I got kind of curious how UDP works with CGNAT, and in my travels I found this on the Wikipedia page [1]: > STUN does not work with symmetric NAT (also known a

I got kind of curious how UDP works with CGNAT, and in my travels I found this on the Wikipedia page [1]: > STUN does not work with symmetric NAT (also known as bi-directional NAT) which is often found in the networks of large companies. Since the IP address of the STUN server is different from that of the endpoint, in the symmetric NAT case, the NAT mapping will be different for the STUN server than for an endpoint. TURN offers better results with symmetric NAT. Not sure if that's related or if you're even having issues, but figured I'd drop it since I found it. As for the privacy aspect, are you CGNAT'ed? My understanding is that bidirectional UDP streams generally don't work with CGNAT unless your ISP adds a proxying service that can construct "sessions" out of those packets. E.g. for DNS, you can proxy it across the CGNAT by having the DNS proxy record the transaction ID and the internal IP/port that requested it, and then looking for that txid in UDP packets coming to the DNS relay to forward it. The solution I usually see for getting UDP across CGNAT is TURN, but then you're making a TCP connection which can be tracked by port easily. I just can't see any way for an ISP to proxy UDP packets without knowing which subscriber they're going to. It seems like trying to make a router route without any routing tables; I just don't see how your ISP can forward that packet to you without knowing it's going to you. [1]: https://en.wikipedia.org/wiki/STUN https://en.wikipedia.org/wiki/STUN