The turn server must be able to access other nodes on the Internet and vice versa unless operating exclusively within your local matrix server.

This looks like a really good explanation of how all the pieces work: What Are STUN, TURN, and ICE? | LiveSwitch Server Documentation https://share.google/PV7BKE7Q56vOE9lHl

Based on what you wrote, it looks like you'll need ICE hosts, but no STUN / TURN.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

5 acronyms in this thread; the most compressed thread commented on today has 7 acronyms.

[Thread #96 for this comm, first seen 15th Feb 2026, 16:10] [FAQ] [Full list] [Contact] [Source code]

Ipv6, get an ipv6. There is not nat in ipv6

If you want a non-federating LAN-only Matrix server, then STUN/TURN can be behind the NAT. Since you have Tailscale, STUN/TURN can also expose itself on the Tailscale VPN too. Just configure proper DNS records per-interface and you should be fine.

Since calls are p2p, the purpose of STUN is to determine a client's (usually public) IP address, and TURN is to relay the connection if they can't connect directly (i.e. behind NAT). If your clients are on the same LAN/VPN with unrestrictive firewalls then you might not even need any STUN/TURN altogether.

I'm not qualified enough to answer that, but..

I tried setting up calls and while STUN/TURN works in WAN, but not LAN, Element are supposed to be making a replacement that makes voice and video calls entirely E2EE, aka Livekit, which I've completely failed to get working. So far I've given up on improving my instance's features and stick to Element Classic. I hope you get it running well!

What do you need STUN for? If anything you might want TURN but that is probably not needed everything is on the same network.