Two computers want to talk directly. Both are hiding behind routers. STUN is the elegant trick that makes the connection possible.
scroll
The Problem
Why can't two peers just connect?
You already know the key layers: IP for addressing, UDP for send-and-forget datagrams. But here's the wrinkle — your laptop's IP address isn't really on the internet. It's on a private network behind your router.
Your router runs NAT — Network Address Translation. When you send a UDP packet out, the NAT replaces your private source IP (192.168.1.5) with the router's own public IP (82.34.12.5). From the internet's perspective, the packet came from the router — not your laptop.
NAT is great for security and for sharing one public IP across many devices. But it creates a fundamental problem for peer-to-peer: incoming connections have nowhere to go.
The core problem: Alice wants to reach Bob, but she only knows his router's public IP (44.67.8.23). She doesn't know which port to use — Bob never opened one. Bob's NAT has no forwarding rule for incoming packets, so it silently drops them. And Alice doesn't even know her own public address to share with Bob.
NAT was designed to protect you from unsolicited incoming connections. Great for security. A fundamental obstacle for P2P.
The Solution
STUN: a mirror on the internet
STUN stands for Session Traversal Utilities for NAT. The idea behind it is strikingly simple:
Place a server with a stable public IP somewhere on the internet. Give it exactly one job: look at every incoming packet and tell the sender what their packet looks like from the outside.
When Alice sends a UDP packet to the STUN server, her NAT rewrites the source address before it leaves her network. The STUN server receives the packet from Alice's public address — the one the NAT assigned — and sends that address back to her.
That's it. STUN is not a tunnel, not a proxy, not a complex routing protocol. It's just a reflection — Alice asks "what do you see?" and the STUN server answers with her public IP and port.
But here's the hidden bonus: by sending that outgoing UDP packet, Alice's NAT created an internal mapping — "any packet arriving on port 49152 → forward to Alice's laptop." This is the "hole" that peer-to-peer relies on. Once Bob knows to send to port 49152, Alice's NAT will let it through.
Interactive Demo
See it happen, step by step
Walk through the complete STUN exchange. Each step reveals which packets are flying and what information each peer learns.
Step 0 of 7
Ready to start
Click "Next step" to walk through the full STUN exchange — from two isolated peers to a live direct connection.
Real-World Uses
Where does STUN show up?
STUN runs quietly in the background of many applications you use every day.
📹
WebRTC
Google Meet, Discord video, Jitsi. Your browser runs STUN automatically to discover its public address and negotiate a direct media stream with the other participant, bypassing central servers for the actual audio/video.
📞
VoIP & SIP
WhatsApp calls, Telegram, enterprise SIP phones, Zoom. STUN is embedded in the ICE framework that every modern voice protocol uses to route RTP voice packets between callers efficiently.
🎮
Online Games
Racing, fighting, and strategy games that reduce lag by connecting players peer-to-peer rather than routing all data through a central game server. STUN lets players punch holes in each other's NATs.
The Full Picture
STUN, TURN & ICE — the trio
STUN works brilliantly for most home routers — but not all NATs are equal. Corporate firewalls often use symmetric NAT, which creates a fresh mapping for each destination. That means the port STUN reflects back is useless for connecting to Bob (who is a different destination). STUN fails, and a fallback is needed.
🔍
STUN
Session Traversal Utilities for NAT
The scout. Discovers your public-facing address and enables direct P2P by hole punching through permissive NATs. Cheap and fast — just a UDP round-trip.
The relay. When direct connection is impossible, all traffic routes through a TURN server. Higher cost and latency, but guaranteed to work in any environment.
✓ Symmetric NAT, strict corporate firewalls ✓ Last resort — always works
🧊
ICE
Interactive Connectivity Establishment
The coordinator. Gathers all possible paths — direct, STUN-assisted, TURN relay — ranks them, and picks the best one that actually works between the two peers.
✓ Used by WebRTC, wraps STUN + TURN ✓ Always finds the optimal path
How ICE decides: Try a direct connection first (same LAN) → try STUN hole punching → fall back to TURN relay. This cascade is why video calls still work on strict corporate networks — TURN is the always-works fallback, at the cost of routing media through a server.