STUN, TURN and ICE Explained Simply: How Devices Find a Path to Each Other
Routers hide devices from the internet, yet calls still connect. Three small technologies make it happen. Here they are, with no networking degree required.
Most devices sit behind a router that hides them from the internet. That is good for safety and awkward for calls: if neither device can be reached from outside, how can two of them connect? The answer lies in three small technologies with unfriendly names. Understanding them explains why a call connects instantly in one place and refuses in another.
The problem in one picture
Imagine two people, each in a house with a single front door that only opens outwards. Neither can knock on the other's door. But if both step out at the same moment and walk towards each other, they can meet in the street. That is the idea behind modern connections. The tricky part is knowing where the other person is, and what to do if the street is blocked.
STUN: finding out how you look from outside
A STUN server is a simple helper on the public internet. A device sends it a tiny message, and the server replies: "from here, you look like this address and port". Now the device knows its public face, which it could not see from inside its own network. It passes that to the other device through the introduction server, and the other does the same.
STUN is small, cheap and sees no content. It only answers one question.
ICE: trying every route
ICE, Interactive Connectivity Establishment, is the process that collects all the possible routes between two devices and tests them in order. The candidates include:
- The devices' local addresses, which work if they share a network.
- Their public addresses learned through STUN, which work if the routers allow the traffic.
- A relay address, which works almost always but is the slowest.
The devices test the candidates, pick the best one that works, and use it. All of this happens in a second or two, before you see anything on screen.
TURN: the relay of last resort
Some networks refuse every direct route: strict company firewalls, certain mobile carriers, some public Wi-Fi. For them there is TURN. A TURN server is a public machine that both devices can reach. Each sends its traffic to the relay, and the relay forwards it to the other. The call works, with a little more delay and with the relay's bandwidth paying the cost.
Can the relay see my call?
No. The media and data are encrypted between the two devices before they reach the relay. The relay handles scrambled packets and passes them along. It knows that two addresses are exchanging data, and how much, but not what is in it. See what is WebRTC for how encryption is built in.
A summary table
| Piece | Job | Sees your content? |
|---|---|---|
| Introduction (signalling) server | Passes setup messages between the two devices | No media |
| STUN server | Tells a device its public address | No |
| ICE | Tries all routes and chooses the best | A process, not a server |
| TURN server | Relays encrypted traffic if no direct route works | No, it is encrypted |
Why calls fail on some networks
If a network blocks direct routes and also blocks the relay, the connection fails. Common causes are a firewall that only allows ordinary web traffic and a network that blocks the ports a relay uses. The fix is to try another network, or for the network owner to allow the traffic. Read remote desktop through firewalls and NAT for more.
What this means for PeerFlow
PeerFlow uses this machinery for calls, screen sharing, file transfers and remote sessions: devices are introduced, routes are tried, and a direct path is used whenever the network allows. When it does not, an encrypted relay carries the traffic. People who run their own server need to open the right ports for both the meeting server and the relay, otherwise calls work on some networks and not on others.
For the curious: ports and protocols
Media usually travels over UDP, which is fast, with TCP as a fallback for strict networks. A relay listens on specific ports. If those ports are closed at the server's firewall, the relay is useless, even though everything else looks fine. When you set up a server, check both the operating system firewall and the hosting provider's firewall.
Troubleshooting in three steps
- Try a different network for one of the devices, such as a phone hotspot.
- Try again in the other direction, if the two roles are interchangeable.
- Ask the network owner whether peer-to-peer traffic and relay ports are allowed.
Related reading
For the broader picture, read how messages travel and is P2P safe?. To try it for yourself, install the Android and Windows apps.
Frequently asked questions
What is a STUN server?
A small public server that tells a device how it looks from the internet, so it can tell the other side how to reach it.
What is a TURN server?
A relay that passes encrypted traffic between two devices when they cannot connect directly.
Can a TURN server see my call?
No. It forwards encrypted data it cannot read.
What is ICE?
The process that gathers every possible route between two devices and picks the best one that works.