P2P mode
Turn on P2P mode. Screen Ferry finds the faster route.
Every session establishes through the encrypted relay first. P2P mode then qualifies a direct path between your Macs and activates it when it wins—without opening inbound ports and without giving up relay fallback.
Why turn it on?
Fewer network hops. Lower round-trip time. Video off the relay.
A direct path can shorten the distance between Host and Client, lower the delay on every input round trip, and keep the session's highest-bandwidth traffic between your Macs.
You do not trade reachability for speed. The session is already working before direct qualification starts, and the validated relay stays ready after the upgrade.
The connection sequence
Direct is proven, measured, and authenticated.
sequenceDiagram participant H as Screen Ferry Host participant R as Screen Ferry Relay participant C as Screen Ferry Client H->>R: Outbound QUIC datagram leg C->>R: Outbound QUIC datagram leg H->>C: Mutually authenticated key exchange C->>H: Encrypted session confirmed H->>C: Encrypted candidate batch C->>H: Encrypted candidate batch H-->>C: Outward UDP simultaneous-open C-->>H: Outward UDP simultaneous-open H->>C: Authenticated path challenge C->>H: Authenticated path response H->>C: Median-of-three RTT qualification Note over H,C: Qualified direct path becomes active Note over H,R: Relay remains validated fallback
- Both Macs dial outward. Host and Client establish QUIC datagram legs to the Screen Ferry relay. No router port is opened or forwarded.
- The encrypted session comes first. Devices authenticate, bind to the brokered session, and establish endpoint traffic keys before P2P coordination begins.
- Candidates travel inside encryption. Network candidates are exchanged through the established end-to-end encrypted session rather than a separate clear signaling channel.
- Both sides send outward UDP. Simultaneous-open creates NAT mappings from the inside. Multiple candidates can be gathered as network conditions change.
- The peer proves the path. Sealed challenge-response validates reachability in both directions using the session's cryptographic material.
- Screen Ferry measures the route. A median-of-three RTT comparison tests the candidate against the active relay route with a configured margin.
- The qualified path activates. Session traffic moves onto the direct carrier without rebuilding the remote desktop session.
- The relay remains ready. The validated relay route is refreshed as standby and can take the session back if the direct route degrades.
No port forwarding
Outbound from both ends.
Screen Ferry never asks you to publish an inbound service on either Mac. Relay connectivity and direct-path discovery both begin with outward connections.
If a network permits the direct path and it qualifies, Screen Ferry uses it. If it does not, the established relay continues carrying the session. Either way, you remain connected.
One session, two possible carriers
Direct is an upgrade—not a second connection.
The remote desktop is already active before direct qualification begins. When a direct path wins, the same encrypted session moves onto it; if that path stops qualifying, the validated relay can carry the session again.