Skip to content

On-premises relay servers#

An on-premises relay server is a TURN server you operate to relay Jump Desktop connections. Jump Desktop Connect sends Fluid connection traffic through it on UDP ports you choose, so you control the network path, firewall rules, and QoS. Deploy one when relayed traffic must pass through servers under your control.

  • The relay carries connection traffic only; hosts still sign in to Jump and receive relay settings from a Connect Configuration. To run without Jump's cloud, see Choose a connectivity option.
  • Traffic is end-to-end encrypted; the relay cannot decrypt it.

Applies to#

  • Jump Desktop for Teams Enterprise plan.
  • Team administrators.
  • Fluid connections to hosts running Jump Desktop Connect on Windows, macOS, or Linux Alpha. Client devices require no configuration.

Before you start#

  • A Linux server with Docker installed. The relay has been tested on CentOS, AlmaLinux, Rocky Linux, and Ubuntu.
  • A quad-core or better processor and at least 4 GB of RAM.
  • Choose the relay's network placement:
Placement Diagram
Outside your network, on a public IP Relay server on the public internet, reached by clients and by internal servers over UDP 3478 and a connection port range
Inside your network, behind NAT Relay server on the internal LAN behind a firewall, with the connection port range forwarded from a public IP

1. Run the relay server#

The relay runs the open-source coturn TURN server in Docker.

  1. Choose a relay port, a username, and a strong, unique password. The credentials are copied to every host assigned the configuration and are visible in the Teams dashboard.
  2. Choose a connection port range. Each simultaneous connection uses one UDP port from this range.

  3. On the relay server, run the following commands with your values. RELAY_EXTERNAL_IP is the server's public IP address (the NAT's public IP if the relay is behind NAT).

    export RELAY_PORT=3478
export RELAY_USERNAME="MyUserName"
export RELAY_PASSWORD="MyPassword"
export RELAY_EXTERNAL_IP=1.2.3.4
export RELAY_CONNECTION_MIN_PORT=49152
export RELAY_CONNECTION_MAX_PORT=49552

sudo docker run \
   -d \
   -p $RELAY_PORT:$RELAY_PORT/udp \
   -p $RELAY_CONNECTION_MIN_PORT-$RELAY_CONNECTION_MAX_PORT:$RELAY_CONNECTION_MIN_PORT-$RELAY_CONNECTION_MAX_PORT/udp \
   --restart=always \
   docker.io/coturn/coturn \
   --listening-port $RELAY_PORT \
   --min-port $RELAY_CONNECTION_MIN_PORT \
   --max-port $RELAY_CONNECTION_MAX_PORT \
   --external-ip=$RELAY_EXTERNAL_IP \
   --no-tcp-relay \
   --no-cli \
   --user "$RELAY_USERNAME:$RELAY_PASSWORD" \
   --realm jumpdesktop.com \
   --lt-cred-mech \
   --pidfile /tmp/turnserver.pid

2. Open firewall ports#

  • On the relay server, allow inbound and outbound UDP on RELAY_PORT and the connection port range.
  • If the relay is behind NAT, forward UDP on the connection port range (for example, external 49152-49552 to internal 192.0.2.10, ports 49152-49552).

Tip

Stopping or restarting a firewall service such as firewalld or ufw flushes the rules Docker creates. To restore the rules, run sudo systemctl restart docker afterwards.

Warning

Restrict a relay inside your network so that it reaches only the machines that require it:

  • Between the relay and internal machines, allow only UDP on RELAY_PORT and the connection port range, initiated by the internal machines.
  • Block TCP connections from the relay to internal machines.
  • Recommended: block the relay from initiating outbound UDP connections to the internet, so internet traffic reaches the relay only as inbound traffic on the connection port range.

3. Add the relay to a Connect Configuration#

  1. Create or edit a Connect Configuration.

  2. In Networking, click Edit next to On Premise Relay Servers.

    On Premise Relay Servers row with an Edit button

  3. In Edit Relays, click Add.

    Edit Relays dialog with no relay servers and Add and Close buttons

  4. Enter the Username and Password you chose, and the Host as address:port (for example, 1.2.3.4:3478). If the port is omitted, 3478 is used. If the relay is behind NAT or computers reach it only on your LAN, enter its internal LAN address. Click Save.

    Add New Relay dialog with Username, Password, and Host fields

  5. Optional: add a second relay so connections continue to work when one relay is unavailable.

  6. Click Close.

  7. Optional: select Relay Connections Only. For details, see Force connections through a relay.

    Relay Connections Only checkbox

  8. Save the configuration and assign it to the hosts that should use the relay.

Force connections through a relay#

By default, Connect attempts a direct peer-to-peer connection first and uses a relay only when the direct attempt fails. To send every connection through a relay, select Relay Connections Only.

  • When your relays are configured, a relay-only connection uses your relays, not relays offered by the client.

The following table shows how Relay Connections Only combines with Direct Connections Only:

Settings on Result
Relay Connections Only Every connection is routed through a relay: your relays if configured, otherwise Jump's public relays.
Direct Connections Only Connections use only a direct network path, with no relays.
Both Every connection is routed through a relay, but Jump's public relays are not used. Connections succeed only when on-premises relays are configured; otherwise, they fail.

Verify connections use the relay#

To check quickly whether a session is relayed, click Help > Show Fluid Connection Stats on a Windows or Mac client during the session. Connection shows Relay for a relayed connection but does not identify which relay.

To identify which relay a connection uses, complete these steps on a Windows or Mac client:

  1. Connect to a host assigned the configuration.
  2. Click Help > Diagnostic Logs... and open the most recent log.
  3. Search for Got candidate. At least one match should contain your relay's address.
  4. If Relay Connections Only is selected, search for Using Cand. The most recent match should contain your relay's address.

Optional: reduce packet loss#

Larger socket buffers on the relay server can reduce packet loss. The change affects every app and container on the relay server.

sudo tee /etc/sysctl.d/99-jump-relay-socket-buffers.conf >/dev/null <<'EOF'
net.core.rmem_default=4194304
net.core.rmem_max=4194304
net.core.wmem_default=4194304
net.core.wmem_max=4194304
EOF
sudo sysctl --system

Reboot the relay server or restart the relay container. Then verify that all four values show 4194304:

sysctl net.core.rmem_default net.core.rmem_max net.core.wmem_default net.core.wmem_max

To revert the change, run sudo rm -f /etc/sysctl.d/99-jump-relay-socket-buffers.conf, then sudo sysctl --system.

Limitations#

  • The Teams dashboard configures relays for UDP only.
  • The size of the connection port range limits the number of simultaneous connections the relay carries.