is obstructed by NATs or firewalls. The service runs on Cloudflare's global anycast network across 310+ cities.
8 
9## Key Characteristics
10 
11- **Anycast Architecture**: Automatically connects clients to the closest Cloudflare location
12- **Global Network**: Available across Cloudflare's entire network (excluding China Network)
13- **Zero Configuration**: No need to manually select regions or servers
14- **Protocol Support**: STUN/TURN over UDP, TCP, and TLS
15- **Free Tier**: Free when used with Cloudflare Calls SFU, otherwise $0.05/GB outbound
16 
17## In This Reference
18 
19| File | Purpose |
20|------|---------|
21| [api.md](./api.md) | Credentials API, TURN key management, types, constraints |
22| [configuration.md](./configuration.md) | Worker setup, wrangler.jsonc, env vars, IP allowlisting |
23| [patterns.md](./patterns.md) | Implementation patterns, use cases, integration examples |
24| [gotchas.md](./gotchas.md) | Troubleshooting, limits, security, common mistakes |
25 
26## Reading Order
27 
28| Task | Files to Read | Est. Tokens |
29|------|---------------|-------------|
30| Quick start | README only | ~500 |
31| Generate credentials | README → api | ~1300 |
32| Worker integration | README → configuration → patterns | ~2000 |
33| Debug connection | gotchas | ~700 |
34| Security review | api → gotchas | ~1500 |
35| Enterprise firewall | configuration | ~600 |
36 
37## Service Addresses and Ports
38 
39### STUN over UDP
40- **Primary**: `stun.cloudflare.com:3478/udp`
41- **Alternate**: `stun.cloudflare.com:53/udp` (blocked by browsers, not recommended)
42 
43### TURN over UDP
44- **Primary**: `turn.cloudflare.com:3478/udp`
45- **Alternate**: `turn.cloudflare.com:53/udp` (blocked by browsers)
46 
47### TURN over TCP
48- **Primary**: `turn.cloudflare.com:3478/tcp`
49- **Alternate**: `turn.cloudflare.com:80/tcp`
50 
51### TURN over TLS
52- **Primary**: `turn.cloudflare.com:5349/tcp`
53- **Alternate**: `turn.cloudflare.com:443/tcp`
54 
55## Quick Start
56 
571. **Create TURN key via API**: see [api.md#create-turn-key](./api.md#create-turn-key)
582. **Generate credentials**: see [api.md#generate-temporary-credentials](./api.md#generate-temporary-credentials)
593. **Configure Worker**: see [configuration.md#cloudflare-worker-integration](./configuration.md#cloudflare-worker-integration)
604. **Implement client**: see [patterns.md#basic-turn-configuration-browser](./patterns.md#basic-turn-configuration-browser)
61 
62## When to Use TURN
63 
64- **Restrictive NATs**: Symmetric NATs that block direct connections
65- **Corporate firewalls**: Environments blocking WebRTC ports
66- **Mobile networks**: Carrier-grade NAT scenarios
67- **Predictable connectivity**: When reliability > efficiency
68 
69## Related Cloudflare Services
70 
71- **Cloudflare Calls SFU**: Managed Selective Forwarding Unit (TURN free when used with SFU)
72- **Cloudflare Stream**: Video streaming with WHIP/WHEP support
73- **Cloudflare Workers**: Backend for credential generation
74- **Cloudflare KV**: Credential caching
75- **Cloudflare Durable Objects**: Session state management
76 
77## Additional Resources
78 
79- [Cloudflare Calls Documentation](https://developers.cloudflare.com/calls/)
80- [Cloudflare TURN Service Docs](https://developers.cloudflare.com/realtime/turn/)
81- [Cloudflare API Reference](https://developers.cloudflare.com/api/resources/calls/subresources/turn/)
82- [Orange Meets (Open Source Example)](https://github.com/cloudflare/orange)
83