Skip to main content
Some networks make it impossible for two devices to connect directly. This happens on strict corporate firewalls, university networks, and when a mobile carrier places many users behind a single shared IP address (carrier-grade NAT). In these cases, a direct path cannot be found and Floe falls back to a relay.

​
Direct vs relay at a glance

​
TURN fallback

When a direct connection fails, Floe automatically routes through a TURN server on Cloudflare’s global anycast network. A TURN server acts as a secure bridge. Your data travels through it on the way to the recipient, like a courier carrying a locked box it cannot open.

​
Encryption

Even through a relay, your files are protected by DTLS encryption built into WebRTC. The relay server sees only encrypted data packets. It cannot read, inspect, or store your files.

​
What relay connections mean for you

  • Transfer works even on networks that block direct connections.
  • Files remain encrypted end-to-end in transit.
  • Speeds may be slower depending on relay server load and network conditions.
  • Relay transfers are capped at 2 GB per session. See The 2 GB Relay Limit.

​
Disabling relay fallback

If you need to ensure files never pass through a relay, you can disable it. In the browser, toggle off Network Relay Fallback before creating the link. In the CLI, pass --no-relay:
With relay disabled, the transfer fails if a direct path cannot be established.
TURN (Traversal Using Relays around NAT): When ICE negotiation produces only relay candidates, both peers connect to the TURN server and the server forwards packets between them. The data is still DTLS-encrypted end-to-end before it reaches the TURN server.Credentials: The signaling server mints short-lived credentials from Cloudflare’s Realtime TURN service and hands them to peers via /api/turn-credentials. Credentials are valid for up to 24 hours. (Self-hosted deployments can instead use coturn with time-limited HMAC-SHA1 credentials; see the self-hosting guide.)Endpoints: the signaling server hands peers a minimal set of three: stun:stun.cloudflare.com:3478 for address discovery, turn:turn.cloudflare.com:3478 over UDP as the primary relay path, and turns:turn.cloudflare.com:443 over TLS as the fallback on networks that block UDP (TLS on port 443 looks like ordinary HTTPS traffic). Cloudflare mints more endpoint variants, but every extra URL multiplies the connection checks each client runs during setup, so the redundant ones are trimmed before serving.Relay detection: The browser polls RTCStatsReport every 5 seconds and examines the nominated candidate pair. If either candidate is of type relay, the connection indicator shows amber.