---
title: NAT Traversal
type: vocabulary
url: "https://www.envisioning.com/vocab/nat-traversal"
summary: Techniques for establishing direct network connections between peers behind firewalls or routers.
year: 1999
generality: 0.65
---

# NAT Traversal

Techniques for establishing direct network connections between peers behind firewalls or routers.
NAT traversal is the family of techniques that allow two networked devices, each sitting behind a NAT (network address translation) device or firewall, to establish a direct connection with one another. NAT exists primarily to share a single public IP address among many local devices, which is convenient for outbound traffic from a home or office but historically made direct inbound connections difficult, since the public IP effectively hides a population of private addresses from the outside world. The techniques that fall under NAT traversal — UDP hole-punching, TCP hole-punching, STUN, TURN, ICE, and the more modern approaches using QUIC and connection IDs — collectively make peer-to-peer connectivity possible across the open internet without requiring either party to operate a server. NAT traversal is a foundational capability for most modern peer-to-peer, real-time communication, and remote-access systems, including voice and video calling, multiplayer games, decentralized inference, and the cohort of distributed AI runtimes that emerged in the mid-2020s.

The mechanism combines address discovery with connection establishment. A common form, UDP hole-punching, relies on the observation that once an outgoing UDP packet from behind a NAT has been sent to a particular external endpoint, the NAT will relay future packets from that endpoint back to the internal host for a short window. Two peers that wish to connect therefore send simultaneous outgoing packets to a third rendezvous server, which observes the public port each peer has been assigned and tells them about each other; each peer then sends another packet directly to the other's public endpoint, which the NAT permits because a recent outgoing packet primed the association. STUN servers automate the address-discovery step; TURN servers relay traffic when hole-punching fails; and ICE glues the pieces together by trying multiple candidate address pairs until one succeeds. Modern protocols built on QUIC — including those used by iroh and similar peer-to-peer libraries — sidestep some of the historical complexity by maintaining connection state in identifiers rather than in socket bindings, making it easier to migrate connections across address changes.

The tradeoff against server-mediated communication is functional reach at the cost of implementation complexity. A system with a relay server in the middle works under any network condition, with predictable latency equal to the path through that server and no ambiguity about who can reach whom. A peer-to-peer system using NAT traversal saves the relay round-trip and avoids trusting or paying a third party, but it must handle symmetric NATs that defeat simple hole-punching, mobile networks that change addresses mid-connection, and corporate firewalls that drop unsolicited traffic entirely. As of the mid-2020s, the success rate of fully peer-to-peer NAT traversal on the open internet sits around 85–90 percent depending on the protocol and the population of peers, with the remaining cases falling back to relays that the system runs only for the cases that strictly need them.

The status of NAT traversal as a technique is essentially settled for the cases it handles well, but the long tail of network configurations — symmetric NATs, carrier-grade NATs, IPv6-only networks behind IPv4 fallbacks, censorship firewalls that actively interfere with connection establishment — continues to drive incremental improvement. For distributed AI systems specifically, NAT traversal is what allows a phone, a laptop in a coffee shop, and a desktop in a data center to act as one compute mesh without requiring anyone to configure port forwarding or accept the cost of round-tripping every request through a cloud region. Whether the reliability of direct connections can ever approach the reliability of data-center networking, and what role relays play as a fallback or for cost reasons, remains an active question in the design of every system that depends on it.

---
Source: Envisioning — Technology Research Institute (https://www.envisioning.com/vocab/nat-traversal)