> ## Documentation Index
> Fetch the complete documentation index at: https://www.floe.one/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# TURN Relay Fallback Connection

> How Floe falls back to a TURN server as an encrypted bridge when strict NAT or firewalls block a direct peer-to-peer WebRTC connection.

Some networks make it impossible for two devices to connect directly. This happens on strict corporate firewalls, university networks, and when a mobile carrier places many users behind a single shared IP address (carrier-grade NAT). In these cases, a direct path cannot be found and Floe falls back to a relay.

## Direct vs relay at a glance

|                 | Direct                            | Relay                               |
| --------------- | --------------------------------- | ----------------------------------- |
| Speed           | Limited only by your internet     | Depends on relay server load        |
| File size limit | None                              | 2 GB per session                    |
| When used       | Most home and mobile networks     | Strict firewalls, carrier-grade NAT |
| Bandwidth cost  | Zero (files never touch a server) | Uses Floe relay infrastructure      |
| Encryption      | DTLS end-to-end                   | DTLS end-to-end                     |

## TURN fallback

When a direct connection fails, Floe automatically routes through a **TURN server** on Cloudflare's global anycast network. A TURN server acts as a secure bridge. Your data travels through it on the way to the recipient, like a courier carrying a locked box it cannot open.

## Encryption

Even through a relay, your files are protected by **DTLS encryption** built into WebRTC. The relay server sees only encrypted data packets. It cannot read, inspect, or store your files.

## What relay connections mean for you

* Transfer works even on networks that block direct connections.
* Files remain encrypted end-to-end in transit.
* Speeds may be slower depending on relay server load and network conditions.
* Relay transfers are capped at **2 GB per session**. See [The 2 GB Relay Limit](/docs/how-it-works/2gb-limit).

## Disabling relay fallback

If you need to ensure files never pass through a relay, you can disable it. In the browser, toggle off **Network Relay Fallback** before creating the link. In the CLI, pass `--no-relay`:

```bash theme={null}
floe send photo.jpg --no-relay
```

With relay disabled, the transfer fails if a direct path cannot be established.

<Accordion title="Technical details">
  **TURN (Traversal Using Relays around NAT):** When ICE negotiation produces only `relay` candidates, both peers connect to the TURN server and the server forwards packets between them. The data is still DTLS-encrypted end-to-end before it reaches the TURN server.

  **Credentials:** The signaling server mints short-lived credentials from Cloudflare's Realtime TURN service and hands them to peers via `/api/turn-credentials`. Credentials are valid for up to 24 hours. (Self-hosted deployments can instead use coturn with time-limited HMAC-SHA1 credentials; see the self-hosting guide.)

  **Endpoints:** the signaling server hands peers a minimal set of three: `stun:stun.cloudflare.com:3478` for address discovery, `turn:turn.cloudflare.com:3478` over UDP as the primary relay path, and `turns:turn.cloudflare.com:443` over TLS as the fallback on networks that block UDP (TLS on port 443 looks like ordinary HTTPS traffic). Cloudflare mints more endpoint variants, but every extra URL multiplies the connection checks each client runs during setup, so the redundant ones are trimmed before serving.

  **Relay detection:** The browser polls `RTCStatsReport` every 5 seconds and examines the nominated candidate pair. If either candidate is of type `relay`, the connection indicator shows amber.
</Accordion>