Iroh: Dial by Public Key, with Automatic Hole-Punching and QUIC
If you've ever tried to connect two devices directly over the internet without a central server, you know the pain. Firewalls, NATs, and port forwarding setups make it feel like you're trying to lockpick your own router just to send a packet.
Iroh is an open-source Rust library that flips that script. Instead of dialing by IP address, you dial by public key. It handles the hard parts—hole-punching through NATs, multiplexing connections with QUIC, and encrypting everything—so you can focus on building peer-to-peer apps without the networking headache.
What It Does
Iroh is a library for building peer-to-peer connections over the internet. At its core, it lets one device "dial" another using only its public key. No IP addresses needed. No server in the middle (though it does use a lightweight relay to help punch holes or bounce traffic when direct connections fail).
Under the hood, Iroh wraps QUIC (the same transport protocol used by HTTP/3) with automatic NAT traversal. When two peers want to talk, Iroh attempts a direct connection using UDP hole-punching. If that doesn't work (some NATs are stubborn), it gracefully falls back to a relay. The result: a secure, low-latency connection that feels like you're on the same local network.
Why It's Cool
The key innovation here isn't just hole-punching—lots of tools do that. It's the dial-by-public-key model combined with QUIC. Here's why that matters:
- No infrastructure headaches. You don't need a DNS server, a static IP, or a reverse proxy. Your app identifies peers by their cryptographic identity. It's like SSH, but for generic data streams.
- Automatic fallback. The relay is there when you need it, fast direct connection when you don't. Your code doesn't care which path is used—Iroh handles the handshake.
- Built-in encryption. QUIC enforces TLS-level security by default. Your data is encrypted end-to-end without you thinking about it.
- Multiplexing. Need multiple streams? QUIC's built-in stream multiplexing means you can send chat messages, files, and video calls over the same connection, each with its own priority.
Use cases are all over: file sync tools (like a distributed Dropbox), LAN-like gaming without a server, IoT device setup, or even just a simpler alternative to WebRTC for custom protocols.
How to Try It
Clone the repo or add the crate to your Cargo.toml:
[dependencies]
iroh = "0.3" # check for latest version
The repo has a full examples/ directory. The simplest one is hello—two peers that exchange a message using their public keys:
# Terminal 1: run a relay (or use the public one)
cargo run --example relay
# Terminal 2: run the hello example (it shows the other peer's key)
cargo run --example hello
For a more practical demo, check out the sync example which transfers files between two machines. Just install Rust, run the relay, and follow the printed instructions.
Final Thoughts
Iroh feels like one of those "why didn't this exist before?" tools. It takes a genuinely difficult problem (p2p networking on the modern internet), wraps it in a clean Rust API, and gives you a solid foundation for building decentralized apps.
If you're tired of wrangling STUN/TURN servers or just want to experiment with peer-to-peer ideas without drowning in networking code, give it a spin. It's early days, but the design is thoughtful and the QUIC implementation (based on quinn) is battle-tested.
Found this hidden gem? We share open-source projects like Iroh every day.
@githubprojects