diff --git a/engine/client/net_master.c b/engine/client/net_master.c
index 5f7d55782..51863994c 100644
--- a/engine/client/net_master.c
+++ b/engine/client/net_master.c
@@ -2889,18 +2889,18 @@ void MasterInfo_Refresh(qboolean doreset)
 		Master_AddMaster("255.255.255.255:"STRINGIFY(PORT_Q3SERVER),				MT_BCAST,			MP_QUAKE3, "Nearby Quake3 UDP servers.");
 #endif
 
-		if (!fs_manifest->rtcbroker || !*fs_manifest->rtcbroker)
+		if (!*net_ice_broker.string)
 			;	//nope, sorry, not configured.
 		else
 		{
 			char *url;
 			COM_Parse(com_protocolname.string);
-			if (!strncmp(fs_manifest->rtcbroker, "tls://", 6))
-				url = va("https://%s/raw/%s", fs_manifest->rtcbroker+6, com_token);
-			else if (!strncmp(fs_manifest->rtcbroker, "tcp://", 6))
-				url = va("http://%s/raw/%s", fs_manifest->rtcbroker+6, com_token);
+			if (!strncmp(net_ice_broker.string, "tls://", 6))
+				url = va("https://%s/raw/%s", net_ice_broker.string+6, com_token);
+			else if (!strncmp(net_ice_broker.string, "tcp://", 6))
+				url = va("http://%s/raw/%s", net_ice_broker.string+6, com_token);
 			else
-				url = va("http://%s/raw/%s", fs_manifest->rtcbroker, com_token);
+				url = va("http://%s/raw/%s", net_ice_broker.string, com_token);
 			Master_AddMasterHTTP(url,				MT_MASTERHTTP,		MP_DPMASTER, "Public Servers Potentially Behind A NAT.");
 		}
 
@@ -3786,12 +3786,12 @@ static void NetQ3_GlobalServers_Request(size_t masternum, int protocol, const ch
 		const char *url;
 		struct dl_download *dl;
 		COM_Parse(com_protocolname.string);
-		if (!strncmp(fs_manifest->rtcbroker, "tls://", 6))
-			url = va("https://%s/raw/%s", fs_manifest->rtcbroker+6, com_token);
-		else if (!strncmp(fs_manifest->rtcbroker, "tcp://", 6))
-			url = va("http://%s/raw/%s", fs_manifest->rtcbroker+6, com_token);
+		if (!strncmp(net_ice_broker.string, "tls://", 6))
+			url = va("https://%s/raw/%s", net_ice_broker.string+6, com_token);
+		else if (!strncmp(net_ice_broker.string, "tcp://", 6))
+			url = va("http://%s/raw/%s", net_ice_broker.string+6, com_token);
 		else
-			url = va("http://%s/raw/%s", fs_manifest->rtcbroker, com_token);
+			url = va("http://%s/raw/%s", net_ice_broker.string, com_token);
 
 		dl = HTTP_CL_Get(url, NULL, MasterInfo_ProcessHTTP);
 		if (dl)
diff --git a/engine/common/common.h b/engine/common/common.h
index fb87e55f4..391be6938 100644
--- a/engine/common/common.h
+++ b/engine/common/common.h
@@ -767,7 +767,6 @@ typedef struct
 	char *defaultexec;	//execed after cvars are reset, to give game-specific engine-defaults.
 	char *defaultoverrides;	//execed after default.cfg, to give usable defaults even when the mod the user is running is shit.
 	char *eula;			//when running as an installer, the user will be presented with this as a prompt
-	char *rtcbroker;	//the broker to use for webrtc connections.
 	char *basedir;		//this is where we expect to find the data.
 	char *iconname;		//path we can find the icon (relative to the fmf's location)
 
diff --git a/engine/common/fs.c b/engine/common/fs.c
index 7ac1405c8..efad653f0 100644
--- a/engine/common/fs.c
+++ b/engine/common/fs.c
@@ -308,7 +308,6 @@ void FS_Manifest_Free(ftemanifest_t *man)
 	Z_Free(man->eula);
 	Z_Free(man->defaultexec);
 	Z_Free(man->defaultoverrides);
-	Z_Free(man->rtcbroker);
 	Z_Free(man->basedir);
 	Z_Free(man->iconname);
 	for (i = 0; i < sizeof(man->gamepath) / sizeof(man->gamepath[0]); i++)
@@ -356,8 +355,6 @@ static ftemanifest_t *FS_Manifest_Clone(ftemanifest_t *oldm)
 		newm->defaultexec = Z_StrDup(oldm->defaultexec);
 	if (oldm->defaultoverrides)
 		newm->defaultoverrides = Z_StrDup(oldm->defaultoverrides);
-	if (oldm->rtcbroker)
-		newm->rtcbroker = Z_StrDup(oldm->rtcbroker);
 	if (oldm->iconname)
 		newm->iconname = Z_StrDup(oldm->iconname);
 	if (oldm->basedir)
@@ -460,8 +457,6 @@ static void FS_Manifest_Print(ftemanifest_t *man)
 		}
 		//Con_Printf("%s", man->defaultoverrides);
 	}
-	if (man->rtcbroker)
-		Con_Printf("rtcbroker %s\n", COM_QuotedString(man->rtcbroker, buffer, sizeof(buffer), false));
 	if (man->iconname)
 		Con_Printf("icon %s\n", COM_QuotedString(man->iconname, buffer, sizeof(buffer), false));
 	if (man->basedir)
@@ -554,8 +549,6 @@ static ftemanifest_t *FS_Manifest_Create(const char *syspath, const char *basedi
 #else
 	man->mainconfig = Z_StrDup("fte.cfg");
 #endif
-
-	man->rtcbroker = Z_StrDup("tls://master.frag-net.com:27950");	//This is eukara's server. fixme: this really ought to be a cvar instead.
 	return man;
 }
 
@@ -812,11 +805,12 @@ static qboolean FS_Manifest_ParseTokens(ftemanifest_t *man)
 	{
 		Z_StrCat(&man->defaultoverrides, va("%s %s\n", Cmd_Argv(0), Cmd_Args()));
 	}
+#ifdef HAVE_LEGACY
 	else if (!Q_strcasecmp(cmd, "rtcbroker"))
 	{
-		Z_Free(man->rtcbroker);
-		man->rtcbroker = Z_StrDup(Cmd_Argv(1));
+		Z_StrCat(&man->defaultexec, va("set %s %s\n", net_ice_broker.name, Cmd_Args()));
 	}
+#endif
 	else if (!Q_strcasecmp(cmd, "updateurl"))
 	{
 		Z_Free(man->updateurl);
diff --git a/engine/common/net_ice.c b/engine/common/net_ice.c
index 53c4f2f36..906cd3137 100644
--- a/engine/common/net_ice.c
+++ b/engine/common/net_ice.c
@@ -5469,12 +5469,12 @@ ftenet_generic_connection_t *FTENET_ICE_EstablishConnection(ftenet_connections_t
 		address+=6;
 	else if (!strncmp(address, "ices://", 7)||!strncmp(address, "rtcs://", 7))
 		address+=7;
-	if (address == path && *path=='/' && fs_manifest->rtcbroker)
+	if (address == path && *path=='/')
 	{
-		if (!strncmp(fs_manifest->rtcbroker, "tls://", 6) || !strncmp(fs_manifest->rtcbroker, "tcp://", 6))
-			Q_strncpyz(newcon->brokername, fs_manifest->rtcbroker+6, sizeof(newcon->brokername));	//name is for prints only.
+		if (!strncmp(net_ice_broker.string, "tls://", 6) || !strncmp(net_ice_broker.string, "tcp://", 6))
+			Q_strncpyz(newcon->brokername, net_ice_broker.string+6, sizeof(newcon->brokername));	//name is for prints only.
 		else
-			Q_strncpyz(newcon->brokername, fs_manifest->rtcbroker, sizeof(newcon->brokername));	//name is for prints only.
+			Q_strncpyz(newcon->brokername, net_ice_broker.string, sizeof(newcon->brokername));	//name is for prints only.
 		Q_strncpyz(newcon->gamename, path+1, sizeof(newcon->gamename));	//so we know what to tell the broker.
 	}
 	else
diff --git a/engine/common/net_wins.c b/engine/common/net_wins.c
index 173cdfab0..cf92ba247 100644
--- a/engine/common/net_wins.c
+++ b/engine/common/net_wins.c
@@ -118,6 +118,7 @@ int UDP6_OpenSocket (int port);
 #ifdef HAVE_IPX
 void IPX_CloseSocket (int socket);
 #endif
+cvar_t	net_ice_broker			= CVARFD("net_ice_broker", "tls://master.frag-net.com:27950", CVAR_NOTFROMSERVER, "This is the default broker we attempt to connect through when using 'sv_public /foo' or 'connect /foo'.");
 cvar_t	timeout					= CVARD("timeout","65", "Connections will time out if no packets are received for this duration of time.");		// seconds without any message
 cvar_t	net_hybriddualstack		= CVARD("net_hybriddualstack",		"1", "Uses hybrid ipv4+ipv6 sockets where possible. Not supported on xp or below.");
 cvar_t	net_fakeloss			= CVARFD("net_fakeloss",			"0", CVAR_CHEAT, "Simulates packetloss in both receiving and sending, on a scale from 0 to 1.");
@@ -1654,8 +1655,7 @@ size_t	NET_StringToAdr2 (const char *s, int defaultport, netadr_t *a, size_t num
 	//`connect /GAMENAME` is equivelent to `connect rtc://broker/GAMENAME`
 	if (*s == '/')
 	{
-		char *broker = fs_manifest->rtcbroker;
-		if (!broker || !*broker)
+		if (!*net_ice_broker.string)
 		{	//FIXME: use referrer? or the website's host?
 			Con_DPrintf("No default rtc broker\n");
 			return 0;	//can't accept it
@@ -1809,9 +1809,11 @@ size_t	NET_StringToAdr2 (const char *s, int defaultport, netadr_t *a, size_t num
 
 	path = strchr(s, '/');
 #if !defined(HAVE_WEBSOCKCL) && defined(SUPPORT_ICE)
-	if (path == s && fs_manifest->rtcbroker && *fs_manifest->rtcbroker)
+	if (path == s)
 	{
-		s = fs_manifest->rtcbroker;
+		if (!*net_ice_broker.string)
+			return result;
+		s = net_ice_broker.string;
 		if (!strncmp(s, "tls://", 6) || !strncmp(s, "wss://", 6))
 			s+=6, prot=NP_RTC_TLS;
 		else if (!strncmp(s, "tcp://", 6))
@@ -2473,6 +2475,7 @@ void *TLS_GetKnownCertificate(const char *certname, size_t *size)
 	//the xor helps break that shitty recursive loop of mistrust from defects in other people's code.
 	//at least until there's a sandbox that checks the dns resolutions for our update requests anyway.
 	//I should probably just copy the downloadables file to sourceforge.
+	//FIXME: we should be signing the content, not the sender. this SHOULD become redundant.
 	static struct
 	{
 		qbyte *data;
@@ -7265,7 +7268,7 @@ static int FTENET_WebRTC_Create(qboolean initiator, ftenet_websocket_connection_
 		}
 		if (*brokeraddress == '/')
 		{
-			brokeraddress = fs_manifest->rtcbroker;
+			brokeraddress = net_ice_broker.string;
 			for (i = countof(pre); i --> 0; )
 			{
 				if (!strncmp(brokeraddress, pre[i], strlen(pre[i])))
@@ -7555,7 +7558,7 @@ static int FTENET_WebRTC_Establish(const char *address, const char *type)
 	{
 		path = address+1;
 
-		address = fs_manifest->rtcbroker;
+		address = net_ice_broker.string;
 		for (i = countof(pre); i --> 0; )
 		{
 			if (!strncmp(address, pre[i], strlen(pre[i])))
@@ -7650,7 +7653,7 @@ static ftenet_generic_connection_t *FTENET_WebRTC_EstablishConnection(ftenet_con
 	if (adr.type == NA_INVALID)
 	{	//if its using our broker, flip it over to a real address type, if we can.
 		adr.type = NA_WEBSOCKET;
-		Q_strncpyz(adr.address.websocketurl, fs_manifest->rtcbroker, sizeof(adr.address.websocketurl));
+		Q_strncpyz(adr.address.websocketurl, net_ice_broker.string, sizeof(adr.address.websocketurl));
 	}
 
 	brokersocket = FTENET_WebRTC_Establish(address, isserver?"rtc_host":"rtc_client");
@@ -9059,6 +9062,7 @@ void NET_Init (void)
 #endif
 	}
 
+	Cvar_Register(&net_ice_broker, "networking");
 	Cvar_Register(&timeout, "networking");
 	Cvar_Register(&net_hybriddualstack, "networking");
 	Cvar_Register(&net_fakeloss, "networking");
diff --git a/engine/common/netinc.h b/engine/common/netinc.h
index d4e9e4d85..4b1531239 100644
--- a/engine/common/netinc.h
+++ b/engine/common/netinc.h
@@ -296,6 +296,7 @@ typedef struct
 	qboolean (QDECL *GetLCandidateSDP)(struct icestate_s *con, char *out, size_t valuesize);		//retrieves candidates that need reporting to the peer.
 } icefuncs_t;
 extern icefuncs_t iceapi;
+extern cvar_t net_ice_broker;
 #endif
 
 #ifdef HAVE_EPOLL
diff --git a/engine/http/iwebiface.c b/engine/http/iwebiface.c
index 8b0051fcd..681001be7 100644
--- a/engine/http/iwebiface.c
+++ b/engine/http/iwebiface.c
@@ -265,10 +265,7 @@ void PrepareStun(int epfd, int reportport)
 #if 0
 	char *stunserver = "localhost";
 	int stunport = 27500;
-#elif 1
-	char *stunserver = "stun.l.google.com";
-	int stunport = 19302;
-#else
+#else	//sorry about hardcoding a server, but probably few people are gonna care enough.
 	char *stunserver = "master.frag-net.com";
 	int stunport = 27950;
 #endif
diff --git a/plugins/irc/ircclient.c b/plugins/irc/ircclient.c
index a8a43ed83..4cfb52749 100644
--- a/plugins/irc/ircclient.c
+++ b/plugins/irc/ircclient.c
@@ -1308,6 +1308,7 @@ static struct ircice_s *IRC_ICE_Create(ircclient_t *irc, const char *sender, enu
 {
 	struct icestate_s *ice;
 	struct ircice_s *ircice;
+	char *s, token[MAX_OSPATH];
 	if (!piceapi)
 		return NULL;
 
@@ -1335,16 +1336,22 @@ static struct ircice_s *IRC_ICE_Create(ircclient_t *irc, const char *sender, enu
 
 	//query dns to see if there's a stunserver hosted by the same domain
 	//nslookup -querytype=SRV _stun._udp.example.com
-//		Q_snprintf(stunhost, sizeof(stunhost), "_stun._udp.%s", ice->server);
-//		if (NET_DNSLookup_SRV(stunhost, stunhost, sizeof(stunhost)))
-//			piceapi->Set(ice, "stunip", stunhost);
-//		else
+//	Q_snprintf(stunhost, sizeof(stunhost), "_stun._udp.%s", ice->server);
+//	if (NET_DNSLookup_SRV(stunhost, stunhost, sizeof(stunhost)))
+//		piceapi->Set(ice, "server", va("stun:%s" + stunhost));
+//	else
 	{
-		//irc services tend to not provide any stun info, so steal someone's... hopefully they won't mind too much. :(
-		piceapi->Set(ice, "stunport", "19302");
-		piceapi->Set(ice, "stunip", "stun.l.google.com");
+		char *stun = cvarfuncs->GetNVFDG("net_ice_broker", "", 0, NULL, NULL)->string;
+		s = strstr(stun, "://");
+		if (s) stun = s+3;
+		piceapi->Set(ice, "server", va("stun:%s", stun));
 	}
 
+	//sadly we need to add the other ice servers ourselves despite there being a cvar to list them.
+	s = cvarfuncs->GetNVFDG("net_ice_servers", "", 0, NULL, NULL)->string;
+	while((s=cmdfuncs->ParseToken(s, token, sizeof(token), NULL)))
+		piceapi->Set(ice, "server", token);
+
 	ircice = malloc(sizeof(*ircice));
 	memset(ircice, 0, sizeof(*ircice));
 	ircice->next = irc->ice;
diff --git a/plugins/jabber/jingle.c b/plugins/jabber/jingle.c
index 836cefc26..04f049cc3 100644
--- a/plugins/jabber/jingle.c
+++ b/plugins/jabber/jingle.c
@@ -6,6 +6,8 @@ static struct c2c_s *JCL_JingleAddContentToSession(jclient_t *jcl, struct c2c_s
 	char generatedname[64];
 	char stunhost[256];
 	int c;
+	char *s;
+	char token[MAX_OSPATH];
 
 	if (!bres)
 		return NULL;
@@ -82,10 +84,18 @@ static struct c2c_s *JCL_JingleAddContentToSession(jclient_t *jcl, struct c2c_s
 		//google also don't provide stun srv records.
 		//so we're basically screwed if we want to work with the googletalk xmpp service long term.
 		//more methods are best, I suppose, but I'm lazy.
-		//yes, hardcoding means that other services might 'borrow' googles' stun servers.
-		piceapi->Set(ice, "stunport", "19302");
-		piceapi->Set(ice, "stunip", "stun.l.google.com");
+
+		//try to use our default rtcbroker setting as a stun server, too.
+		char *stun = cvarfuncs->GetNVFDG("net_ice_broker", "", 0, NULL, NULL)->string;
+		s = strstr(stun, "://");
+		if (s) stun = s+3;
+		piceapi->Set(ice, "server", va("stun:%s", stun));
 	}
+
+	//if the user has manually set up some other stun servers, use them.
+	s = cvarfuncs->GetNVFDG("net_ice_servers", "", 0, NULL, NULL)->string;
+	while((s=cmdfuncs->ParseToken(s, token, sizeof(token), NULL)))
+		piceapi->Set(ice, "server", token);
 	return c2c;
 }
 static qboolean JCL_JingleAcceptAck(jclient_t *jcl, xmltree_t *tree, struct iq_s *iq)