When you transfer a 4GB raw video file directly between two laptops across town using Crate Drop, or duel another player in real-time on TypeCrate, data packets fly straight from one browser to the other. No cloud storage, no intermediate upload step, and zero server bandwidth fees. But on the modern internet, two devices cannot simply dial each other’s internal IP address (`192.168.1.45`). Between them sits Network Address Translation (NAT) and strict enterprise firewalls.
Understanding how WebRTC punctures these digital walls requires demystifying the three pillars of WebRTC connectivity:STUN, TURN, and ICE.
The Problem: The NAT Wall
IPv4 addresses are scarce. To solve this, your home Wi-Fi router assigns local private IP addresses to your phone, laptop, and smart TV. When your laptop sends an outbound packet to `google.com`, your router rewrites the source IP and port from your local address to its own public WAN IP.
This works seamlessly for client-server communication because the client initiates the request. But for Peer-to-Peer (P2P), Device A and Device B do not know each other’s public IP or port. Worse, if Device B attempts to send an unsolicited packet to Device A’s public IP, Device A’s router drops it immediately for security.
1. STUN: The Mirror in the Cloud
STUN (Session Traversal Utilities for NAT, RFC 5389) is an extremely lightweight protocol designed to answer one simple question:"What is my public IP address and port as seen by the outside world?"
- Device A sends a STUN binding request to a known public STUN server (such as Google’s free `stun:stun.l.google.com:19302`).
- The STUN server inspects the incoming UDP packet header, notes the public IP and source port allocated by Device A’s router, and replies back with that mapped address (the XOR-MAPPED-ADDRESS).
- Now Device A knows its public persona and can share it with Device B over a signaling channel.
2. The Failure of STUN: Symmetric NATs
STUN succeeds in approximately 80% to 85% of consumer home network situations. However, it fails completely on Symmetric NATs, commonly found on cellular 4G/5G networks, university campuses, and corporate VPNs.
Under symmetric NAT, the router assigns a unique external port for every individual destination IP and port requested. When Device A contacts the STUN server, port `45231` is allocated. But when Device A subsequently attempts to send packets to Device B, the router assigns a completely new, unpredictable port (`58190`). Because Device B was expecting communication on port `45231`, direct hole punching fails.
3. TURN: The Guaranteed Relay Fallback
When direct P2P hole punching is impossible, WebRTC falls back to TURN (Traversal Using Relays around NAT, RFC 5766).
A TURN server is not a signaling mirror; it is an active media relay. Both peers establish an outbound connection to the TURN server, which forwards all encrypted packets between them. While this eliminates the cost savings of zero-bandwidth P2P, it ensures a 100% connection success rate regardless of how strict the firewall or enterprise proxy might be.
4. ICE: The Master Orchestrator
ICE (Interactive Connectivity Establishment, RFC 8445) is the algorithm that brings STUN and TURN together. Instead of guessing which connection method will work, ICE gathers every conceivable communication path—called ICE Candidates:
| Candidate Type | Source | Latency / Priority |
|---|---|---|
| host | Local NIC (LAN/Wi-Fi internal IP) | Highest (< 1ms on local network) |
| srflx (Server Reflexive) | Public IP/port discovered via STUN | Direct P2P over WAN |
| prflx (Peer Reflexive) | Discovered dynamically during checks | Direct P2P alternate route |
| relay | Relayed via TURN server | Fallback (Higher latency, guaranteed) |
The browsers exchange these candidates via SDP (Session Description Protocol) offers and answers through a signaling server (such as WebSockets). ICE performs connectivity checks in parallel, pairs the best working paths, and locks onto the lowest-latency route.
How We Apply This in Crate Tools
In Crate Drop, ICE pairing allows two devices in the same office to transfer gigabytes of 4K footage at local Gigabit Wi-Fi speeds without touching the public internet at all. In TypeCrate, host and srflx candidates provide sub-20ms keystroke synchronization for head-to-head typing battles.