Deploy an optional probe
One Go binary for TCP and UDP discovery on the same port.
When you need it
Workers cannot listen on raw UDP/TCP probe sockets. Public UDP STUN works by default. To add your own mapping discovery or cover unreachable public probes, run reignhub-probe on a public server.
The probe returns address mappings only. It does not store a device directory, run agents, serve Web pages or relay application traffic. You can deploy the Worker without it.
Build and run
Use the Go version in go.mod, or Linux amd64/arm64 probe artifacts when available:
go build -o reignhub-probe ./cmd/reignhub-probe
./reignhub-probe --listen :26330Allow both in the server firewall and cloud security group:
| Port | Protocol | Purpose |
|---|---|---|
| 26330 | UDP | STUN Binding / mapped-address discovery |
| 26330 | TCP | Native TCP probe and hole-punch candidates |
An ordinary Nginx HTTP proxy cannot forward these protocols. Use DNS only for the probe hostname, without Cloudflare's HTTP proxy.
Publish endpoints from the Worker
Set Worker variables and redeploy:
SELF_STUN=stun:probe.example.com:26330
TCP_STUN=probe.example.com:26330Clients still configure only the Worker HTTPS URL. /p2p/config publishes these endpoints.
Public and self-hosted STUN run in parallel to find a direct path. Browsers have no raw TCP API; TCP probing is primarily for native clients.
Limits
Symmetric NAT, carrier networks and enterprise firewalls may still block hole punching. A probe does not guarantee direct access. When direct access is unavailable, the Worker encrypted WebSocket relay provides a fallback path.