What is NAT Traversal?
Techniques that let two devices behind NAT routers or firewalls open a direct connection to each other, with a relay as the fallback.
Definition
NAT traversal is the set of techniques that let two devices sitting behind Network Address Translators (home routers, office firewalls, carrier-grade NAT) connect directly, even though neither has a public address the other can dial. A NAT rewrites private addresses to a shared public one and drops unsolicited inbound packets, so a peer cannot simply be reached at the address it sees for itself. The standard approach, Interactive Connectivity Establishment (ICE, RFC 8445), has each side gather candidate addresses: host candidates from its own interfaces, server-reflexive candidates learned by asking a STUN server what public address and port the NAT assigned, and relayed candidates on a TURN server. The peers exchange candidates through a signalling channel, then send STUN connectivity checks on candidate pairs at the same time so each NAT sees outbound traffic and lets the replies in, a technique usually called hole punching. The first pair that works is used. When no direct path works, for example behind some carrier-grade NATs, traffic falls back to a relay, which adds latency but still connects. Mesh VPNs such as NetBird and Tailscale apply the same idea to WireGuard tunnels.
When to Use NAT Traversal
Hole punching works only when both sides send at nearly the same time, which is why every NAT traversal system needs a rendezvous or signalling service in addition to STUN. Relays are not a failure mode to eliminate but a guarantee of connectivity; plan their location, because every relayed packet takes a detour through them. When troubleshooting slow mesh VPN links, first check whether the connection is direct or relayed.
NAT Traversal in Practice
- NetBird agents use ICE (via the pion/ice library) with STUN to discover candidates, exchange them through NetBird's signal service, and fall back to its relay service when a direct peer-to-peer connection is not possible, for example on mobile carrier-grade NAT.
- Tailscale tries a direct WireGuard connection first, then a peer relay inside your own tailnet, and finally its globally distributed DERP relay servers.
- A self-hosted NetBird server must expose UDP port 3478, the standard STUN port, so agents behind NAT can learn their public address and port.
Common Mistakes
- Assuming a direct connection is always possible; carrier-grade and some strict NATs force relayed traffic, so relay capacity and placement still matter.
- Blocking outbound UDP, or UDP 3478 to the STUN server, on a firewall, which silently pushes every connection onto the relay.
- Confusing port forwarding with NAT traversal: port forwarding is a manual router rule, while NAT traversal works without changing either router.
- Treating a relay as able to read traffic by default; in WireGuard-based meshes the relay forwards end-to-end encrypted packets.