Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →You can block unneeded STUN traffic without breaking VoIP or WebRTC, but avoid a blanket rule that drops every STUN packet. First identify the services, transports, and ports your applications actually use; then restrict unapproved destinations or route traffic through an approved proxy or TURN relay. Test call setup and two-way media on representative networks before enforcing the rule broadly.
Why blocking all STUN can disrupt VoIP or WebRTC
STUN helps an endpoint discover the address and port a NAT assigns to it. It can also support connectivity checks and NAT-binding keepalives. STUN is not a complete NAT-traversal solution by itself; it is a tool used within one. RFC 8489
As an Amazon Associate I earn from qualifying purchases.
ICE gathers possible connection addresses, called candidates, and tests paths between endpoints using STUN checks. It can also use TURN relays. If a firewall blocks STUN, an ICE deployment may lose candidate information or checks it needs, but that does not mean every call will fail. The result depends on the application’s configuration, the candidates available, and the network paths the firewall permits. RFC 8445
That is why “block unneeded STUN traffic” is a more useful policy goal than “block STUN.” The former can restrict unknown services while preserving the paths approved applications need; the latter may remove connectivity options without providing a working alternative.
#1 Best Overall
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Which ports does STUN use?
RFC 8489 specifies default STUN ports, not a universal firewall allowlist:
| STUN transport | Default port |
|---|---|
| UDP | 3478 |
| TCP | 3478 |
| TLS or DTLS | 5349 |
Applications and deployments can use other configured ports. These defaults also do not describe every TURN relay or media path. Confirm the actual server listening ports and service requirements; server operators should publish the listening port in DNS service records. A rule based only on port number may miss traffic on other configured ports or capture traffic that is not the service you intend to control.
Rank #2
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Choose a policy that matches what you need to control
Decide whether your objective is to restrict unknown public STUN services, require mediated egress, or deny a particular application. They are different policies, and each calls for different firewall and application settings.
| Policy approach | What it controls | What to verify |
|---|---|---|
| Allow approved endpoints | Limits STUN access to the service names or addresses approved for your applications. | Confirm the applications’ configured endpoints, transports, and ports with their owners. Check that the rule accounts for the services’ actual configuration. |
| Require an organizational proxy or enterprise TURN service | Directs external WebRTC traffic through an approved path rather than allowing direct egress. | Configure and test the proxy or relay path before removing direct paths. RFC 8828 describes this type of enterprise policy. |
| Deny a particular application | Targets the application rather than treating all STUN traffic alike. | Use the organization’s application-control policy and confirm that the rule does not unintentionally affect other services sharing network paths. |
Compare the options against destination scope, configured transports, whether direct connectivity is allowed, call reliability on restrictive networks, support impact, and privacy or governance requirements. For example, consider whether endpoint address information or media may traverse third-party infrastructure. Standards describe protocol options; they do not provide vendor performance comparisons or recommend a particular product. RFC 8489, RFC 8835, RFC 8828, RFC 8656
Rank #3
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
How to block unneeded STUN traffic safely
- Inventory the applications. List the VoIP and WebRTC applications in scope and obtain their configured STUN and TURN server names, addresses, transports, and ports. Confirm requirements with each application or service owner; do not assume the RFC default ports cover the deployment.
- Define the intended path. Decide whether approved applications may connect directly, must use an organizational proxy or enterprise TURN relay, or should be denied. If mediated egress is required, configure and permit that path before removing direct connectivity.
- Write narrow rules. Scope rules to approved services and the transports and ports they actually use. Avoid treating the default STUN ports as a complete list of WebRTC traffic or assuming that permitting a STUN request also permits TURN allocations and relayed media.
- Test the network cases that matter. Check candidate gathering, connectivity, and actual media in both directions on the same LAN, across different NATs, on a UDP-restricted network, and through any relevant remote-access or split-tunnel path. A successful signaling exchange or ICE negotiation alone does not prove that media flows.
- Roll out gradually. Apply the rule to a small group first. Monitor call failures and quality, and keep a rollback path available while validating behavior.
This sequence is operational guidance based on the roles of STUN, ICE, and TURN; the RFCs do not prescribe a vendor-specific firewall change process.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can I block UDP and still use WebRTC?
Possibly, if the application has a working TURN fallback over a permitted TCP path. RFC 8835 requires WebRTC implementations to support TURN over TCP and TURN over TLS over TCP for networks where firewalls block all UDP. That requirement does not configure a TURN server for your application or make a blocked route usable: the application must have a viable TURN configuration, and the firewall must permit that connection. TURN has its own server and transport configuration, and relayed media must be allowed along the required path. RFC 8656
Rank #4
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
So blocking UDP may still allow WebRTC in some deployments, but it is not a safe assumption for an untested application. Verify the configured fallback and bidirectional media on the UDP-restricted network you need to support.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How much traffic does STUN generate?
RFC 8445 gives a planning example of 1.7 bits per second per user under its stated assumptions: one million users would require 1.7 megabits per second of STUN traffic. This is the RFC’s example, not a general measured rate or a current forecast. The RFC notes that TURN traffic is more substantial because it also carries relayed data. RFC 8445
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
