Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got some confusion about port forwarding vs NAT. I know the problems NAT causes for P2P, and that there exist some solutions to it (STUN,TURN,etc) which require a relay server to setup direct connections between the peers.

Is port forwarding an alternative to STUN/TURN regarding the NAT problem? Can two peers behind NAT who have both port forwarded connect with TCP to each other directly? For example I want to develop an app and I'd rather not have to have a server sitting 24/7 to relay connections, but instead having peers maybe do port forwarding and then they can speak to each other directly.

share|improve this question

migrated from Jul 9 '11 at 19:05

This question came from our site for professional and enthusiast programmers.

Two peers behind a NAT, using DNAT (or "port forwarding") aren't technically behind the NAT anymore.

When this scheme is used, connecting to the public IP makes the NAT box forward the packets to an internal system. So, to everyone involved, it looks just like the internal machine is actually not behind the NAT. So if at least one of the peers is using this scheme, STUN is no longer needed.

Of course, the fact that the NAT box mangles packets introduces lots of problems, but if you don't include IPs and ports in your messages you should be fine.

Another problem with this scheme is that you need the cooperation of the NAT box administrator, which isn't always easy to get.

share|improve this answer

This is quite complicated... Also, based as it was on Stack Overflow, I am assuming you want to know this from a programming perspective and what you need to do for communication between clients.

... NAT is the process of having a single (or more) IP addresses one side of a network, and then forwarding any port on any of those addresses to any internal address.

Most NAT devices have a default rule of allow all outgoing and only allow named incoming.

A STUN or similar server basically means that both machines make an outgoing request and the server sort of acts as a proxy so neither client needs to set up an incoming rule.

If you do not want to set something like this up, I would recommend in your program, you design it so you let people know what ports they need to open (so only one person needs to do configuration), or alternatively, look in to UPnP which has techniques that allow you to programatically open ports in some firewalls.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .