Skip to main content
Some networks make it impossible for two devices to connect directly. This happens on strict corporate firewalls, university networks, and when a mobile carrier places many users behind a single shared IP address (carrier-grade NAT). In these cases, a direct path cannot be found and Floe falls back to a relay.

​
Direct vs relay at a glance

​
TURN fallback

When a direct connection fails, Floe automatically routes through a TURN server on Cloudflare’s global anycast network. A TURN server acts as a secure bridge. Your data travels through it on the way to the recipient, like a courier carrying a locked box it cannot open.

​
Encryption

Even through a relay, your files are protected by DTLS encryption built into WebRTC. The relay server sees only encrypted data packets. It cannot read, inspect, or store your files.

​
What relay connections mean for you

  • Transfer works even on networks that block direct connections.
  • Files remain encrypted end-to-end in transit.
  • Speeds may be slower depending on relay server load and network conditions.
  • Relay transfers are capped at 2 GB per session. See The 2 GB Relay Limit.

​
Disabling relay fallback

If you need to ensure files never pass through a relay, you can disable it. In the browser, toggle off Network relay fallback before creating the link (the toggle appears once you have picked files, just above the Create secure link button). In the CLI, pass --no-relay:
Terminal
With relay disabled, the transfer fails if a direct path cannot be established.
The desktop app has no relay-fallback switch. Its Hide my IP address setting is the opposite control: it makes the relay the only path, so every transfer is relayed and capped at 2 GB. See the desktop settings reference.
TURN (Traversal Using Relays around NAT): ICE tries the candidate pairs and nominates one that works. When the nominated pair has a relay candidate on either side, traffic goes through the TURN server, which forwards packets between the peers. This is decided by the winning pair, not by an absence of other candidates: host and reflexive candidates are still gathered and offered, they simply did not win. The data is still DTLS-encrypted end-to-end before it reaches the TURN server.Credentials: The signaling server mints short-lived credentials from Cloudflare’s Realtime TURN service and hands them to peers via /api/turn-credentials. Credentials are valid for up to 24 hours. (Self-hosted deployments can instead use coturn with time-limited HMAC-SHA1 credentials; see the self-hosting guide.)Endpoints: the signaling server hands peers a minimal set of three: stun:stun.cloudflare.com:3478 for address discovery, turn:turn.cloudflare.com:3478 over UDP as the primary relay path, and turns:turn.cloudflare.com:443 over TLS as the fallback on networks that block UDP (TLS on port 443 looks like ordinary HTTPS traffic). Cloudflare mints more endpoint variants, but every extra URL multiplies the connection checks each client runs during setup, so the redundant ones are trimmed before serving.Relay detection: The browser polls RTCStatsReport every 5 seconds and examines the nominated candidate pair. If either candidate is of type relay, the connection indicator shows amber.

Related topics

Floe Quick StartSending Files with the Floe Web AppFloe FAQDirect Peer-to-Peer ConnectionFloe Troubleshooting Guide