My firewall reports outgoing connection attempts via com.apple.WebKit.Networking to a number of STUN servers (namely, stun.nas.net, stun.node4.co.uk, stun.voxox.com and stun.wwdl.net). This is requested by the Safari (Apple's browser) process. From what I can see STUN servers are required for VoIP connections. I found a brief run-down on STUN here, with more detail on the relevant Wikipedia page.

I don't run any VoIP services from my iMac (at least not knowingly). The only app that'd come to mind are maybe some conferencing software I once installed and Skype.

So far, I have not accepted the connections and haven't discovered any detrimental effects, but I'm wondering what might have been the initial trigger for the connection attempt.

3 Answers 3


STUN (Session Traversal Utilities for NAT) is a mean for a device which sits behind a NAT firewall to learn the public IP address of the Internet connections which is beding natted. I.e. your laptop may have been assigned a "private" IP address as per RFC 1918, for example Any software on your laptop asking the operating system "What is my IP address" will get as an answer, which isn't helpful for applications which try to use protocols that were simply made without NAT in mind.

The NAT unfriendliness of protocols usually kicks in whenever a client connects to a server and is supposed to tell the server its own IP address in order for the server to be able to initiate connections to the client (as opposed to just sending answer packets on the same IP connection; this is handled by NAT routers.

STUN is a means for a client to learn the public IP address of the NAT router through which the connection is natted in order to use that information when registering with a server that wants to call back now or later.

The 95% use case indeed is VoIP telephony, especially SIP.

If you found that the STUN requests originate from the Safari process, it cannot be either Skype or any other conferencing software, as that would typically spawn a separate process.

STUN (and TURN) might be used by Safari for WebRTC connections; though that should only happen while you are using any such sites, i.e. video chats in the browser.

Otherwise - to answer your original question - there is

  1. no reason to allow those connections unless you intentially use any services which need them and

  2. I would want to find out what piece of code (browser plugins?) try and make those connections

It may turn out it's something you just did not think about. But it may also turn out to be something harmful.

  • Thanks. Could it be Google Talk from within Gmail? Sep 4, 2018 at 8:05
  • Yes,I think so, according to wiki.unify.com/wiki/STUN. Quote: "An example of a well-known VoIP application that uses STUN is Google Talk, which interoperates with STUN servers situated in Google's datacenters."
    – TorstenS
    Sep 4, 2018 at 11:12
  • I suspect these are some sort of tracking/fingerprinting -- besides the google ones, I also routinely see connection attempts to online-metrix dot net (usually while visiting what turns out to be a sketchy site).
    – jhfrontz
    Jan 9, 2020 at 2:21

OLD thread; new information.

BAD news for stun servers. I just located this website.

while searching for an answer to whether I should allows some of the STUN NAT TRAVERSAL hits snort is getting. Currently all blocked. After reviewing the website I decided that the odd issue cause when my wife and I are BOTH using our cell providers VoIP service while at home was something we could put up with.


Yes stun server are completely secure and the connections are encrypted. STUN servers are used to show the client that is behind a NAT or Multiple NATs what its own public IP and port number is, so that peer to peer connection is made possible.

There is nothing else that is shared with the STUN server and as such they are not much of a security concern To learn more about STUN servers and how the STUN protocol works refer to this article STUN server

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .