Which type of NAT does STUN typically not work across?

STUN, which stands for Session Traversal Utilities for NAT, is designed to enable clients behind Network Address Translation (NAT) to discover their public IP address and the type of NAT they are behind. It is particularly effective for certain types of NAT, but not all.

Symmetric NAT creates a mapping between a client's private IP address and a public IP address that varies based on the destination IP address. This means that when a client sends packets to different addresses, the NAT device translates the packets using a unique public port for each destination address. As a result, when a client behind a symmetric NAT tries to communicate with others, it cannot simply use the information relayed by STUN, as the mappings are not consistent. Therefore, since STUN relies on consistent mapping, it struggles with symmetric NAT scenarios, making it ineffective in this case.

On the other hand, Full-cone NAT, Port-restricted NAT, and Restrictive NAT generally allow for better compatibility with STUN. These types maintain more predictable mappings, which STUN can leverage to determine the public-facing address and port for the client, thus enabling successful connection establishment with other peers.