Relay Servers

Relay servers ensure connectivity between users and their resources (VMs, containers, remote desktops) when a direct WebRTC connection is not possible or when a Websocket transport managed by the platform is chosen.

Two types exist:

  • TURN Servers: standard relays for WebRTC.

  • Websocket Relays: Websocket tunnels managed by mini-containers deployed on demand.

Note

TURN relays can be PUBLIC (accessible to all organizations) or PRIVATE (explicit association required).

Note

Websocket relays are private and require explicit association.

TURN Servers

Role

TURN servers relay the WebRTC stream when peer-to-peer establishment fails (strict NAT, firewall, proxy). They ensure reliability at the cost of higher latency compared to direct connections.

Create a TURN server

../../_static/images/instance/relays/instance_relay_turn_create.png

Creating a TURN server.

  1. Open TURN Relays → New TURN Relay.

  2. Fill in the fields below.

  3. Create.

  • Name: internal identifier (e.g., TURN1).

  • Visibility: PUBLIC or PRIVATE.

  • Host: FQDN or IP of the TURN server.

  • Port: listening port (commonly 443).

  • Username: TURN authentication username.

  • Password: TURN password.

View TURN servers

  • The list displays Host, Port, Status.

  • Open a server to view details and linked organizations.

../../_static/images/instance/relays/instance_relay_turn_list.png

List of TURN servers.


From a relay server profile, you can see which organizations are currently associated with it.

../../_static/images/instance/relays/instance_relay_turn_profile.png

TURN server profile.

Associate a private TURN server

A TURN server can have 2 visibility statuses in the platform:

  • PUBLIC: available to all organizations.

  • PRIVATE: must be explicitly associated with an organization.

Association procedure:

  1. In the organization, open the Settings page and go to the TURN Relay Servers tab.

  2. Select Assign existing and choose the server.

  3. Save.

../../_static/images/instance/relays/instance_orga_relay_turn_assign.png

Association of a private TURN server with an organization.

TURN best practices

  • Prefer port 443 to bypass corporate proxies.

  • Segment by environment or organization using PRIVATE visibility and targeted associations.

Websocket Relays

Role

Websocket relays replace WebRTC. Reemo deploys mini relay containers on a cluster (SWARM or Kubernetes) that transfer packets between the user and the target resource. They are useful in highly constrained networks or to unify the transport on the user side.

Create a Websocket relay

../../_static/images/instance/relays/instance_relay_websocket_create.png

Creating a Websocket relay.

  1. Open Websocket Relays → New Websocket Relay.

  2. Fill in the fields below.

  3. Create.

  • Type: target engine (SWARM or KUBERNETES).

  • Name: internal relay identifier.

  • URL: cluster URL to contact to create the relay mini-containers.

  • Server Name (SNI): server name expected in the SSL certificate presented by the relay.

  • Relay IP Addresses: fallback IPs if the relay is unreachable via DNS (comma-separated list).

  • Websocket Base URL: public URL used by the users’ browser.

  • Status Base URL: status URL called by the provisioning API to know when the relay is ready.

  • Certificate: TLS certificate to use (select from existing certificates).

View Websocket servers

  • The list allows you to test basic availability.

  • The profile displays URL, SNI, Base URLs, certificate, and association tabs.

../../_static/images/instance/relays/instance_relay_websocket_list.png

List of Websocket relays.


From a relay server profile, you can see which organizations are currently associated with it.

../../_static/images/instance/relays/instance_relay_websocket_profile.png

Websocket relay profile.

Associate a Websocket relay

  • In the organization, open Websocket Relay.

  • Enable Enable Websocket Relay and select the relay.

  • Save.

../../_static/images/instance/relays/instance_relay_websocket_assign.png

Enabling and selecting a Websocket relay for the organization.


You can also associate a relay directly with a Container Provider. In this case, the relay will be used directly by the organizations linked to that provider without the need for explicit relay association.

../../_static/images/instance/relays/instance_relay_websocket_profile_providers_tab.png

List of Container Providers linked to this relay

Websocket best practices

  • Websocket Base URL must be public, stable, and covered by the certificate.

  • Configure SNI to secure client-side TLS validation.

  • Use Relay IP Addresses only as fallback.

  • Size the target cluster to handle the on-demand creation of mini-containers.

Summary

  • TURN: fallback WebRTC relays to guarantee connectivity.

  • Websocket: single transport based on mini-containers, useful in constrained networks.

  • PUBLIC/PRIVATE: global access control vs explicit association.

  • Associations:

    • Private TURN/Websocket → associate with the organization.

    • Websocket → can also be linked to Container Providers.

  • Correctly configure URL, SNI, Base URLs, and certificate for reliable operation.