NAT traversal is how two machines reach each other directly when one or both sit behind address translation. STUN reports the public address a NAT assigned you, TURN relays the traffic when nothing direct works, and ICE tries every option and keeps the one that succeeded.
- A NAT mapping is created by outbound traffic only
- STUN is cheap, TURN costs bandwidth, ICE chooses between them
- Symmetric NAT defeats hole punching, so a relay is required
- One way audio is this failing in one direction
- IPsec has its own version: NAT-T, on UDP 4500
On this page
The problemWhy NAT breaks direct connections
A NAT device holds a table. When an internal client sends a packet out, the device rewrites the source address to its own public address, picks a source port, and records the mapping. When a reply arrives at that public address and port, the device looks it up and sends the data inward.
That design has one property everything else follows from: the mapping is created by outbound traffic, and only by outbound traffic. A packet arriving at the NAT for which no mapping exists has nowhere to go, so it is discarded.
For a web browser this is invisible. The client starts the connection, the mapping exists before any reply arrives, and the reply comes back. For two devices that both want to be called, it is a wall. Neither can start a connection to the other, because neither has a public address the other can send data to.
Three shapes of problem follow.
Voice and video. Two endpoints negotiate a media stream through a server and then try to send audio directly to each other. If the addresses they exchanged are private ones, the audio goes nowhere.
Peer to peer applications. File sharing, gaming, remote support tools and anything built on WebRTC face the same connectivity wall.
Tunnels between sites. An IPsec tunnel from a router behind NAT has its own version of the problem, addressed separately below.
STUNSTUN, which asks what the world sees
STUN, Session Traversal Utilities for NAT, does one small thing and does it well.
A client sends a packet to a STUN server on the internet. The server looks at the source address of the packet it received, which is the public address of the NAT device and the port it chose, and sends that back in the reply. The client now knows the address other devices would have to use to reach it.
host sends from 192.168.1.40:50000
STUN server sees 203.0.113.7:61234
STUN server says "you are 203.0.113.7:61234"That address is a candidate: somewhere the client might be reachable. Both endpoints collect candidates, exchange them in the session description through whatever signaling channel already connects them, and then try to send data to each other.
The trick that makes it work is hole punching. Both sides start sending outbound simultaneously. Each side's outbound packet creates a mapping in its own NAT. The other side's packet, arriving a moment later, matches that freshly created mapping and gets through. Neither side ever accepted an unsolicited inbound packet, and yet a two way path now exists.
STUN is cheap. The server handles a few packets per session and never touches the media data, so one small server supports enormous numbers of connections.
Symmetric NATThe NAT that defeats it
Hole punching depends on an assumption: that the NAT device assigns one mapping per internal socket, and uses it for every destination.
| NAT behavior | The mapping is | Hole punching | Where you meet it |
|---|---|---|---|
| Endpoint independent | The same for every destination | Works | Most home and small office routers |
| Address dependent | Per destination address | Usually works | Some enterprise firewalls |
| Symmetric | Per destination address and port | Fails, needs TURN | Enterprise firewalls, mobile, CGNAT |
That holds for most home and small business routers. It does not hold for a symmetric NAT, which creates a different mapping for every destination. The address STUN reported was the mapping for talking to the STUN server, and it is not the mapping that will be used for talking to the other host. The candidate is correct and useless.
Symmetric behavior is common on enterprise firewall devices, on carrier grade NAT, and on mobile networks. When both endpoints are behind one, no amount of candidate gathering produces direct connectivity.
That is what TURN is for.
TURNTURN, which gives up and relays
TURN, Traversal Using Relays around NAT, is the fallback that always works.
Both clients connect outward to a TURN server, which every NAT device permits because it is an ordinary outbound connection. The server allocates each of them an address and port on itself and forwards data between them. Neither client ever receives an unsolicited packet, and yet they can talk.
The cost is real and it is why TURN is a fallback rather than a design.
Every byte of data crosses the relay twice. The bandwidth bill belongs to whoever runs the server, and for video it is substantial.
Latency goes up. The path is now two legs through a third location rather than one direct hop.
It is a single point of failure for every session using it.
The usual planning number is that a minority of sessions need a relay and the rest connect directly, but the minority is not small enough to ignore, and it grows on mobile networks.
ICEICE, which tries everything in order
ICE is not another way through a NAT device. It is the connectivity procedure that uses the other two properly.
Gather candidates. Each client collects every address and port it might be reachable at: its own internal addresses, the public address STUN reported, and an address allocated on a TURN server.
Exchange them. The ICE candidate lists travel in the SDP over whatever channel already connects the two parties, which is the signaling server for a phone system or a WebRTC application.
Check every pair. Each endpoint sends connectivity checks to each of the other endpoint candidates. Some fail immediately, some succeed. This is also where the hole punching happens.
Pick the best pair that worked. Internal addresses first if the two devices happen to be on the same network, then a direct path through the NAT devices, and the relay only if nothing else succeeded.
That ordering is the whole point of ICE. It does not decide in advance which technique the network needs, which is good, because nobody can tell in advance.
| Candidate type | Where the address comes from | Cost | Used when |
|---|---|---|---|
| Host | The interface on the device itself | None | Both ends on the same network |
| Server reflexive | STUN | Almost none | The usual case, through NATs |
| Relayed | TURN | Bandwidth and latency | Nothing else worked |
NAT-TThe IPsec version, which is a different fix
A site to site tunnel behind NAT hits a related problem for a different reason, and the fix has its own name.
IPsec in its original form uses IP protocol 50, which has no port numbers. A NAT device rewrites addresses and ports, so a protocol with no ports gives it nothing to work with, and many NATs simply cannot forward it. On top of that, one of IPsec's own integrity checks covers the addresses that the NAT just rewrote.
NAT Traversal, NAT-T, solves it by wrapping the whole thing in UDP on port 4500. The NAT now sees an ordinary UDP flow with ports it can translate, and the inner packet arrives unmodified.
Two practical consequences.
UDP port 4500 has to be permitted wherever an IPsec tunnel crosses a NAT device, and it is a common firewall omission.
Keepalives are needed. A NAT mapping expires after a period of silence, so the tunnel sends small packets periodically to keep its mapping alive. A tunnel that drops after a few minutes of no traffic is usually this.
PitfallsWhere people go wrong
Diagnosing one way audio as a codec problem. Audio flowing in one direction only is the signature of NAT traversal failing in one direction. It is not a codec, and it is not the handset.
Forgetting that signaling and media are separate. The call sets up fine because the signaling goes through a server. The audio fails because the media data was supposed to go directly. Two different paths, and only one of them has connectivity.
Deploying STUN with no TURN. It works for most users and fails completely for the ones behind symmetric NAT or carrier grade NAT, who are then told the problem is on their end.
Opening a wide port range inbound on the firewall instead. It is the old fix, it is a large hole, and it is unnecessary once ICE is working.
Enabling UPnP as the solution. It lets any application on any device open an inbound port on the router without asking anybody. Convenient, and a standing firewall hole.
Missing UDP 4500 for IPsec. A tunnel that will not come up from behind a NAT device, or that comes up and then dies quietly, is usually NAT-T being blocked or keepalives being absent.
Assuming double NAT is rare. A router behind a carrier's NAT is now common on residential and mobile connections, and it makes a direct path considerably less likely.
ComparisonThree protocols, and the one that costs money to run
| Criterion | STUN | TURN | ICE |
|---|---|---|---|
| What it does | Reports your public address | Relays the traffic | Chooses between them |
| Carries your media | No | Yes | No |
| Server bandwidth cost | Almost none | High | None of its own |
| Works behind symmetric NAT | No | Yes | Yes, by using TURN |
| Adds latency | No | Yes | No |
| Needed on its own | Rarely | Rarely | It is the framework |
The second row is the whole economics. STUN servers are cheap enough to run for free at scale, and TURN servers are not, which is why relay capacity is the part of any peer to peer service that costs money.
FAQFrequently asked questions
What is NAT traversal?
The set of techniques two devices use to establish direct connectivity when one or both are behind network address translation, which otherwise provides no way to start an inbound connection.
What is STUN?
A protocol that tells a client what public address and port a NAT device has assigned it, by having a server report the source address of the packet it received.
What is TURN?
A relay. Both clients connect outward to it and it forwards data between them. It always works and it costs bandwidth and latency, so it is the fallback.
What is ICE?
The framework that gathers every candidate address, tests them all, and selects the best pair that actually worked. It uses STUN and TURN rather than replacing them.
What is hole punching?
Both sides sending outbound at the same time, so each NAT creates a mapping, and each side's packet arrives to find a mapping already waiting for it.
Why does STUN fail on some networks?
Because a symmetric NAT creates a different mapping for each destination, so the address STUN reported is not the address that will be used for the other host.
What ports do STUN and TURN use?
Port 3478 for both, over UDP and TCP, and port 5349 for the TLS versions. TURN also allocates a range of relay ports.
Do I need a TURN server?
If you run a service that must work for everybody, yes. A meaningful minority of users are behind NAT that no direct technique gets through, and they are the ones who report that it never works.
What causes one way audio?
NAT traversal succeeding in one direction and failing in the other, so media flows to one endpoint and not back. It is the most recognizable symptom there is.
What is NAT-T?
NAT Traversal for IPsec: wrapping the tunnel in UDP on port 4500, so a NAT device has ports to translate and the inner packet survives unchanged.
Why does my VPN tunnel drop when idle?
Because the NAT mapping expired. NAT-T keepalives exist for exactly this, and a tunnel dying after a few quiet minutes usually means they are not being sent.
Does IPv6 remove the need for this?
Largely, yes. With globally reachable addresses on both ends there is no translation to traverse, though a firewall still has to permit the traffic.
Is UPnP a reasonable answer?
It works and it lets any application on the network open inbound ports without approval. On a business network that is a firewall policy decision rather than a convenience setting.
What is the NAT full form in networking, and what is NAT vs PAT?
NAT stands for Network Address Translation. Plain NAT maps one private address to one public address. PAT, port address translation, maps many private addresses to a single public one by tracking port numbers, and it is what every home and office router actually does. People say NAT for both.
What is NAT type on a game console or app?
NAT type is a label for how easily other devices can start a connection to yours. Open means inbound connections work, moderate means some do, and strict means only outbound ones do. Two routers in series, or a provider using carrier grade NAT, are the usual causes of a strict result.
Keep readingRelated concepts
Read next · Remote access What Is an IPsec VPN? A tunnel from a router behind NAT hits a related problem, and NAT-T on UDP 4500 is the fix with its own name. Open this next11 min- Network security · 14 min What Is a Firewall? Every technique here works by making the traffic look outbound, because outbound is what the rules permit.
- Protocols · 10 min TCP vs UDP STUN, TURN and the media itself are usually UDP, which is what makes hole punching possible at all.
- Fundamentals · 10 min Modem and Router, and What the Box From Your Internet Provider Does Why inbound traffic is the half that breaks.
- Addressing · 11 min IP Masquerading, and the One Case Where SNAT Is Better How anything gets in, given all of this.