How do you properly harden a self-hosted coturn TURN server's denied-peer-ip ACL against known bypasses that allow the relay to be abused to reach private/internal networks (TURN relay abuse, SSRF-style)?
Fix: Plain IPv4 denied-peer-ip ranges (e.g. denied-peer-ip=192.168.0.0-192.168.255.255) do not block the IPv4-mapped IPv6 form of the same addresses (::ffff:192.168.1.1) — a client can route around the denylist entirely by addressing the mapped form instead of plain IPv4. Mitigate by also adding denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255 to block the entire IPv4-mapped IPv6 range regardless of which specific coturn version/patch level is running. Separately, a related advisory covers loopback-protection bypass via 0.0.0.0, ::1, or :: used as the peer address, which plain 127.0.0.0-127.255.255.255 denial does not cover — add denied-peer-ip=0.0.0.0-0.255.255.255, denied-peer-ip=::1, and denied-peer-ip=:: explicitly. Also note: coturn's denied-peer-ip only accepts 'ip' or 'ip-ip' range syntax; CIDR notation (e.g. 192.168.0.0/16) is explicitly rejected at startup with 'Wrong address format' / 'CIDR is not supported', confirmed directly from turnserver's own error output.
coturnturnwebrtcsecurityssrfdenied-peer-ip
References
- https://github.com/coturn/coturn/security/advisories/GHSA-j8mm-mpf8-gvjg — IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL, not covered by the earlier CVE-2020-26262 fix.
- https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79 — IPv4-mapped form of 127.0.0.1 bypasses coturn's default loopback peer protection, published 2026-06-26, affecting versions up to at least 4.12.0/4.14.0-era builds.
- https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p — Loopback bypass by using 0.0.0.0, [::1], or [::] as the peer address, distinct from the plain 127.x.x.x denial case.