STUN (Session Traversal Utilities for NAT)

Networking intermediate

STUN is a protocol that lets a client discover the public IP address and port its NAT has mapped to an outbound connection.

Summary

STUN (Session Traversal Utilities for NAT) is a lightweight protocol defined in RFC 8489 that lets a client behind a NAT learn the public IP address and port that the NAT has assigned to its outbound traffic.

What is STUN?

A STUN client sends a short request to a public STUN server. The server inspects the source address and port of the incoming packet — which is the public address the NAT picked — and reflects this information back to the client. With that knowledge, the client can advertise its publicly reachable endpoint to other peers during a connection setup.

STUN does not carry any application payload. It only exposes addressing information that is otherwise invisible from behind a NAT. Two peers that have each obtained their mapped addresses through STUN can then attempt hole punching to talk to each other directly, without relaying through a server.

STUN is used by WebRTC, SIP, peer-to-peer VPNs, and overlay networks such as WireGuard-based mesh VPNs. It is typically deployed alongside TURN, which provides relayed fallback transport when direct connections fail. Public, free STUN servers are commonly available, but production deployments often run their own.

Why is STUN relevant?

  • Direct paths: Enables peer-to-peer connections without relaying every packet
  • Lightweight: A single, small UDP exchange per client per connection
  • Standard: Implemented by every modern real-time protocol stack
  • Privacy-friendly: Does not carry payload, only addressing metadata
  • NAT Traversal: Umbrella concept of which STUN is one building block
  • TURN: Companion protocol for relayed fallback when STUN-based hole punching fails
  • Peer-to-Peer: Network model whose connections STUN helps establish
  • Mesh VPN: VPN topology that relies on STUN-based peer discovery

Similar Solutions

For Cloud & Infrastructure Teams

Cloud and infrastructure teams don’t deliver value because they run servers. They deliver value because systems are reliable, scalable, and secure. We work with cloud and infrastructure teams to design environments that meet business needs while enabling fast delivery. Our approach emphasizes practical automation, operational efficiency, and resilience.

Discover more

For Security & SOC Teams

Security teams don’t protect organizations because they issue reports. They protect organizations because vulnerabilities are managed continuously. We work with security and SOC teams to strengthen processes, proactively address risks, and align with compliance requirements. We focus on actionable practices, not theory.

Discover more

Related Terms

TURN (Traversal Using Relays around NAT)

TURN is a protocol that relays traffic between two endpoints when direct peer-to-peer connectivity through NAT is not possible.

Discover more

NAT Traversal

NAT traversal describes techniques that let two endpoints behind Network Address Translation devices establish a direct connection with each other.

Discover more

Peer-to-Peer (P2P)

Peer-to-peer (P2P) is a network model where nodes communicate directly with each other instead of routing all traffic through a central server.

Discover more

Mesh VPN

A mesh VPN is a VPN topology where every authorised client builds direct, encrypted peer-to-peer connections to every other client, with only identity and policy managed centrally.

Discover more

We are here for you

You are interested in our courses or you simply have a question that needs answering? You can contact us at anytime! We will do our best to answer all your questions.

Contact us