I have 2 sites (call them "A" and "B") which connect to the Internet using 4G mobile data routers - don't knock them, I'm getting 200Mbps downlink and 30Mbps uplink, faster than a lot of ADSL providers! I want to set up a site-to-site VPN between them but neither site can "call" the other because they both have 10-dot-something private IP addresses on the mobile operator's internal network and when they break out to the Internet it's through a NAT gateway, so there's nothing to call back in on.

I have a 3rd site (call it "H" - my home!) which has regular landline broadband and a static IP address which is DNS'ed, so I could connect both sites A and B to a VPN server hosted at H. However, this (I think) means all the traffic will be going A <-> H <-> B, putting a lot of latency between A and B and hammering my home internet connection into the bargain.

The question is, is there a way to establish a connection directly between A and B, perhaps using H as a rendezvous point, that leaves all the live traffic going directly A <-> B without going anywhere near H?

  • 2
    You'll need an external rendezvous point with enough bandwidth for the intended traffic. This could be your home, but residential services usually suck for this (and likely ToS prohibit it.) There are external VPN services that might be worth a look.
    – Ricky
    Aug 16, 2022 at 23:00
  • 3
    See Also: STUN and TURN (in general devices behind NATs cannot directly reach each other)
    – Ricky
    Aug 16, 2022 at 23:04
  • 1
    Definitely don't want the rendezvous point to be a full-time proxy à la SOCKS - if it's someone else's then they're gonna want money to pass all my traffic! STUN and TURN are better ideas, and maybe this is how to leverage them, using their VPN-over-UDP configuration - softether.org
    – kbro
    Aug 16, 2022 at 23:11
  • 3
    You could, of course, look into IPv6. All the mobile providers use it.
    – Ron Maupin
    Aug 16, 2022 at 23:16
  • @RonMaupin good shout - I’ve never found a need for IPv6 before but I think you could be right!
    – kbro
    Aug 17, 2022 at 6:13

1 Answer 1


Mostly just summarizing from the very useful comments: there are a few basic options, varying in performance, resilience and cost.

External rendezvous server

The rendezvous server accepts connections from both sites and relays between them (spoke-hub style).

  1. commercial VPN service - large variations in pricing, reliability - note that routing private traffic requires a great deal of trust!
  2. externally hosted server - possibly the cheapest approach, but requires regular maintenance

NAT traversal

Options like STUN or TURN may be possible with your ISP. However, unless you've got a rigid SLA, these options may vanish at any time, depending on any configuration changes and updates happening at the ISP which you likely won't be aware of.


Should be supported by any mobile ISP. Possibly the cheapest, most reliable (no extra parts) and best performing approach.

  • 1
    Rendezvous server fails to meet my stipulation of having a point-to-point connection between the two sites, which is reason I asked the question in the first place. UDP hole-punching looks possible - SoftEther VPN (softether.org) has a UDP mode that exploits this technique. IPv6 sounds the most promising - I need to get onto something like www.whatismyipaddress.com from the remote sites to see if they're exposing an IPv6 address, then I should be able to use that in my Ubiquiti router to set up a site-to-site VPN. Watch this space!
    – kbro
    Aug 18, 2022 at 3:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.