How do I force a direct connection in Remio?
Most homes already get a direct connection on the first session — Remio runs ICE negotiation with STUN candidates the moment two paired devices come online, and a direct UDP path forms automatically when NAT permits. When the HUD shows relay instead of direct, walk through four checks in order: confirm both devices share the same Wi-Fi SSID, disable AP isolation, forward one UDP port on the home router and enter that same port in Remio's Direct connection port setting, and add Remio Host to the macOS firewall allow-list. Each check rules out one common blocker.
What ports does Remio use for direct peer-to-peer?
By default, Remio's host listens on an automatic UDP port chosen fresh each session, so nothing needs to be forwarded for connections on the same network. To guarantee a direct connection from outside your home network, set a single UDP port — anything from 1024 to 65535, such as 50000 — in Remio's Direct connection port setting on a Mac host, and forward that one port on your router. There is no TCP fallback for media — Remio only uses UDP because TCP head-of-line blocking adds variable latency that is unacceptable for remote desktop. Forwarding a single port is safe because the host only accepts packets from a peer that completed DTLS-SRTP handshake with a paired client.
Is the relay connection less secure than direct?
No. Both paths use the same end-to-end encryption — keys are negotiated directly between your devices during pairing, anchored to the six-digit code shown on the host. The Cloudflare TURN relay sees only opaque encrypted bytes; it cannot decrypt the stream because it never receives the session keys. The only difference is latency: direct adds zero hops, relay adds one (the nearest Cloudflare edge), which costs 25 to 95 ms of round-trip time depending on geography.
Why does my Remio HUD say relay instead of direct?
ICE could not punch a direct UDP path between your client and host. The four most common reasons: the devices are on different networks (cellular on one side, home Wi-Fi on the other) so no LAN candidate exists; the home router blocks inbound UDP from the public internet; the cellular carrier uses carrier-grade NAT which hides the device behind a symmetric NAT incompatible with hole punching; or the local Wi-Fi (hotel, corporate, campus) deliberately blocks peer-to-peer traffic between clients.
Does Remio require port forwarding to work?
No — Remio works out of the box on every network. When NAT traversal fails, the session automatically falls back to a Cloudflare TURN relay that works through any router and firewall. Port forwarding is only needed when you want the lowest possible internet-path latency from outside your home network, and it improves direct-path connection success on routers that disable UPnP. On the same Wi-Fi network at home, no port forwarding is ever needed because the ICE local-LAN candidate connects directly.
