What Is NAT Traversal?
Why devices on separate networks can't reach each other directly, how hole punching and relaying work, and how this differs from port forwarding and VPNs.
Updated
NAT traversal is the technology that lets devices on two different local networks reach each other. It is the reason remote control software can connect to a machine by entering an ID, with nothing configured on either router.
Why can’t two computers just connect directly?
Because most devices have no public IP address.
Your home router, your office gateway and your mobile carrier all perform NAT (network address translation): hundreds of devices share a single public exit. From the outside, all anyone sees is that exit — not which machine sits behind it.
An analogy: NAT is the company switchboard. You can reach the main number, but you cannot dial a specific desk — unless someone tells the switchboard where to route you. That is the problem NAT traversal solves.
Two routes: hole punching and relaying
Hole punching (preferred)
Both devices first connect to a public server and report the exit address they appear to come from. The server tells each side about the other, and both then send packets to that address at the same time. Each NAT sees what looks like a reply to a connection its own side initiated, and lets it through. The path opens, and from then on traffic flows directly between the two machines without touching the server.
This route is the fastest, has the lowest latency, and consumes no vendor bandwidth.
Relaying (fallback)
Some NAT types — symmetric NAT especially, and strict corporate firewalls — defeat hole punching. Traffic then has to be forwarded through a public server: A → server → B.
Relaying is inevitably slower than a direct path and it consumes vendor bandwidth, which is why relay bandwidth is usually a paid-plan concern.
How good a remote control product feels comes down largely to how often hole punching succeeds, and how good the relay is when it doesn’t. Users never see either, and both decide the experience.
What it is not
NAT traversal is not port forwarding. Port forwarding is a rule you add on the router, pointing one public port at one internal machine. It works, but it requires router access, a stable public IP, and one rule per device. NAT traversal does the same job automatically, without touching the router.
NAT traversal is not a VPN. A VPN joins your device to a remote network, after which you reach things as if you were inside it. NAT traversal only opens a path for one connection; your network membership does not change. This is why a good remote desktop tool does not require you to connect to a VPN first — see what remote desktop is.
NAT traversal is not “insecure”. What hole punching establishes is reachability, not permission. Whether anyone may actually control your machine is still decided by credentials and by your approval — see security and auditing.
What WorksLink provides here
WorksLink establishes connections without a VPN and without port forwarding on your router. Cross-carrier connectivity and P2P networking are included even on the free plan; paid plans add global server clusters and VIP P2P networking with unmetered relay bandwidth — that is, the quality of the fallback path described above.
Full plan differences are on the pricing page; how a session is established is covered in connecting with WorksLink.