How BitTorrent Connects When Only One Peer Has Open Port

In the BitTorrent protocol, establishing a direct connection between two peers requires only one peer to have an open, accessible port. This article explains how asymmetric connection initiation, stateful Network Address Translation (NAT), and the full-duplex nature of transport protocols allow a peer behind a strict firewall to successfully upload to and download from an unfirewalled peer.

Peer Discovery

To initiate a transfer, peers must first learn about each other’s network addresses. This discovery happens through three primary mechanisms:

• Trackers: Centralized servers that maintain lists of active peers (IP addresses and listening ports) in a swarm.
• Distributed Hash Table (DHT): A decentralized routing system (such as Kademlia) where nodes store and retrieve peer contact information.
• Peer Exchange (PEX): A protocol extension allowing connected peers to directly share lists of other peers they are currently connected to.

Through these systems, a firewalled peer (Peer A) discovers the public IP address and listening port of a reachable peer (Peer B).

Outbound Connection Initiation

Standard residential routers and firewalls block unsolicited inbound connection requests, meaning Peer B cannot initiate a connection to Peer A. However, most network firewalls permit outbound traffic initiated by internal devices.

Because Peer B has a forwarded or public port, Peer A initiates an outbound TCP (or uTP via UDP) connection to Peer B’s IP address and open port. Because the connection is outbound from Peer A’s perspective, Peer A’s firewall allows the request to leave the local network.

Stateful NAT Tracking

When Peer A sends the initial packet (such as a TCP SYN) outward:

1. Peer A’s local router assigns an ephemeral source port and logs the connection in its state table.
2. The router tracks the destination (Peer B’s IP and port).
3. When Peer B responds (e.g., TCP SYN-ACK), the router recognizes the incoming packets as a direct reply to the session initiated by Peer A.
4. The router forwards these return packets through to Peer A.

Bidirectional BitTorrent Communication

Once the transport layer handshake is complete, a full-duplex virtual circuit is established. Even though Peer A initiated the connection outward, the single established socket allows simultaneous two-way communication:

• BitTorrent Handshake: Both peers exchange the standard BitTorrent protocol handshake to verify the info-hash of the torrent and their respective peer IDs.
• Piece Exchange: Both peers exchange have messages, request blocks of data, and send piece payloads.

Peer A can download data from Peer B, and Peer B can download data from Peer A across this single connection. As long as one peer has a reachable port to accept the initial connection request, a complete bidirectional data transfer takes place.