[dijit]

STUN is a way of breaking NAT using uPNP.

What I mean is that: You don't have a public IP, you likely go to the internet via a router. That router is stateful and allows traffic destined to go to some other internet address to return to you, even though your device is not technically routable on the internet.

So, what a STUN server does, is give you information about how to initiate connections to each party; that allows traffic to go through each of your routers.

    CLIENT1 <-> STUN    // (what ip/port combo is needed for CLIENT2 ;;; there is nothing in the table)
    CLIENT1 <-> CLIENT2 // (initiate a connection attempt that will fail, but will be remembered by the stateful NAT/firewall for return traffic)
    CLIENT1 <-> STUN    // (CLIENT1's incoming info for CLIENT2, this combo will only work for CLIENT2, so it requires CLIENT2 to ask about it)
    CLIENT2 <-> STUN    // (what ip/port combo is needed for CLIENT1 ;;; information is now in the table and will be fetched)
    CLIENT2 <-> CLIENT1 // (direct connection based on previous incoming connection attempt *from* CLIENT1)

NOTE: this is not required for ipv6; this is a hack we needed to bypass NAT because we ran out of ipv4.

TURN is the same idea, but instead of coordinating a peer-to-peer connection, it routes traffic via itself, it's just a neutral relay.

[ashton314]

Excellent explanation—thank you. Great example of a handshake too.