What is NAT traversal?
Most devices don't have their own public internet address; they sit behind Network Address Translation (NAT) on a router, which shares one public address among many internal devices. That's fine for reaching out to servers, but it means two such devices can't simply dial each other directly. NAT traversal is the collection of techniques that let them establish a direct connection anyway.
NAT traversal is the set of techniques that let two devices behind routers (NAT) form a direct connection, even though neither has a public address the other can dial.
How NAT traversal works
- 01
A coordination (signaling) service helps the two peers learn each other's externally visible address and port, which is how the outside world sees them through their NATs.
- 02
STUN is a common way for a peer to discover its own public-facing address and port as seen from outside its NAT.
- 03
With that information, the peers attempt 'hole punching': both send packets toward each other at the same time so each NAT opens a path for the other's traffic.
- 04
When a direct path can't be opened (some strict NATs block it), a relay, often called TURN, can forward the traffic as a fallback at the cost of an extra hop.
UDP hole punching, step by step
In a typical flow, each peer contacts a signaling server and, via STUN, learns the public address and port its NAT is presenting. The server shares each peer's external candidate with the other. Both peers then send packets to each other's external address roughly simultaneously. The first outbound packet from each side causes its NAT to create a temporary mapping expecting a reply; when the other side's packet arrives, it matches that mapping and gets through. Once a few packets cross in each direction, a direct, two-way path is open and the encrypted tunnel runs over it.
When a relay is needed
Hole punching works for most NAT types, but some (so-called symmetric NATs, or strict corporate firewalls) assign unpredictable ports or block the attempt, so a direct path can't form. The fallback is a relay: a server both peers can reach, which forwards their traffic. In a well-designed system the relay only forwards packets that are already encrypted and that it cannot read. It adds latency and a hop, but it doesn't see the data. A good mesh uses a relay only as a last resort, when a direct tunnel is impossible.
How this relates to Vexaro Mesh (in development)
Vexaro Mesh, now in development, is designed with NAT traversal built in: peers behind NAT connect directly wherever the network allows, and through a relay only when it doesn't. Gateways are designed to bring up encrypted tunnels over any link without port forwarding or public addresses, which keeps site-to-site paths short.
See the planned features