| Network Scenario | Conventional STUN / TURN Apps | Wonek Direct P2P + Encrypted Fallback | Real-World Call Impact |
|---|---|---|---|
| Home Wi-Fi to Home Wi-Fi ( Cone NAT ) | Direct UDP via standard STUN | Direct P2P over QUIC / WebTransport (TLS 1.3) | Lowest round-trip latency and crisp HD video |
| 4G / 5G Mobile CGNAT to Home Wi-Fi | Often falls back to cloud TURN relay | High-success direct P2P via proprietary port prediction | Avoids unnecessary cloud detour and reduces audio delay |
| Mobile CGNAT to Mobile CGNAT | Almost always relayed through central TURN servers | Frequently establishes direct device-to-device P2P link | Natural conversation cadence without talk-over collisions |
| Strict Corporate Firewall (UDP Blocked) | TCP/TLS TURN relay fallback | Automatic latency-measured encrypted relay fallback | Call connects reliably while MLS E2EE keeps media private |
Why Cellular Carrier-Grade NAT Defeats Naive Hole Punching
IPv4 address exhaustion forced mobile carriers worldwide to place thousands of phones behind shared Carrier-Grade NAT gateways. Unlike a simple home router that often reuses the same external port mapping across destinations, mobile CGNAT gateways dynamically assign external ports per destination session.
Standard WebRTC ICE agents query a public STUN server, learn the port assigned for that STUN server, and hand that single coordinate to the other peer. The moment the peer sends traffic from a different IP address, a strict or symmetric CGNAT gateway rejects the incoming packet and maps outbound traffic to an entirely new external port—causing standard P2P negotiation to time out and fall back to a central TURN relay.
High-Success Direct P2P with Proprietary Port Prediction
Wonek was engineered from the transport layer up to solve mobile-to-mobile connectivity without compromising security. Instead of relying solely on naive single-port STUN assumptions, Wonek uses a proprietary port-prediction NAT traversal algorithm designed specifically for real-world cellular CGNAT and restricted gateways.
When a direct path is achievable, both Apple devices lock onto a direct QUIC / WebTransport session protected by mandatory TLS 1.3 transport encryption underneath client-side MLS (RFC 9420) end-to-end encryption. Voice frames (Opus with acoustic echo cancellation and noise suppression), HD video, screen sharing, and large files travel straight between peers.
- Both peers authenticate session keys end-to-end via Wonek's native Rust MLS cryptographic core before media flows.
- Wonek coordinates NAT traversal and applies its proprietary port-prediction engine to establish a direct encrypted QUIC link even across difficult mobile CGNAT networks.
- If a restrictive enterprise or hotel firewall blocks direct UDP entirely, Wonek automatically selects the lowest-latency encrypted relay so the call still connects immediately.
- Throughout the call, relays and signaling nodes only ever observe opaque TLS 1.3 + MLS ciphertext—never plaintext audio, video, or keys.
Why Milliseconds Matter in Two-Way Voice & Video
Human conversation relies on subtle vocal cues under 150 milliseconds. When a mobile call between two people in the same city is hair-pinned through a cloud relay in another country, round-trip latency climbs and speakers accidentally interrupt each other.
By achieving direct peer-to-peer links across mobile CGNAT far more often than standard STUN/ICE stacks, Wonek keeps local calls local—preserving Opus voice clarity, smooth Picture-in-Picture video, and high-throughput direct file transfers.
Practical Readiness Checklist
Stored locally in your browser—nothing leaves your device.
Frequently Asked Questions
Does direct P2P expose my conversation content to my mobile carrier?
No. Every Wonek connection combines two encryption layers: mandatory TLS 1.3 wire encryption via QUIC / WebTransport plus client-side MLS (RFC 9420) end-to-end encryption. Neither your carrier nor any fallback relay can read your calls, messages, or files.
What happens when a firewall blocks UDP completely?
Wonek automatically falls back to a latency-measured encrypted relay path. The connection remains end-to-end encrypted via MLS, so the relay forwards only opaque ciphertext.
Is Wonek available to download today?
Wonek by Arte Soft EOOD is currently in pre-release and early-access preparation for iPhone, iPad, Mac, and Apple Watch. You can request early access at support@wonek.com.
Related Guides & Comparison
QUIC and WebTransport vs Legacy TCP and WebRTC Stacks in Modern Messengers
Compare QUIC and WebTransport against legacy TCP WebSockets and complex WebRTC stacks: zero head-of-line blocking, TLS 1.3 by default, and faster setup.
MLS (RFC 9420) End-to-End Encryption Explained: Scaling Private Groups & Multi-Device Chat
Understand IETF Messaging Layer Security (RFC 9420): logarithmic TreeKEM group key updates, forward secrecy, post-compromise security, and Noise QR linking.