What is NAT Traversal?
Learn what NAT traversal is, how STUN, hole punching, TURN, and ICE let peers connect directly despite NAT restrictions.
Expected Interview Answer
NAT traversal refers to the set of techniques that let two devices establish a direct peer-to-peer connection even though one or both sit behind a NAT (Network Address Translation) device that hides their real address, since an unsolicited inbound packet to a private address normally has no route back in.
NAT lets many devices on a private network share one public IP by rewriting source addresses and ports on outbound packets and mapping replies back to the correct internal device; the problem is that NAT only creates that mapping in response to outbound traffic, so an external peer generally cannot initiate a connection inward. Techniques like STUN (Session Traversal Utilities for NAT) let a device discover its own public-facing IP and port as seen from outside, so it can share that information with a peer for direct connection attempts. Hole punching has both sides simultaneously send packets toward each other so their respective NATs each create an outbound mapping that then allows the other side's traffic through, commonly used for peer-to-peer VoIP and gaming. When hole punching fails against strict/symmetric NATs, TURN (Traversal Using Relays around NAT) falls back to relaying all traffic through a public server, at the cost of extra latency and bandwidth. ICE (Interactive Connectivity Establishment), used by WebRTC, orchestrates all of this by trying the most direct viable path first, then falling back through STUN-assisted hole punching and finally TURN relay if nothing else works.
- Enables direct peer-to-peer connections despite NAT
- STUN reveals a device’s externally visible address/port
- Hole punching avoids costly relay servers when possible
- TURN and ICE provide reliable fallback for strict NAT scenarios
AI Mentor Explanation
NAT traversal is like two players on different teams, each reachable only through their own team manager’s switchboard, trying to arrange a private practice session directly. STUN is like each player first asking their own manager “what number does the outside world see when I call out?” so they can share that number. Hole punching is like both players calling each other’s switchboard number at the exact same moment, so each switchboard opens a temporary line expecting the other’s call. If the switchboards are too locked down to allow that, a neutral clubhouse (TURN) relays messages between them instead.
Step-by-Step Explanation
Step 1
Discover public mapping
Each peer uses STUN to learn the public IP and port a NAT has assigned to its outbound traffic.
Step 2
Exchange candidates
Peers exchange their discovered address/port candidates through a signalling channel (e.g., over WebRTC/ICE).
Step 3
Attempt hole punching
Both peers send packets toward each other simultaneously so each NAT opens a matching outbound mapping.
Step 4
Fall back to relay
If direct connectivity fails against a strict/symmetric NAT, TURN relays all traffic through a public server.
What Interviewer Expects
- Explains why NAT blocks unsolicited inbound connections
- Names STUN, hole punching, and TURN with their distinct roles
- Knows ICE orchestrates candidate gathering and connection attempts
- Understands the tradeoff: direct connection is preferred, relay is the fallback
Common Mistakes
- Confusing STUN (discovery) with TURN (relay) — they solve different problems
- Assuming hole punching always works regardless of NAT type
- Not knowing symmetric NAT is the hardest case, often requiring TURN
- Thinking NAT traversal is only relevant to VoIP, not also gaming/WebRTC/file sharing
Best Answer (HR Friendly)
“NAT traversal is how two devices behind separate home or office routers manage to talk to each other directly, even though normally a router will not let unexpected incoming traffic through. Techniques like STUN help each device figure out how it looks from the outside, and hole punching gets both sides to open a path at the same time; when that is not possible, a relay server steps in as a middleman so the connection still works, just with a bit more delay.”
Code Example
import socket
import struct
def stun_get_mapped_address(stun_host="stun.l.google.com", stun_port=19302):
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.settimeout(3)
# Minimal STUN Binding Request (RFC 5389 header)
transaction_id = b"\x00" * 12
message = struct.pack("!HHI", 0x0001, 0, 0x2112A442) + transaction_id
sock.sendto(message, (stun_host, stun_port))
data, _ = sock.recvfrom(2048)
# A real client would parse XOR-MAPPED-ADDRESS from the response
# to learn its public IP:port as seen by the STUN server.
print("Received STUN response of length:", len(data))
sock.close()
stun_get_mapped_address()Follow-up Questions
- What is the difference between STUN and TURN?
- Why does symmetric NAT make hole punching harder than cone NAT?
- How does ICE combine STUN and TURN to pick the best connection path?
- Why do WebRTC applications need NAT traversal at all?
MCQ Practice
1. What does STUN help a device discover?
STUN lets a device learn the external IP/port a NAT has mapped its outbound traffic to.
2. What does TURN provide when direct NAT traversal fails?
TURN relays traffic through a public server when a direct peer-to-peer path cannot be established.
3. What technique has both peers send packets simultaneously to open matching NAT mappings?
Hole punching relies on simultaneous outbound packets from both peers so each NAT creates a usable mapping.
Flash Cards
What is NAT traversal? — Techniques letting peers connect directly despite one or both being behind NAT.
What does STUN do? — Lets a device discover its public-facing IP/port as seen from outside its NAT.
What does hole punching do? — Has both peers send packets simultaneously so each NAT opens a matching outbound mapping.
What does TURN do? — Relays all traffic through a public server when direct connectivity fails.