{"slug":"what-is-stun","title":"What is STUN?","tags":["tailscale"],"agent_summary":"Last validated: Aug 6, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# What is STUN?\r\n\r\nLast validated: Aug 6, 2025\r\n\r\nSTUN lets a device to determine its public IP address and the [type of NAT](https://tailscale.com/docs/reference/device-connectivity#nat-types) it is behind, which is essential for establishing direct communication between devices on different private networks. STUN uses a client-server architecture model where the STUN client sends requests to a STUN server, which responds with the client's public IP address and port number.\r\n\r\nTailscale uses STUN (session traversal utilities for NAT) to enable direct communication between devices behind NAT firewalls or routers. The Tailscale client running on a device functions as the STUN client, and the [DERP](https://tailscale.com/docs/reference/derp-servers) relay servers function as the STUN servers.\r\n\r\nThe Tailscale client sends a STUN request to all the DERP relay servers, and the DERP relay servers note the public IP and port it received the request from. Tailscale uses this information to determine how to traverse the NAT the client is behind. You can get this information using the [`tailscale netcheck`](https://tailscale.com/docs/reference/tailscale-cli#netcheck) command.\r\n\r\nTo better understand how Tailscale connections work, read [How Tailscale works](https://tailscale.com/blog/how-tailscale-works).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>What is STUN?</h1>\n<p>Last validated: Aug 6, 2025</p>\n<p>STUN lets a device to determine its public IP address and the <a href=\"https://tailscale.com/docs/reference/device-connectivity#nat-types\">type of NAT</a> it is behind, which is essential for establishing direct communication between devices on different private networks. STUN uses a client-server architecture model where the STUN client sends requests to a STUN server, which responds with the client's public IP address and port number.</p>\n<p>Tailscale uses STUN (session traversal utilities for NAT) to enable direct communication between devices behind NAT firewalls or routers. The Tailscale client running on a device functions as the STUN client, and the <a href=\"https://tailscale.com/docs/reference/derp-servers\">DERP</a> relay servers function as the STUN servers.</p>\n<p>The Tailscale client sends a STUN request to all the DERP relay servers, and the DERP relay servers note the public IP and port it received the request from. Tailscale uses this information to determine how to traverse the NAT the client is behind. You can get this information using the <a href=\"https://tailscale.com/docs/reference/tailscale-cli#netcheck\"><code>tailscale netcheck</code></a> command.</p>\n<p>To better understand how Tailscale connections work, read <a href=\"https://tailscale.com/blog/how-tailscale-works\">How Tailscale works</a>.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}