Skip to main content
TCP may be blocked or throttled on your network. Add the -udp flag to connect to the TURN server over UDP instead:
./client-linux -udp -peer <vps-ip>:56000 -vk-link <vk-link> -listen 127.0.0.1:9000 | sudo routes.sh
By default the proxy opens 16 parallel TURN connections for VK links. Each VK TURN connection is capped at approximately 5 Mbps. If the connection is unstable, reduce to a single stream with -n 1:
./client-linux -n 1 -peer <vps-ip>:56000 -vk-link <vk-link> -listen 127.0.0.1:9000 | sudo routes.sh
If you need more throughput and the connection is stable, increase -n to open additional parallel streams.
When the WireGuard VPN is active without app exclusions, all of Termux’s traffic — including DNS — goes through the tunnel. If the tunnel is not yet fully established, DNS resolution fails.Fix this by enabling per-app routing in WireGuard for Android: go to the tunnel settings, open the Apps section, and add Termux to the excluded applications list. Termux will then always use the physical network interface for DNS and TURN connections.
The TURN server address auto-detected from the call link may be unreachable from your network. Use -turn <ip> to specify a known-working TURN server IP manually:
./client-linux -turn 5.255.211.241 -peer <vps-ip>:56000 -vk-link <vk-link> -listen 127.0.0.1:9000 | sudo routes.sh
  • For VK links: the TURN server must belong to a VK, OK (Odnoklassniki), or Mail.ru IP range.
  • For Yandex links: most Yandex TURN IP ranges do not work. Use one of the known-working IPs directly: 5.255.211.241, 5.255.211.242, 5.255.211.243, 5.255.211.245, or 5.255.211.246.
The -peer flag is required and was not provided. It must point to your VPS IP and the port the proxy server is listening on:
./client-linux -peer <vps-ip>:56000 -vk-link <vk-link> -listen 127.0.0.1:9000
Ensure the proxy server is running on the VPS and the specified port is reachable.
The routing script reads TURN IPs from the proxy client’s stdout. You must connect the two with a pipe (|):
./client-linux -peer <vps-ip>:56000 -vk-link <vk-link> -listen 127.0.0.1:9000 | sudo routes.sh
Common mistakes that break this:
  • Running the client and routes.sh in separate terminals — they are not connected.
  • Redirecting the client output to a file and then reading it separately — the script won’t see new IPs in real time.
  • Running routes.sh without sudoip r add requires root privileges.
If you enabled the WireGuard VPN before the proxy client established its TURN connection, the TURN server’s IP is being routed through the tunnel rather than directly to the gateway.To recover:
1

Disable the WireGuard VPN

Turn off the WireGuard tunnel in your client.
2

Restart the proxy client

Run the proxy client and routing script again. Wait until you see Established DTLS connection! in the output.
3

Enable the VPN

Now that the host route for the TURN server IP is in place, activate the WireGuard tunnel.
This ordering requirement applies to Linux and Windows. On Android, use per-app exclusions to avoid the issue entirely.
The macOS routing script (routes-macos.sh) detected that the current default network interface is a utun device, which means a WireGuard or other VPN tunnel is already active. If the script continued, it would add routes via the tunnel’s gateway rather than the physical gateway, which would not break the loop.Disconnect the WireGuard VPN first, then start the proxy client and routing script, wait for Established DTLS connection!, and then re-enable WireGuard.

Build docs developers (and LLMs) love