Have you ever been matched with someone on a video chat, seen their name appear, and then waited while the video never quite connected? Or noticed that video chat works perfectly at home but fails on your office or campus Wi-Fi? The explanation usually involves three acronyms that most people never need to think about: NAT, STUN and TURN.
This article explains them without jargon. By the end, you will understand why connecting two devices on the internet is harder than it sounds, how video chat platforms solve the problem, and what you can do when a connection will not go through.
The problem: devices hiding behind routers
In an ideal world, every device on the internet would have its own unique public address, and one device could contact another simply by knowing that address. That was roughly the original design of the internet. But the world ran low on IPv4 addresses decades ago, and the industry adopted a workaround called NAT, or Network Address Translation.
With NAT, your router has one public address, and all the devices in your home, such as phones, laptops, TVs and consoles, share it using private addresses like 192.168.1.23. When your laptop sends a request out to a website, the router rewrites it to use the public address and remembers which device asked. When the reply comes back, the router forwards it to the right device.
This works beautifully for normal browsing, where your device always makes the first move. It works badly for video calls between two people, because each side needs to receive data that the other side sends. If both people are behind NAT routers, neither router knows what to do with unexpected incoming traffic, and by default it drops it. It is like two people in different office buildings, each with a receptionist who only forwards calls from people you have already called.
Mobile networks often add a second layer called carrier-grade NAT, where the mobile provider shares one public address among many customers. That makes direct connections harder still.
STUN: "What does my address look like from outside?"
The first tool in the toolbox is STUN, which stands for Session Traversal Utilities for NAT. A STUN server is a simple public server that answers one question: "What public address and port did your request come from?"
Your browser sends a small request to the STUN server, and the server replies with the address it saw. Now your browser knows how it appears to the outside world. It shares this public address with the other person through the platform's signalling server, as explained in how WebRTC works. The other person does the same.
Then comes a clever trick called hole punching. Both browsers start sending small packets toward each other's public address at roughly the same time. Each router sees an outgoing packet and opens a temporary pathway for replies. When the other side's packets arrive, the router treats them as replies to the conversation that was just started and lets them through. The result is a direct, peer-to-peer connection, even though both devices are behind NAT.
STUN servers are cheap to run, because they only answer a tiny question and never carry the video itself. Many applications use publicly available STUN servers. JustChill Live uses a well-known public STUN server to help browsers discover their addresses.
When STUN is not enough
Hole punching works for the majority of home and mobile connections, but not all of them. Some routers use what is called symmetric NAT, where the router assigns a different public port for every destination. The address the STUN server saw is not the address the other person would need to use, so hole punching fails. Strict corporate, school and hotel firewalls may also block the kinds of traffic WebRTC relies on, allowing only standard web traffic.
In these situations, a direct connection simply is not possible, no matter how clever the software is.
TURN: the relay of last resort
This is where TURN comes in: Traversal Using Relays around NAT. A TURN server sits on the public internet with a reachable address. When two browsers cannot connect directly, each connects to the TURN server instead, and the server relays the media between them.
TURN almost always works, because each browser is making an ordinary outgoing connection that routers and firewalls permit. The downside is cost and performance. Every second of video passes through the relay, which consumes significant bandwidth, and the extra hop can add delay. Services that use TURN therefore usually treat it as a fallback, used only when direct connections fail. The media is still encrypted end to end between the browsers, so the relay forwards it without being able to watch it.
ICE: trying everything in the right order
The framework that ties all of this together is called ICE, or Interactive Connectivity Establishment. Each browser gathers a list of candidate addresses:
- Host candidates: local addresses on the device itself, which may work if both people are on the same network
- Server-reflexive candidates: public addresses discovered via STUN
- Relay candidates: addresses on a TURN server, if one is configured
The browsers exchange these candidates, pair them up and test connectivity, preferring the most direct paths. Within a second or two, they settle on the best one that works. If none work, the connection fails.
What this means for you
If a video chat connects instantly, you are almost certainly on a direct peer-to-peer connection, the fastest possible path. If a chat sometimes fails to connect with certain people, it is often because one of you is on a network that prevents direct connections. It is rarely anything you did wrong.
Things to try when connections fail
- Skip and try again. The problem may have been on your partner's network, not yours.
- Switch networks. If you are on school, office or hotel Wi-Fi, try your home connection or mobile data.
- Restart your router. This can clear stale NAT mappings.
- Disable VPNs or proxies temporarily to see whether they are interfering, then decide whether you want to keep them on. Our IP privacy article discusses the trade-offs.
- Update your browser. Newer versions include connection improvements.
- Check browser extensions. Some privacy extensions block WebRTC entirely.
Our guide to fixing camera and microphone problems covers the other half of troubleshooting: making sure your devices are working before the connection even starts.
Why this matters for random chat
On a random video chat platform, connection speed is part of the experience. People decide within seconds whether to stay, so a match that takes ten seconds to connect often ends in a skip. The combination of STUN, hole punching and fast signalling is what makes it possible to go from pressing Start to seeing a stranger's face almost instantly. The fact that it works for most people, across millions of different routers and networks, is a small everyday miracle of internet engineering.