Remote Desktop Through Firewalls and NAT: How Connections Really Work
Two computers want to talk, and a router or firewall stands in the way. Here is the plain-language story of NAT, direct paths, relays and why some networks block everything.
You enter the code, the other computer is sitting there with PeerFlow open, and yet nothing connects. Or it connects at home and fails at the office. Nothing is wrong with the program; the network is in the way. Understanding how connections cross routers and firewalls explains almost every case, and tells you what to try next.
The problem: routers hide your computer
Most computers do not have a public internet address of their own. They sit behind a router, which has one public address and shares it among everything at home or at work. The router uses a technique called NAT, network address translation, to keep track of which traffic belongs to which device. It is a clever arrangement, but it means the outside world cannot just open a connection to your computer. The router drops traffic it did not expect, which is also a useful protection.
How two devices still find each other
Direct connections between devices, as used by PeerFlow, start with an introduction. Both devices contact a server on the internet, which tells each of them how the other looks from outside. Each then sends a few small messages towards the other. Because both are sending, each router believes the incoming traffic is a reply to something its own device started, and lets it through. The two devices now have a direct path. This trick is part of a standard called ICE, with helpers called STUN servers.
When the direct path fails
Some networks refuse the trick. Strict firewalls, some company networks, some hotel and café networks and some mobile networks scramble addresses in ways that stop direct paths. In that case the two devices need a relay.
What a relay does
A relay, sometimes called a TURN server, is a public server that both devices can reach. When no direct path exists, each device sends its traffic to the relay, and the relay passes it on. The relay never sees your screen, because the traffic is encrypted between your devices. It simply forwards packets it cannot read. The price is a little extra delay and the relay's own bandwidth, so direct paths are always preferred.
What the relay needs
A relay only helps if the devices can reach it. If a firewall blocks outgoing traffic to the relay's ports, the connection fails even with a relay in place. For this reason, anyone who runs their own PeerFlow server needs to open the relay's port range as well as the ports used for meetings. Everyone else just needs normal internet access.
Diagnosing a failed connection
| What you see | Likely cause | What to try |
|---|---|---|
| Works at home, fails at the office | Company firewall blocks direct and relay | Use another network or ask the IT team |
| Works on Wi-Fi, fails on mobile data | Mobile carrier network translation | Switch to Wi-Fi |
| Connects but is slow | Using a relay | Try a different network for a direct path |
| Never connects on any network | Relay unreachable or blocked | Server side ports must be open |
| Works one way, not the other | Strict NAT on one side | Try swapping who shares and who connects |
Practical advice
- Try another network. A phone hotspot is the fastest test. If it works there, the problem is the first network.
- Try the other direction. Sometimes one device's network is stricter than the other's.
- Restart the router. Old translation tables sometimes confuse things.
- Ask the network owner. At an office, the IT team may allow the traffic or give you an approved route.
- Check the date and time. Wrong clocks can break encrypted connections.
What about opening ports?
With traditional remote desktop you forward a port on the router, which exposes a service on the open internet to automatic scanners all day. Direct connection with introduction and relay avoids that, because nothing needs to listen for strangers. Read remote desktop vs VPN for more on the options, and is remote desktop safe? for the safety side.
For people who run their own server
If you host PeerFlow yourself, open the ports for meetings and for the relay on both the server's firewall and the hosting provider's firewall, with both UDP and TCP. Missing ranges are the most common reason for calls and remote sessions that connect on one network but not on another. The deployment guide in the project lists the exact ranges.
In short
Direct when possible, relayed when not, and always encrypted. When a connection fails, change the network first. Install the latest Windows and Android apps, which include the newest connection improvements.
Frequently asked questions
Why can some networks not connect directly?
Some routers and firewalls change or block the paths that two devices would use to find each other. Strict company networks and some mobile networks do this more often.
What is a relay?
A relay is a server that passes encrypted traffic between two devices when they cannot reach each other directly. It adds a little delay but makes the connection possible.
Can the relay read my screen?
No. The traffic is encrypted between your two devices. The relay forwards data it cannot read.
What should I try if a session never connects?
Switch one device to another network, such as a mobile hotspot, and try again. If it only works on some networks, a firewall is blocking the connection on the others.