How Your iPhone Reaches Your Mac From Anywhere
Your Mac is behind a router and your iPhone is on a mobile network. Neither can dial the other. Here is the sequence that gets them talking, in the order it happens.
On the same network: Bonjour and one port
The Mac app listens on TCP port 51515 and announces itself over Bonjour as
_remotedesktop._tcp, with three small facts attached: a device ID, the Mac's name and the
protocol version. The iPhone browses for that service, so a Mac on the same Wi-Fi shows up under
Nearby without anyone typing an address.
The announcement is a hint and nothing more. Nothing security related is decided from it, because anybody on a network can announce anything. What matters is what happens next: the phone opens a TLS 1.3 connection, both sides present a certificate, and each checks the other's public key against the one it stored when you paired. How that pairing works is its own post.
On a home network the phone opens two connections: one for control (input, settings, the list of windows) and one that carries only the picture. Keeping video off the control stream means a big keyframe can never make a mouse click wait behind it.
Off the network: a relay that only introduces
Once you leave home, the phone cannot reach a private address behind your router, and the router will not accept a connection nobody asked for. So the Mac makes the first move, early. While it is running it keeps one outbound WebSocket open to Peering's relay and sends a small ping every 25 seconds. That open socket is the Mac's presence: it is how the relay knows the Mac exists and is awake.
When you tap your Mac on the iPhone, this happens:
- The phone asks the relay to connect to your Mac's device ID.
- The relay answers both ends with an address and a pair of random 16 byte tokens, one for control and one for video.
- Both devices open an outbound TCP connection to the relay and write their token first.
- The relay matches the two tokens and joins the sockets together, copying bytes from one to the other.
Then the phone starts the same TLS handshake it would use on a home network, and it runs straight through the relay to the Mac. The relay is a pipe, not a party to the conversation. It never holds a key. If you want the details of what it can and cannot learn, read what the relay can see.
The picture takes a shortcut
Relaying everything would work, but it is the slowest path and the most expensive one. So the picture does not stay on the TCP connection. It moves to UDP, which is better suited to video: a late frame is worth nothing, and retransmitting one only makes the next one later.
Each end also asks the relay a question: what address does the other side connect from? The relay answers with the address it observed, and both devices start sending small sealed probe packets to each other, every 250 milliseconds. Each probe opens a hole in the sender's own router, and when the two holes line up, a probe gets through and authenticates. From that moment the picture goes straight from the Mac to the iPhone and the relay is out of the video path.
This is the technique usually called hole punching. It works with most home routers and fails with some strict mobile and corporate ones, in which case the picture simply keeps flowing through the relay. Either way, you do not have to configure anything or open a port.
When UDP is blocked
Some networks drop UDP entirely. If no picture has arrived for three seconds while the control connection is still answering, the iPhone asks the Mac to send video over the control stream instead, chopped into chunks. It is capped at a lower bitrate, so it looks softer, but a soft picture beats a frozen one. The Mac keeps sending a keyframe on the fast path every few seconds, and when the phone sees that path recover it switches back.
Why it is built this way
- No inbound ports. Every connection is outbound, so there is no router setting to change and nothing exposed on the internet.
- No account. Devices are identified by keys they generate, not by a login. See pairing without an account.
- The cheap path first. Same network is free and unmetered. The relay carries only what a direct path cannot.
For the user-facing version of this, with the settings that keep a Mac reachable while you are out, see accessing your Mac from anywhere and keeping your Mac awake for remote access.
Questions
Do I need to open ports on my router to use Peering away from home?
No. Every connection is outbound. The Mac keeps one connection open to the relay, and both devices connect out to it, so nothing needs forwarding.
Does Peering use the relay for the whole session?
The relay joins the connection at the start. The picture then tries to go straight between your Mac and iPhone, and falls back to the relay when your network does not allow a direct path.