How do I force a direct connection in Remio?

Most homes already get a direct connection on the first session — Remio runs ICE negotiation with STUN candidates the moment two paired devices come online, and a direct UDP path forms automatically when NAT permits. When the HUD shows relay instead of direct, walk through four checks in order: confirm both devices share the same Wi-Fi SSID, disable AP isolation, open UDP 49152–65535 on the home router, and add Remio Host to the macOS firewall allow-list. Each check rules out one common blocker.

What ports does Remio use for direct peer-to-peer?

Remio uses UDP ephemeral ports in the IANA-defined range 49152–65535 for media streaming. The host listens on a randomly chosen port each session and the ICE candidate exchange tells the client which port to send to. There is no TCP fallback for media — Remio only uses UDP because TCP head-of-line blocking adds variable latency that is unacceptable for remote desktop. Forwarding the whole 49152–65535 range to the host's local IP is safe because the host only accepts packets from a peer that completed DTLS-SRTP handshake with a paired client.

Is the relay connection less secure than direct?

No. Both paths use the same end-to-end encryption — DTLS-SRTP with AES-256-GCM, keys negotiated via ECDHE on Curve25519, anchored to the six-digit one-time PIN exchanged at pairing. The Cloudflare TURN relay sees only opaque encrypted bytes; it cannot decrypt the stream because it never receives the session keys. The only difference is latency: direct adds zero hops, relay adds one (the nearest Cloudflare edge), which costs 25 to 95 ms of round-trip time depending on geography.

Why does my Remio HUD say relay instead of direct?

ICE could not punch a direct UDP path between your client and host. The four most common reasons: the devices are on different networks (cellular on one side, home Wi-Fi on the other) so no LAN candidate exists; the home router blocks inbound UDP from the public internet; the cellular carrier uses carrier-grade NAT which hides the device behind a symmetric NAT incompatible with hole punching; or the local Wi-Fi (hotel, corporate, campus) deliberately blocks peer-to-peer traffic between clients.

Does Remio require port forwarding to work?

No — Remio works out of the box on every network. When NAT traversal fails, the session automatically falls back to a Cloudflare TURN relay that works through any router and firewall. Port forwarding is only needed when you want the lowest possible internet-path latency from outside your home network, and it improves direct-path connection success on routers that disable UPnP. On the same Wi-Fi network at home, no port forwarding is ever needed because the ICE local-LAN candidate connects directly.

Direct P2P Connection Guide — Sub-5ms LAN

One destination, two paths in.

Every Remio session takes one of two routes between your client and your host. The direct path is device-to-device — sub-5 ms on the same network, glass-to-glass, no server in the middle. The relay path goes through the nearest encrypted relay edge — 30 to 100 ms round-trip, same end-to-end encryption, no decryption at the relay. Most homes get direct automatically; when they do not, four small fixes usually fix it.

Guide 01 — Why am I on relay

Diagnose the connection type

Remio shows the active path in the streaming HUD. A "relay" label means Remio could not open a direct path between your devices. Usually one of four things is to blame.

Devices are on different networks — cellular on one side, home Wi-Fi on the other.
Router firewall blocks inbound traffic from the public internet.
Mobile carrier networks sometimes hide your device behind layers of routing that block direct paths.
Corporate, hotel, or campus Wi-Fi explicitly blocks direct device-to-device traffic.

Guide 02 — Same Wi-Fi network

Confirm both devices share the LAN

Same network is the easiest path to direct — Remio finds the local route first and skips public-internet probing entirely. If your HUD still says relay, walk through these checks.

01Confirm both devices are joined to the same Wi-Fi network. On iOS, Settings → Wi-Fi. On macOS, System Settings → Network.
02If you run a mesh router (eero, Google Nest, Deco, ASUS AiMesh), make sure both devices are on the same network name — some meshes split 2.4 GHz and 5 GHz into separate networks.
03Disable AP isolation in your router admin if the option exists. AP isolation explicitly forbids device-to-device traffic on the same Wi-Fi.
04Disconnect and reconnect in Remio. The next session picks up the local route.

Guest networks on many routers (Verizon, Xfinity, ASUS) isolate clients by default. Pair Remio host and client on the main SSID instead.

Guide 03 — Across the internet

Open a UDP path on your home router

Connecting from outside your home network — cellular, a friend's Wi-Fi, a coffee shop — means your home router has to accept inbound traffic for the host. Most consumer routers do this automatically. When they do not, you can open the port range manually.

01Find your host Mac's local IP in System Settings → Network. It usually looks like 192.168.1.100 or 10.0.0.42.
02Open your router admin page in a browser. The address is usually 192.168.1.1 or 192.168.0.1; check the sticker on the router for the default login.
03Find the Port Forwarding (sometimes "Virtual Server" or "Pinholes") section.
04Forward UDP ports 49152–65535 to your Mac's local IP. Leave TCP alone — Remio only uses UDP for streaming.
05Save the rule, reboot the router if asked, and reconnect in Remio. The HUD should switch from "relay" to "direct" within a few seconds.

Ports to forward

UDP 49152 – 65535 Remio streaming — encrypted video and audio

Remio picks random high ports each session. Forwarding the whole range is safe — the host listens only when a paired client is connecting, and traffic is end-to-end encrypted.

Guide 04 — Local firewall

Allow Remio Host through macOS firewall

macOS firewall (off by default since Ventura, on by default if you turned it on) can silently drop inbound traffic from your client. Adding Remio Host to the allow-list takes thirty seconds.

01Open System Settings → Network → Firewall. If the firewall is off, you can stop here — nothing is being blocked.
02Click Options… (or "Firewall Options" on older macOS).
03Add Remio Host to the list. The app lives in /Applications/Remio Host.app.
04Make sure "Allow incoming connections" is checked for Remio Host. Save.

Ready to go direct.

Install Remio on the computer you want to reach and on the device you want to reach it from. Pair with a six-digit one-time PIN. The streaming HUD will tell you which path you got — direct or relay.

macOS, iOS, iPadOS, Windows, and Android. Free during launch.

One destination, two paths in.

One endpoint pair, two parallel paths.

Same encryption, different speed.

Direct connection

Encrypted relay connection

How to force a direct path.

Diagnose the connection type

Confirm both devices share the LAN

Open a UDP path on your home router

Allow Remio Host through macOS firewall

Ready to go direct.