;==============================================================================
; rtp.conf  —  media port range + STUN/TURN for WebRTC ICE
;==============================================================================

[general]
; RTP/DTLS-SRTP media port range. Open this whole UDP range on the firewall
; (and forward it if Asterisk is behind NAT). 10000-20000 is the classic range;
; shrink to what you actually need (each concurrent call ~= 2-4 ports).
rtpstart=10000
rtpend=20000

; --- ICE / STUN --------------------------------------------------------------
; STUN lets Asterisk learn its own public reflexive address so it can offer a
; reachable ICE candidate to mobiles on cellular/CGNAT networks.
stunaddr=stun.l.google.com:19302

; --- TURN (recommended for field engineers on locked-down mobile networks) ----
; STUN alone fails on symmetric NAT (common on carrier CGNAT). A TURN relay
; guarantees media flows. Run coturn and point these at it.
;turnaddr=turn.yourdomain.com:3478
;turnusername=turnuser
;turnpassword=turnsecret

; Enable ICE support globally (endpoints also set ice_support=yes via webrtc=yes)
icesupport=yes

; Optionally restrict which local interfaces ICE advertises (avoids leaking
; docker/vpn addresses as candidates):
;ice_blacklist=10.0.0.0/8
;ice_blacklist=172.16.0.0/12