iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
UDP hole punching is a technique that lets two devices behind network address translation (NAT) try to send UDP traffic directly to each other. A rendezvous service helps them exchange the public IP addresses and ports their networks expose; if both NATs permit the resulting traffic, the devices can communicate without routing their application data through that service. It is an attempt, not a guarantee.
How UDP hole punching works
A device on a private network usually has a local address that is not directly reachable from the public internet. Its NAT device translates outbound traffic and may create a temporary mapping between the device’s local address and port and a public-facing address and port.
- Discover an externally visible endpoint. Each peer sends UDP traffic to an external address-discovery or rendezvous service. The service can report the source IP address and port it observes, which may differ from the peer’s private address and port.
- Exchange candidate endpoints. The peers pass those observed public endpoints to each other through signaling or a rendezvous service.
- Send packets toward each other. Each peer sends UDP packets to the other’s candidate endpoint. These outbound packets may cause the NAT devices to create mappings or allow return traffic.
- Use the direct path if it works. If the NAT mappings and filtering behavior allow packets to pass in both directions, the peers can exchange application traffic directly.
- Relay if direct checks fail. An application can route traffic through a relay such as TURN when the peers cannot establish a direct path.
The term “hole” does not mean a router is permanently opened to unsolicited traffic from anywhere. The technique attempts to make specific peer traffic pass by coordinating outbound packets and the NAT behavior associated with them.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhy it does not work through every NAT
Success depends on how the NAT devices create mappings and filter incoming packets. RFC 5128 describes UDP hole punching as relying on endpoint-independent mapping behavior and explains that a NAT may not allow an endpoint discovered through one server to be reused for peer traffic. Network configurations therefore vary, and the technique cannot guarantee a direct connection.
#1 Best Overall
The IETF’s RFC 5128 is an informational overview of peer-to-peer communication across NATs, published in March 2008. It documents the behavioral conditions and limitations; it does not establish a universal success rate.
How STUN, ICE, and TURN fit together
| Term | Role | Connection path |
|---|---|---|
| UDP hole punching | Peers exchange and send packets to candidate endpoints in an effort to create usable NAT mappings. | Direct, if the NAT behavior permits it. |
| STUN | Helps a client discover the transport address observed by a STUN server. | Address discovery; it does not itself guarantee a peer connection. |
| ICE | Gathers and tests candidate paths to establish connectivity. | Searches for a direct path and can use a relay when needed. |
| TURN | Provides a relay address and forwards packets between peers. | Relayed through an intermediary rather than directly between peers. |
These terms describe different parts of a connection process: STUN helps discover an observed address, ICE coordinates candidate checks, hole punching is one technique for attempting direct communication, and TURN relays traffic if a direct path cannot be found. RFC 8656 states that when ICE determines the communication path, it uses hole-punching techniques to search for a direct path first and uses a TURN server only when a direct path cannot be found.
RFC 8656, the IETF’s TURN standard published in April 2020, describes TURN’s role and its relationship to ICE and direct-path attempts. The older RFC 3489, published in March 2003, is an obsolete early STUN specification; it is relevant here only for the basic idea of a server returning an observed address, not as current implementation guidance.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11When the rendezvous server carries data
A rendezvous or signaling service can introduce the peers by helping them exchange candidate endpoints and coordinate the initial connection attempt. If a direct path succeeds, that service does not have to carry the peers’ later application data. If the direct attempt fails and the application uses TURN, a relay does carry the traffic.
Rank #3
- Used Book in Good Condition
That difference affects the network path: direct communication can avoid relaying application data, while TURN makes communication possible in cases where direct connectivity cannot be established by routing packets through an intermediary.
Quick Recap
Best Value
What a robust implementation needs
- Use a connectivity-establishment process that gathers and tests candidate paths rather than assuming a discovered public endpoint will work for peer traffic.
- Keep signaling or rendezvous coordination distinct from the application-data path; the former may be needed even when the latter becomes direct.
- Provide a relay fallback, such as TURN, for networks where NAT mapping or filtering behavior prevents direct connectivity.
- Do not promise a universal hole-punching success rate: the cited standards explain conditions and fallback behavior, not a general percentage.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
