I thought STUN uses UDP packets, as the name suggests (Simple Traversal of User Datagram Protocol (UDP) through Network Address Translators), as well as standardized port numbers. I thought you could filter its traffic based on protocol and port number.

Enterprise routers sometimes allow only 80/tcp and 443/tcp egress traffic.

That’s why sometimes Tailscale falls back to relaying, which is pretty slow (unless in the future they deploy large number of relay servers around the world).