bigbluebutton
Add allowed and denied peer to turnserver.conf
Following [1] and [2] the TURN-Server can be used to access the network behind the TURN-Server or the server can be abused to relay attacks in the internet. To workaround those problems denied-peer-ip and allowed-peer-ip setting should be used.
[1] https://www.rtcsec.com/post/2020/04/how-we-abused-slacks-turn-servers-to-gain-access-to-internal-services/ [2] https://www.rtcsec.com/post/2021/01/details-about-cve-2020-26262-bypass-of-coturns-default-access-control-protection/
If the TURN server is used by multiple BBB servers?
https://github.com/bigbluebutton/bigbluebutton.github.io/pull/233/files#diff-1a3e0cf20383b357d6a073f8ccb95126f5b7d7e9d5192c99fb564c0e9dc139c2R112
And the blind shall see ;-)
This is a good pull request and makes the internet a lot safer!
we run this setup in production since many months (can't remember since when). I'd recommend everyone to protect their turn servers using this setting.
