NAT and stateful packet inspection (SPI) work with UDP similar to how they do with TCP, but depend a little more on heuristic timeouts because there is nothing

NAT and stateful packet inspection (SPI) work with UDP similar to how they do with TCP, but depend a little more on heuristic timeouts because there is nothing equivalent to TCP flags. Outbound packet 4-tuples (source IP, destination IP, source port,, destination port) are tracked and translated with NAT. For some heuristic amount of time after, if an incoming UDP packet is received matching the same 4-tuple it is let through and the translation is reversed. This is UDP "connection tracking", and the details are a little more complicated than described here but not a lot more. As with TCP, these are considered outbound connections because the initiating packet is outbound. There's no need for hole punching, which is a set of unreliable techniques to enable inbound connections. Firewalls and routers have supported NAT for UDP as long as they have for TCP in practice. They haven't supported NAT for other IP protocols such as native SCTP. This a major reason why QUIC is built on top of UDP, so outbound QUIC connections work already over most NAT routers, at home, at work and mobile.