How hole punching works, why TCP and plain UDP fall short, and how QUIC and iroh make direct P2P connections reliable.
A p2p Vision for QUIC
Using QUIC to achieve everything needed for NAT traversal, from address discovery to proxying UDP
FOSDEM 2026 - iroh p2p connections
iroh is a library to establish direct connections between two peers, wherever they are on the internet. It takes care of using different transports and holepunching as needed, to reliably establish connectivity. To the application a normal QUIC connection is presented. The aim is to be a connection layer for p2p, providing greater user agency.
TIL: Iroh: peer-to-peer networking for app developers
I came across Iroh (via, via) today as it hit 1.0 and found it a really interesting solution to a problem I knew existed but had not thought a lot about. Judging from the comment sections, it seems pretty clear that lots of people are confused as to exactly what Iroh is. I don’t think their launch post does their product justice at all, and their tagline is “IP addresses break, dial keys instead” which sounds cool, but if you think about it for just a second, you’ll end up with lots of questions. The biggest one is: “so how is this different from a mesh VPN like Tailscale, ZeroTier, Netbird, etc.?” It’s only after reading a lot of developers’ comments on the threads that I feel I understand: Iroh is aimed at application developers who want to communicate P2P between machines running their app, while mesh networks are aimed at network admins who want to connect devices they own/manage together.
QUIC API for Peer-to-peer Connections
This document defines a set of ECMAScript APIs in WebIDL to allow data to be sent and received from another browser or device implementing the QUIC protocol. The specification for multiplexing of QUIC with STUN/TURN/ZRTP/DTLS/RTP/RTCP [[RFC9443]] was developed within the IETF AVTCORE Working Group.
The Deceptive Complexity of P2P Connections and the Solution We Found
Discover how ARK Builders navigated a maze of p2p network technologies, comparing WebRTC, libp2p, and Iroh to find the perfect fit.
Deep dive into iroh: A replacement for WireGuard or a P2P layer for your application?
Just last week, the iroh project announced the release of its v1.0. What is iroh? Well, I'm glad you're asking because it's a very interesting project that I'm following for
How NAT traversal works
Learn how NAT traversal works, how Tailscale can get through and securely connect your devices directly to each other.
Going Peer to Peer with QUIC
Marten Seemann and I just published an entry on his blog, A p2p Vision for QUIC. This is a technical argument, explaining how a series of small improvements to the QUIC standards would suffice to make QUIC a great peer-to-peer (P2P) protocol. I personally love it, because the Internet suffers greatly from excessive centralization, with big platforms acting as gatekeepers. Currently, pretty much all user activities on the Internet are mediated by “services in the cloud”. Take for example something as simple as a security camera in your home. People want to check the camera images when they are outside the home. They cannot connect to the camera or even a home server directly, because the home network is “behind a NAT” – and very possibly behind multiple layers of NAT, given the scarcity of IPv4 addresses. The practical solution is to export the images from the camera to a “service in the cloud”, and to let user contact that service from their cellphone. It works, but it has obvious issues for privacy, security, or even continuity of service: if the cloud service stops, the camera gets bricked. The proposed QUIC architecture would provide a generic solution using the Masque standard for relaying QUIC, combine with QUIC NAT traversal extensions to migrate connections from “using the relay” to “directly P2P”, as shown in the following diagram. +------------------------------+ | Step 1: phone contacts | v the camera through +---|---+ +-----------+-+ the relay | Phone | | Masque ^ | +---|---+ | Relay | | | +-----------|-+ +-------------------------+ | | Step 2: phone and camera cooperate +-----|----|-+ and establish a "hole" in the NAT. | NAT | | | +-----|----|-+ Step 3: traffic flows directly | | between phone and camera without +-|----|-+ burdening the relay | Camera | +--------+ The standards to achieve that are almost ready. The relaying of incoming connections is described in the UDP Listen, already adopted in the Masque Working Group. A draft submitted to the IETF QUIC Working Group describes the Using QUIC to Traverse NAT, and another describes QUIC Address Discovery. I have already implemented the Address Discovery draft in picoquic, and intend to promptly implement the other two drafts. Using QUIC has many advantages. The communications are encrypted end to end, even when they are going through the relay, which has nice security and privacy benefits. The relay is uses standards and is not dependent on the application; if a relay goes out of business, just pick another one. In the weird cases where the NAT traversal fails, the application still works. There are of course many more applications of P2P possible, such as for example direct video calls between two homes, video games and more. The vision is clear: we can do all those applications using QUIC.
EmbarkStudios/quilkin
Quilkin is a non-transparent UDP proxy specifically designed for use with large scale multiplayer dedicated game server deployments, to ensure security, access control, telemetry data, metrics and more.