Iroh's 90% Direct-Connection Figure Comes From a Tunnel Vendor's Blog, and n0's 1.0 Post Gives No Rate

Iroh, the Rust library from n0 that lets two devices connect by public key instead of IP address, has shipped three minor releases since 1.0 on June 15. A 90% direct-connection rate attached to it does not appear in n0's own 1.0 post.

What iroh 1.0 promises

Iroh gives each device an Ed25519 keypair and treats the public key as its address. Code dials an endpoint ID, tries a direct QUIC connection through the network address translation (NAT) box in front of the device, and falls back to a relay server when that fails. The repository, n0-computer/iroh, is Apache-2.0 licensed and had 12,743 stars and 181 open issues on October 17.

In practice, a phone and a home server each hold a keypair. The server's operator copies its public key to the phone once, by QR code or config file. After that the phone connects to that key wherever the server sits, and the home router's changing IP address stops being the phone's problem. Iroh 1.0 also added QUIC multipath, which lets a connection move between Wi-Fi and cellular, according to Pinggy.

Rüdiger Klaehn wrote in The road to iroh 1.0, published July 9, that "Iroh 1.0 just means that the wire format and API are stable." The post says iroh is already running in production on "hundreds of thousands of devices".

Where the 90% figure comes from

On hole punching, n0's post says only that "In most normal circumstances we punched holes almost immediately", and that the approach follows Tailscale's design. It gives no success rate and no relay count.

The numbers come from a Pinggy blog post dated June 18. Pinggy sells tunnels for exposing local ports, and the post recommends one for inbound web traffic, which iroh does not provide. It says direct QUIC hole punching succeeds about 90% of the time and that about 95% of data volume travels over direct connections. It puts libp2p's hole-punch rate at around 70% in practice.

None of the three figures is attributed to a measurement in the post as fetched. The same post also gives two scale numbers that do not match: over 200 million endpoint connections per month in its introduction, and more than 200 million endpoints created in the last 30 days later on. Those are different units, and neither fits n0's own "hundreds of thousands of devices".

Claim	Who made it	Date
About 90% direct hole punch	Pinggy	June 18
About 95% of volume direct	Pinggy	June 18
libp2p around 70%	Pinggy	June 18
Hundreds of thousands of devices	n0 (Klaehn)	July 9

The 1.x releases so far

The stable wire format has not meant a frozen changelog. The GitHub releases page lists these.

Version	Date	Notable change
1.0.0	June 15	"Dial keys, not IPs"
1.0.2	July 6	Relay rate-limit feature
1.1.0	August 25	Relay metrics; one change marked breaking
1.2.0	September 11	New DNS resolver, old nameserver builders deprecated
1.3.0	September 28	Batch datagram APIs; rustls bump for RUSTSEC-2026-0285

The breaking entry in 1.1.0 is a fix so that CustomAddr "serializes the same as a Vec", tracked as pull request 4465. The changelog does not say whether that touches the wire format.

What iroh does not do

Klaehn's post lists what 1.0 leaves out. Post-quantum signatures are unsupported because large public keys would break deriving endpoint IDs from keys, though post-quantum key exchange is available. Encrypted ClientHello is not implemented, so the protocol name is visible to an observer on the path. Configurable key algorithms such as P-256 are ruled out for now.

Pinggy adds a practical limit: iroh connects known peers, so an app still needs a way to share keys, such as a QR code, a config file or a pairing flow. It is a library to embed, not a hosted service.

Read together with Forgejo 17.0, whose webhook change needs manual migration, the 1.1.0 entry is a reminder to read minor-version changelogs on any stable-API dependency. For self-hosters, the Codeberg Pages v2 shutoff on December 31 is the other dated change to plan around.

The next release to read is the first one after 1.3.0. n0 had not published a relay-fallback rate in its 1.0 post, and 1.1.0 is the release that added relay metrics.