Punching Through NAT: How Peer-to-Peer Connections Actually Work
Many Linux users eventually turn a Raspberry Pi, spare laptop, or mini PC into a homelab server. Running a service at home is easy. Reaching it from another network becomes harder when the server sits behind home NAT, ISP CGNAT, or both.
Your home server and phone can make outbound connections, but neither device necessarily accepts a new inbound connection. How do mesh VPNs, video calls, multiplayer games, and other peer-to-peer applications establish a direct path between them?
This talk follows the packets behind UDP hole punching. We will examine NAT address and port mappings, endpoint discovery, coordination servers, simultaneous probing, and candidate selection. We will also examine why direct connections sometimes fail and how encrypted relays provide a fallback path.
The examples draw from Linux homelabs, WireGuard-based mesh networks such as Tailscale, WebRTC, and other peer-to-peer systems. We will briefly separate reachability from security: NAT traversal creates a network path, encryption protects the packets, and policy decides which peers may communicate.
The session uses diagrams and pre-captured packet traces instead of a live network demonstration.
Attendees will learn
- How NAT maps an internal UDP socket to a public endpoint
- Why NAT mapping and filtering behavior affect direct connectivity
- How peers discover and exchange candidate endpoints
- How UDP hole punching creates a direct peer-to-peer path
- Why CGNAT does not always prevent direct connections
- When a relay is required and what an encrypted relay can observe
- How these ideas apply to remotely accessing Linux homelab services
- Why NAT traversal, encryption, and authorization solve different problems
Duration: 20 minutes, followed by 5 minutes for questions.
Punching Through NAT: How Peer-to-Peer Connections Actually Work
Many Linux users eventually turn a Raspberry Pi, spare laptop, or mini PC into a homelab server. Running a service at home is easy. Reaching it from another network becomes harder when the server sits behind home NAT, ISP CGNAT, or both.
Your home server and phone can make outbound connections, but neither device necessarily accepts a new inbound connection. How do mesh VPNs, video calls, multiplayer games, and other peer-to-peer applications establish a direct path between them?
This talk follows the packets behind UDP hole punching. We will examine NAT address and port mappings, endpoint discovery, coordination servers, simultaneous probing, and candidate selection. We will also examine why direct connections sometimes fail and how encrypted relays provide a fallback path.
The examples draw from Linux homelabs, WireGuard-based mesh networks such as Tailscale, WebRTC, and other peer-to-peer systems. We will briefly separate reachability from security: NAT traversal creates a network path, encryption protects the packets, and policy decides which peers may communicate.
The session uses diagrams and pre-captured packet traces instead of a live network demonstration.
Attendees will learn
Duration: 20 minutes, followed by 5 minutes for questions.