Configure Relay Servers

Relay servers ensure connectivity between users and their resources (VMs, containers, remote desktops) when a direct WebRTC connection is not possible or when a Websocket transport managed by the platform is chosen.

Two types exist:

  • TURN servers: fallback WebRTC relays. They can be PUBLIC (accessible to all organizations) or PRIVATE (explicit association required).

  • Websocket relays: based on mini-containers, useful for highly constrained networks. They are private and require explicit association.

This page also covers best practices for correctly configuring URL, SNI, Base URLs, and certificates.

TURN Servers

TURN servers relay the WebRTC stream when peer-to-peer establishment fails (strict NAT, firewall, proxy). They ensure reliability at the cost of higher latency compared to direct connections.

Access: verified_user Admin Area > shield Network & Security > cast TURN Relays.

Create a TURN server

  1. Open verified_user Admin Area > shield Network & Security > cast TURN Relays, then click + New TURN Relay.

  2. Fill in the form fields.

  3. Click Create.

Form Fields

  • Name: internal identifier (e.g., TURN1).

  • Visibility: PUBLIC or PRIVATE.

  • Host: FQDN or IP of the TURN server.

  • Port: listening port (commonly 443).

  • Authentication: authentication mode for the TURN server.

    • Username and password: all clients receive the same credentials, which never change.

    • Shared secret: the API derives a credential valid for 24 hours from this secret, per connection. The TURN server must run in use-auth-secret mode.

Note

The shared secret is never sent to the client: only your TURN server and Reemo know it. For each connection, Reemo derives a temporary credential from it, valid for 24 hours. Unlike a fixed username and password shared by every client, this method limits the impact of a leak: generated credentials expire quickly and are never reused.

Associate a private TURN server

A TURN server can have 2 visibility statuses in the platform:

  • PUBLIC: available to all organizations.

  • PRIVATE: must be explicitly associated with an organization.

This association is done from the organization’s settings — see TURN Servers. From a relay server’s profile, you can see which organizations are currently associated with it.

TURN best practices

  • Prefer port 443 to bypass corporate proxies.

  • Segment by environment or organization using PRIVATE visibility and targeted associations.

Websocket Relays

Websocket relays replace WebRTC. Reemo deploys mini relay containers on a cluster (SWARM or Kubernetes) that transfer packets between the user and the target resource. They are useful in highly constrained networks or to unify the transport on the user side.

Access: verified_user Admin Area > shield Network & Security > settings_ethernet Websocket Relays.

Create a Websocket relay

  1. Open verified_user Admin Area > shield Network & Security > settings_ethernet Websocket Relays, then click + New Websocket Relay.

  2. Fill in the form fields.

  3. Click Create.

Once the relay is created, you can test it from the Websocket relay list using the Test button.

Note

The Test button checks that the relay server is reachable and can provision containers. A green Success or red Failed badge then appears next to the button depending on the result.

Form Fields

  • Type: target engine (SWARM or KUBERNETES).

  • Name: internal relay identifier.

  • URL: cluster URL to contact to create the relay mini-containers.

  • Server Name (SNI): server name expected in the SSL certificate presented by the relay.

  • Relay IP Addresses: fallback IPs if the relay is unreachable via DNS (comma-separated list).

  • Websocket Base URL: public URL used by the users’ browser.

  • Status Base URL: status URL called by the provisioning API to know when the relay is ready.

  • HAProxy stats port: port exposing HAProxy statistics (8404 by default). Used by the node diagnostic.

  • Certificate: choose to use an existing certificate, then select it from the list.

Associate a Websocket relay

  1. Go to verified_user Admin Area > domain Organizations.

  2. Select the desired organization.

  3. Click admin_panel_settings Administration > settings_ethernet Websocket Relay.

  4. Check Enable Websocket Relay, then select the Relay to use.

  5. Click Save.

Note

By default, the relay applies to all containers in the organization. Check Optional for containers to make it optional instead: it will then need to be enabled manually on each container profile.


You can also associate a relay directly with a Container Provider. In this case, the relay will be used directly by the organizations linked to that provider without the need for explicit relay association. From a relay server’s profile, you can see which organizations are currently associated with it.

Websocket best practices

  • Websocket Base URL must be public, stable, and covered by the certificate.

  • Configure SNI to secure client-side TLS validation.

  • Use Relay IP Addresses only as fallback.

  • Size the target cluster to handle the on-demand creation of mini-containers.