WebRTC ICE Connection Failures with Amazon Kinesis Video Streams in Different Network Environments

Question

I'm experiencing WebRTC connectivity issues when implementing peer-to-peer video streaming with Amazon Kinesis Video Streams (KVS). The specific behavior I'm observing:

Same WiFi Network: M@ster  and Viewer can connect successfully when on the same WiFi network.
Different Networks: When M@ster and viewer are on different networks (different WiFi or cellular/WiFi), the connection fails with error: "WebRTC: ICE failed, see about for more details"
Relay Mode Testing: When I explicitly force iceTransportPolicy: "relay" to use TURN servers, the connection fails even when both peers are on the same network.

My Implementation Details
I'm using the following AWS SDK packages with React 18:

@aws-sdk/client-kinesis-video
@aws-sdk/client-kinesis-video-signaling
amazon-kinesis-video-streams-webrtc
webrtc-adapter

We are using same Channel Arn everytime for a specific Channel Name.

My ICE server configuration code:
javascriptconst iceServerConfig = new GetIceServerConfigCommand({
    ChannelARN: channelARN,
});
const iceServerResponse = await kinesisSignalingClient.send(iceServerConfig);
const iceServers = [
    { urls: `stun:stun.kinesisvideo.${region}.amazonaws.com:443` },
    ...iceServerResponse.IceServerList.map((server) => ({
        urls: server.Uris,
        username: server.Username,
        credential: server.Password,
    })),
];
My AWS client initialization:
javascriptconst kinesisVideoClient = new KinesisVideo({
    region,
    credentials: {
        accessKeyId: awsCredentials.accessKeyId,
        secretAccessKey: awsCredentials.secretAccessKey,
        ...(awsCredentials.sessionToken && { sessionToken: awsCredentials.sessionToken })
    },
    correctClockSkew: true,
});
Troubleshooting Steps Already Tried

Verified that both peers have internet connectivity
Confirmed that my IAM permissions include proper access to KVS resources
Added detailed logging for ICE candidates and connection states
Tested with different browsers (Chrome, Firefox)
Verified the TURN credentials are being properly passed to the RTCPeerConnection

Questions

Is there a known issue with KVS TURN servers not properly relaying WebRTC traffic across different networks?
Are there specific configuration parameters needed for cross-network connectivity with KVS WebRTC?
Should I be setting a specific TTL for the ICE server credentials to ensure they don't expire during connection establishment?
Are there any recommended network diagnostics I should perform to identify potential firewall or NAT issues?
Is there any specific region configuration that might affect TURN server performance?

Any guidance or solutions would be greatly appreciated. Our application needs to support users connecting from various networks and environments.
Thank you!

re:Post Agent · Answer

Based on your description, it appears you're facing challenges with WebRTC connectivity using Amazon Kinesis Video Streams (KVS) across different network environments. Let's address your concerns and provide some troubleshooting steps:

1. Cross-network connectivity issues are common with WebRTC, especially when NATs and firewalls are involved. The fact that your connection works on the same WiFi network but fails across different networks suggests that your STUN/TURN configuration might need adjustment.

2. For the TURN server relay mode failure, even on the same network, this could indicate an issue with your TURN server configuration or credentials.

To address these issues:

1. Increase the ICE timeouts to allow more time for candidate gathering and connectivity checks. You can adjust the following parameters:
   - iceConnectionCheckTimeout: Increase this for unstable or slow networks.
   - iceCandidateNominationTimeout: Increase this to ensure candidate pairs with local relay candidates are tried.
   - iceConnectionCheckPollingInterval: Adjust this to change the frequency of connectivity checks.

2. Verify your TURN server configuration. Ensure that the TURN credentials are correct and not expired. KVS TURN servers should be capable of relaying WebRTC traffic across different networks when configured correctly.

3. Enable verbose logging for ICE candidates and connection states. This will help you identify where exactly the connection is failing.

4. Check your network configuration to ensure all required endpoints for KVS WebRTC are accessible, including STUN and TURN servers.

5. Implement proper error handling in your application to catch and respond to disconnection events.

6. Use the AWS CLI to describe the Kinesis Video Streams signaling channel endpoints:
   ```
   aws kinesisvideo describe-signaling-channel
   ```
   This will help verify that your STUN and TURN servers are configured correctly.

7. Review the WebRTC logs from both successful (same network) and failed (different network) connection attempts. Look for differences in ICE candidate generation and negotiation.

8. Regarding TTL for ICE server credentials, KVS typically handles this automatically. However, ensure you're using the latest credentials for each connection attempt.

9. For network diagnostics, you can use tools like WebRTC Internals in Chrome to gather detailed information about the ICE candidates and connection process.

10. Region configuration shouldn't significantly affect TURN server performance, but ensure you're using the correct region for your KVS resources.

If these steps don't resolve the issue, you may need to implement your own reconnection logic to handle cases where the SDK fails to connect automatically. Also, consider updating to the latest version of the Amazon KVS WebRTC SDK, as newer versions may have resolved similar connectivity issues.

Remember, WebRTC connections can be complex, especially across different network environments. Proper error handling and connection state management are crucial for robust WebRTC applications.  
**Sources**  
[Troubleshooting Amazon Kinesis Video Streams with WebRTC - Kinesis Video Streams](https://docs.aws.amazon.com/kinesisvideostreams-webrtc-dg/latest/devguide/troubleshooting.html)  
[kvsWebrtcClientMasterGstSample: viewer failed to connect back when disconnected until app restarted, operation returned status code: 0x5a000025 | AWS re:Post](https://repost.aws/questions/QUDcKB64M9TzOHSqtzRoLk0g/kvswebrtcclientmastergstsample-viewer-failed-to-connect-back-when-disconnected-until-app-restarted-operation-returned-status-code-0x5a000025)  
[WebRTC configuration on Prod | AWS re:Post](https://repost.aws/questions/QUoNEYYfjQRaGXnTlrfmGb2Q/webrtc-configuration-on-prod)

WebRTC ICE Connection Failures with Amazon Kinesis Video Streams in Different Network Environments

Relevant content