I’m facing an issue publishing my local captured media over a remote relay server which works well whenever I run the relay server on my local machine and connect via my local network.
The relay server is mediamtx and I run a local instance by
docker run --rm -it \
-e MTX_PROTOCOLS=tcp \
-e MTX_WEBRTCADDITIONALHOSTS=192.168.2.36 \
-p 8554:8554 \
-p 1935:1935 \
-p 8888:8888 \
-p 8889:8889 \
-p 8890:8890/udp \
-p 8189:8189/udp \
bluenviron/mediamtx:1.4.2
mediamtx uses WHIP to expose endpoints for sending local SDP and ICE candidates. I use WebRTC for iOS on my client app.
My WebRTC on iOS generates the following local SDP message that I send to mediamtx:
v=0
o=- 5696695924308715550 2 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE 0 1
a=extmap-allow-mixed
a=msid-semantic: WMS out
m=audio 9 UDP/TLS/RTP/SAVPF 111 63 9 102 0 8 13 110 126
c=IN IP4 0.0.0.0
a=rtcp:9 IN IP4 0.0.0.0
a=ice-ufrag:tE/a
a=ice-pwd:Jqbs8enq5rCDTDFMRp0U0+0F
a=ice-options:trickle renomination
a=fingerprint:sha-256 98:23:78:59:E5:14:D7:DF:35:FE:D9:BD:50:61:B0:DD:11:B5:15:55:0A:44:66:FB:BF:11:8B:1B:C3:13:EB:8A
a=setup:actpass
a=mid:0
a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
a=extmap:2 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
a=extmap:3 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:mid
a=sendrecv
a=msid:out audio0out
a=rtcp-mux
a=rtpmap:111 opus/48000/2
a=rtcp-fb:111 transport-cc
a=fmtp:111 minptime=10;useinbandfec=1
a=rtpmap:63 red/48000/2
a=fmtp:63 111/111
a=rtpmap:9 G722/8000
a=rtpmap:102 ILBC/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:13 CN/8000
a=rtpmap:110 telephone-event/48000
a=rtpmap:126 telephone-event/8000
a=ssrc:371128085 cname:CTXZYu0staSgX5W2
a=ssrc:371128085 msid:out audio0out
m=video 9 UDP/TLS/RTP/SAVPF 96 97 98 99 100 101 127 103 35 36 104 105 106
c=IN IP4 0.0.0.0
a=rtcp:9 IN IP4 0.0.0.0
a=ice-ufrag:tE/a
a=ice-pwd:Jqbs8enq5rCDTDFMRp0U0+0F
a=ice-options:trickle renomination
a=fingerprint:sha-256 98:23:78:59:E5:14:D7:DF:35:FE:D9:BD:50:61:B0:DD:11:B5:15:55:0A:44:66:FB:BF:11:8B:1B:C3:13:EB:8A
a=setup:actpass
a=mid:1
a=extmap:14 urn:ietf:params:rtp-hdrext:toffset
a=extmap:2 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
a=extmap:13 urn:3gpp:video-orientation
a=extmap:3 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
a=extmap:5 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
a=extmap:6 http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
a=extmap:7 http://www.webrtc.org/experiments/rtp-hdrext/video-timing
a=extmap:8 http://www.webrtc.org/experiments/rtp-hdrext/color-space
a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:mid
a=extmap:10 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id
a=extmap:11 urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id
a=sendrecv
a=msid:out video0
a=rtcp-mux
a=rtcp-rsize
a=rtpmap:96 H264/90000
a=rtcp-fb:96 goog-remb
a=rtcp-fb:96 transport-cc
a=rtcp-fb:96 ccm fir
a=rtcp-fb:96 nack
a=rtcp-fb:96 nack pli
a=fmtp:96 level-asymmetry-allowed=1;packetization-mode=1;profile-level-id=640c34
a=rtpmap:97 rtx/90000
a=fmtp:97 apt=96
a=rtpmap:98 H264/90000
a=rtcp-fb:98 goog-remb
a=rtcp-fb:98 transport-cc
a=rtcp-fb:98 ccm fir
a=rtcp-fb:98 nack
a=rtcp-fb:98 nack pli
a=fmtp:98 level-asymmetry-allowed=1;packetization-mode=1;profile-level-id=42e034
a=rtpmap:99 rtx/90000
a=fmtp:99 apt=98
a=rtpmap:100 VP8/90000
a=rtcp-fb:100 goog-remb
a=rtcp-fb:100 transport-cc
a=rtcp-fb:100 ccm fir
a=rtcp-fb:100 nack
a=rtcp-fb:100 nack pli
a=rtpmap:101 rtx/90000
a=fmtp:101 apt=100
a=rtpmap:127 VP9/90000
a=rtcp-fb:127 goog-remb
a=rtcp-fb:127 transport-cc
a=rtcp-fb:127 ccm fir
a=rtcp-fb:127 nack
a=rtcp-fb:127 nack pli
a=rtpmap:103 rtx/90000
a=fmtp:103 apt=127
a=rtpmap:35 AV1/90000
a=rtcp-fb:35 goog-remb
a=rtcp-fb:35 transport-cc
a=rtcp-fb:35 ccm fir
a=rtcp-fb:35 nack
a=rtcp-fb:35 nack pli
a=rtpmap:36 rtx/90000
a=fmtp:36 apt=35
a=rtpmap:104 red/90000
a=rtpmap:105 rtx/90000
a=fmtp:105 apt=104
a=rtpmap:106 ulpfec/90000
a=ssrc-group:FID 3423376253 1561297510
a=ssrc:3423376253 cname:CTXZYu0staSgX5W2
a=ssrc:3423376253 msid:out video0
a=ssrc:1561297510 cname:CTXZYu0staSgX5W2
a=ssrc:1561297510 msid:out video0
I then receive the SDP answer from the server, set it on my peer connection and send the following ICE candidates to mediamtx:
a=ice-ufrag:e9vc
a=ice-pwd:innkHj7tp01zblvLlRvDqpXV
m=audio 9 UDP/TLS/RTP/SAVPF 111 63 9 102 0 8 13 110 126
a=mid:0
a=candidate:921562002 1 udp 2122260223 192.168.100.232 52871 typ host generation 0 ufrag e9vc network-id 1 network-cost 10
a=candidate:1925009008 1 udp 2122194687 169.254.254.183 53101 typ host generation 0 ufrag e9vc network-id 2 network-cost 10
a=candidate:4192683786 1 udp 2121998079 10.134.230.124 61138 typ host generation 0 ufrag e9vc network-id 7 network-cost 900
a=candidate:4294302202 1 udp 2122131711 2a02:3032:305:edcb:e809:26f9:efe7:4032 57345 typ host generation 0 ufrag e9vc network-id 8 network-cost 900
a=candidate:2966715779 1 udp 2122066175 2a02:303e:2b17:3f50:599f:f17:bf24:5bbc 57939 typ host generation 0 ufrag e9vc network-id 9 network-cost 900
a=candidate:3315951815 1 udp 2121937663 fdfe:f2d:3c26::1 61577 typ host generation 0 ufrag e9vc network-id 10 network-cost 50
a=candidate:2847309219 1 udp 2121869567 2a02:303e:2b17:3f50:1825:7933:ec1f:af3b 56368 typ host generation 0 ufrag e9vc network-id 3 network-cost 50
a=candidate:2847309219 1 udp 2121804031 2a02:303e:2b17:3f50:1825:7933:ec1f:af3b 58951 typ host generation 0 ufrag e9vc network-id 4 network-cost 50
a=candidate:3360112390 1 tcp 1518280447 192.168.100.232 58625 typ host tcptype passive generation 0 ufrag e9vc network-id 1 network-cost 10
a=candidate:2350357220 1 tcp 1518214911 169.254.254.183 58626 typ host tcptype passive generation 0 ufrag e9vc network-id 2 network-cost 10
a=candidate:122524574 1 tcp 1518018303 10.134.230.124 58627 typ host tcptype passive generation 0 ufrag e9vc network-id 7 network-cost 900
a=candidate:23006574 1 tcp 1518151935 2a02:3032:305:edcb:e809:26f9:efe7:4032 58628 typ host tcptype passive generation 0 ufrag e9vc network-id 8 network-cost 900
a=candidate:1316923671 1 tcp 1518086399 2a02:303e:2b17:3f50:599f:f17:bf24:5bbc 58629 typ host tcptype passive generation 0 ufrag e9vc network-id 9 network-cost 900
a=candidate:990886995 1 tcp 1517957887 fdfe:f2d:3c26::1 58630 typ host tcptype passive generation 0 ufrag e9vc network-id 10 network-cost 50
a=candidate:1461496119 1 tcp 1517889791 2a02:303e:2b17:3f50:1825:7933:ec1f:af3b 58631 typ host tcptype passive generation 0 ufrag e9vc network-id 3 network-cost 50
a=candidate:1461496119 1 tcp 1517824255 2a02:303e:2b17:3f50:1825:7933:ec1f:af3b 58632 typ host tcptype passive generation 0 ufrag e9vc network-id 4 network-cost 50
a=candidate:388287157 1 udp 1686052607 176.95.203.239 52871 typ srflx raddr 192.168.100.232 rport 52871 generation 0 ufrag e9vc network-id 1 network-cost 10
a=candidate:2217923902 1 udp 1685790463 176.0.150.230 32375 typ srflx raddr 10.134.230.124 rport 61138 generation 0 ufrag e9vc network-id 7 network-cost 900
m=video 9 UDP/TLS/RTP/SAVPF 96 97 98 99 100 101 127 103 35 36 104 105 106
a=mid:1
a=candidate:921562002 1 udp 2122260223 192.168.100.232 51015 typ host generation 0 ufrag e9vc network-id 1 network-cost 10
a=candidate:1925009008 1 udp 2122194687 169.254.254.183 50750 typ host generation 0 ufrag e9vc network-id 2 network-cost 10
a=candidate:4192683786 1 udp 2121998079 10.134.230.124 50664 typ host generation 0 ufrag e9vc network-id 7 network-cost 900
a=candidate:4294302202 1 udp 2122131711 2a02:3032:305:edcb:e809:26f9:efe7:4032 64827 typ host generation 0 ufrag e9vc network-id 8 network-cost 900
a=candidate:2966715779 1 udp 2122066175 2a02:303e:2b17:3f50:599f:f17:bf24:5bbc 63007 typ host generation 0 ufrag e9vc network-id 9 network-cost 900
a=candidate:3315951815 1 udp 2121937663 fdfe:f2d:3c26::1 64628 typ host generation 0 ufrag e9vc network-id 10 network-cost 50
a=candidate:2847309219 1 udp 2121869567 2a02:303e:2b17:3f50:1825:7933:ec1f:af3b 63069 typ host generation 0 ufrag e9vc network-id 3 network-cost 50
a=candidate:2847309219 1 udp 2121804031 2a02:303e:2b17:3f50:1825:7933:ec1f:af3b 57592 typ host generation 0 ufrag e9vc network-id 4 network-cost 50
a=candidate:3360112390 1 tcp 1518280447 192.168.100.232 58633 typ host tcptype passive generation 0 ufrag e9vc network-id 1 network-cost 10
a=candidate:2350357220 1 tcp 1518214911 169.254.254.183 58634 typ host tcptype passive generation 0 ufrag e9vc network-id 2 network-cost 10
a=candidate:122524574 1 tcp 1518018303 10.134.230.124 58635 typ host tcptype passive generation 0 ufrag e9vc network-id 7 network-cost 900
a=candidate:23006574 1 tcp 1518151935 2a02:3032:305:edcb:e809:26f9:efe7:4032 58636 typ host tcptype passive generation 0 ufrag e9vc network-id 8 network-cost 900
a=candidate:1316923671 1 tcp 1518086399 2a02:303e:2b17:3f50:599f:f17:bf24:5bbc 58637 typ host tcptype passive generation 0 ufrag e9vc network-id 9 network-cost 900
a=candidate:990886995 1 tcp 1517957887 fdfe:f2d:3c26::1 58638 typ host tcptype passive generation 0 ufrag e9vc network-id 10 network-cost 50
a=candidate:1461496119 1 tcp 1517889791 2a02:303e:2b17:3f50:1825:7933:ec1f:af3b 58639 typ host tcptype passive generation 0 ufrag e9vc network-id 3 network-cost 50
a=candidate:1461496119 1 tcp 1517824255 2a02:303e:2b17:3f50:1825:7933:ec1f:af3b 58640 typ host tcptype passive generation 0 ufrag e9vc network-id 4 network-cost 50
a=candidate:388287157 1 udp 1686052607 176.95.203.239 51015 typ srflx raddr 192.168.100.232 rport 51015 generation 0 ufrag e9vc network-id 1 network-cost 10
a=candidate:2217923902 1 udp 1685790463 176.0.150.230 32319 typ srflx raddr 10.134.230.124 rport 50664 generation 0 ufrag e9vc network-id 7 network-cost 900
Afterwards I can successfully stream my iPhone’s camera and receive the footage by opening a WHEP connection on my laptop that connects to the local mediamtx server.
HOWEVER: When I deploy the same server version remotely in my k8s cluster my stream is never getting established. I’m receiving 201 and 204 on the POST and PATCH respectively when sending first the SDP message and then the ICE candidates, so the server accepts them successfully and I’m also receiving the servers SDP message and can successfully add them to my peer connection.
The difference I can spot is that my local server has a HTTP connection whereas my remote one has an HTTPS connection. Am I missing to set some security flags somewhere on my client so it can accept incoming connections? Or is my router maybe blocking the incoming connection attempt from the server to my iPhone?
