NAT Traversal & Endpoints

Most home/mobile networks are behind NAT. The client's public IP is the router; internal IP is private.

WireGuard's NAT handling:

1. Client initiates: outbound UDP packet creates NAT mapping. Server learns client's mapped public IP+port.
2. Server replies to learned endpoint. Mapping persists for ~30s by default.
3. PersistentKeepalive: client sends empty keepalive every 25s. Resets the NAT timeout.
4. Symmetric NAT: maps differently per destination. Two peers behind symmetric NATs can't reach each other directly.

Without keepalive: NAT mapping expires when traffic idles. Server unable to send. Reconnection requires fresh client-initiated packet.

For peer-to-peer (no central server):

• STUN (RFC 5389): query an external server for your public IP+port.
• TURN (RFC 5766): relay traffic via a public server when direct fails.
• ICE (RFC 8445): try direct, then NAT-punching, then TURN.

WireGuard doesn't include these; it's point-to-multipoint with one peer always reachable.

Tailscale's MagicDNS + NAT punching:

• Each peer registers its public endpoint candidate(s) with a coordination server.
• Peers exchange candidates via the coord server.
• Try direct UDP to each candidate. If it works, use it.
• Fall back to DERP relays (Tailscale-operated) if direct fails.

UDP hole punching:

1. Both peers send UDP packets to each other's likely public endpoint AT THE SAME TIME.
2. The first packet creates a NAT mapping.
3. The reply arrives through that mapping.

Symmetric NAT defeats hole punching. Most home routers are not symmetric (port-restricted cone NAT).

IPv6 helps: no NAT needed if both peers have IPv6.

Mobile/cellular networks often have CGNAT (carrier-grade NAT). Hole punching usually fails. Relays needed.