Janus WebRTC Gateway Installation on Ubuntu (Production Guide)

Janus • WebRTC Gateway • Ubuntu • Production Hardening • NAT/ICE/TURN

Janus WebRTC Gateway Installation on Ubuntu (Production Guide: from Zero → Hardened)

This is a production-focused guide to installing Janus WebRTC Gateway on Ubuntu, with the exact decisions you must make for real traffic: which Ubuntu version, which Janus version strategy, why we run TURN, how to set NAT/ICE, how to run Janus as a service, how to secure it, and how to validate audio works end-to-end.

1) Choosing versions: Ubuntu, Janus, plugins

2) Production architecture (why Janus + TURN + firewall)

The most common reason “WebRTC worked in my laptop test but fails in production” is networking: NAT, UDP policies, and missing TURN.

3) Server prerequisites and sizing

4) Install dependencies (safe defaults)

Janus is C-based and commonly built from source. The dependency list looks long, but you can treat it as “build tools + crypto + WebSockets + codecs”.

# 1) Update OS packages
sudo apt-get update
sudo apt-get -y upgrade

# 2) Build tools + common libs
sudo apt-get install -y \
  git autoconf automake libtool pkg-config \
  build-essential cmake ninja-build \
  libmicrohttpd-dev libjansson-dev libssl-dev \
  libsrtp2-dev libcurl4-openssl-dev \
  libsofia-sip-ua-dev \
  libglib2.0-dev libopus-dev libogg-dev libini-config-dev \
  gengetopt libconfig-dev

# Optional but common:
sudo apt-get install -y \
  libnice-dev \
  libwebsockets-dev \
  libnanomsg-dev

# Helpful tools
sudo apt-get install -y \
  unzip wget curl htop net-tools tcpdump

5) Build & install Janus from source (recommended)

# Choose a working directory
cd /usr/src

# Clone Janus
sudo git clone https://github.com/meetecho/janus-gateway.git
cd janus-gateway

# (Recommended) checkout a specific tag/release
# Example:
# sudo git checkout v1.2.3
# Use the tag you have tested in staging.

# Build system
sudo sh autogen.sh

# Configure install path
sudo ./configure --prefix=/opt/janus --enable-websockets --enable-rest

# Build and install
sudo make -j"$(nproc)"
sudo make install
sudo make configs

# Create a symlink for convenience
sudo ln -sf /opt/janus/bin/janus /usr/local/bin/janus

6) Core Janus config (janus.jcfg)

Janus uses configuration files to enable transports (how you connect to Janus) and plugins (what Janus can do). The single most important core file is typically: janus.jcfg.

# Example location:
# /opt/janus/etc/janus/janus.jcfg

general: {
  # In production, keep logs structured and not too verbose
  debug_level = 4
  debug_timestamps = true
  debug_colors = false

  # If you are behind NAT, you must handle this properly (covered below)
  # nat_1_1_mapping = "YOUR_PUBLIC_IP"
  # ice_enforce_list = "eth0"
}

# RTP settings:
media: {
  # IMPORTANT: open these ports in firewall (see firewall section)
  rtp_port_range = "20000-40000"
}

7) ICE / STUN / TURN: what to configure and why

If you deploy Janus in production and do not configure TURN, you will get user reports like: “Works on my home Wi-Fi, fails on office network.”

8) NAT, public IP, and tricky cloud networking

Most production Janus problems are not “Janus bugs”. They are: wrong public IP advertised, wrong interface selected, or blocked UDP ports.

# Example (edit your janus.jcfg):
general: {
  # If Janus has private IP but is reachable via public IP:
  nat_1_1_mapping = "YOUR_PUBLIC_IP"

  # Ensure Janus advertises only the correct NIC (example: eth0)
  ice_enforce_list = "eth0"
}

media: {
  rtp_port_range = "20000-40000"
}

9) SIP plugin basics (optional but common)

Many deployments use Janus SIP plugin to connect WebRTC browsers to SIP infrastructure (like Asterisk/FreePBX) for PSTN or call routing.

10) Run Janus with systemd (service, logs, restarts)

Production means: Janus starts on boot, restarts if it crashes, and logs are centralized. systemd is the standard way on Ubuntu.

# Create a dedicated user for Janus (recommended)
sudo useradd --system --no-create-home --shell /usr/sbin/nologin janus

# Create log directory
sudo mkdir -p /var/log/janus
sudo chown -R janus:janus /var/log/janus

# Create systemd unit
sudo tee /etc/systemd/system/janus.service > /dev/null <<'EOF'
[Unit]
Description=Janus WebRTC Gateway
After=network.target

[Service]
Type=simple
User=janus
Group=janus
ExecStart=/opt/janus/bin/janus -F /opt/janus/etc/janus
Restart=always
RestartSec=2
LimitNOFILE=1048576

# Hardening (safe defaults)
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
ReadWritePaths=/var/log/janus /opt/janus

[Install]
WantedBy=multi-user.target
EOF

# Reload and start
sudo systemctl daemon-reload
sudo systemctl enable janus
sudo systemctl start janus

# Check status and logs
sudo systemctl status janus --no-pager
sudo journalctl -u janus -n 200 --no-pager

11) Firewall ports & network rules (tables)

The most important “production” part is opening the correct ports. If you do not open media UDP, your WebRTC will appear to “connect” and then have silence, or it will fail for some users.

12) TLS: HTTPS, WSS, and secure signaling

WebRTC media is encrypted (DTLS/SRTP), but your signaling layer (how the browser talks to your server/Janus) still needs proper HTTPS/WSS in production.

13) Validation & troubleshooting (what to test first)

# Check service
sudo systemctl status janus --no-pager

# Check listeners (example)
sudo ss -lntup | grep -E 'janus|8088|8089|8188|8989'

# Tail logs
sudo journalctl -u janus -f

# On Janus box: watch UDP traffic when a browser tries to connect
sudo tcpdump -n -i any udp portrange 20000-40000

# If you see nothing during call attempts:
# - firewall blocks UDP range
# - Janus advertised wrong IP (NAT mapping)
# - ICE/TURN not configured correctly

14) Production checklist (copy/paste)

15) References and next articles