iroh relays
Reach your devices,
wherever you are
iroh relays managed by NervesCloud so your devices stay reachable from behind carrier-grade NAT, mobile networks and factory firewalls. No VPN, no public IP, nothing to open on the router. Connections are end-to-end encrypted, and prefer a direct path whenever one exists.
Where they run
North America
us.iroh.nervescloud.com
Europe
eu.iroh.nervescloud.com
Asia Pacific
asia.iroh.nervescloud.com
Devices don't pick a region, they measure them and settles on the fastest, re-checking as the network changes. Only that one connection is held open; the others are contacted briefly when needed and dropped after a minute of being idle.
What a relay does
- Works behind any NAT
- Devices on mobile networks, hotel wifi or a customer's factory LAN stay reachable without an inbound port, a static address, or anything to configure on their router.
- End-to-end encrypted
- The QUIC session is established between the two endpoints. A relay forwards ciphertext it holds no keys for, so we cannot read your traffic even though it passes through us.
- A fallback, not a toll booth
- Endpoints try to hole punch first. The relay carries traffic while that is being established, and steps out of the path as soon as a direct route works.
- Closest region, automatically
- Each device measures the relays and holds a connection to the fastest, moving only when another is clearly better, so it does not flap between two that are close.
What it cannot do
A relay forwards encrypted packets between two endpoints that already know each other's public keys. It is not a chokepoint: once hole punching succeeds, traffic moves to a direct path and stops passing through the relay entirely. Anything you need enforced on every connection has to be enforced by the device, not by the relay.