If a Teredo relay (or another Teredo client) has to send an IPv6 packet to a Teredo client, it will first send a "Teredo bubble" packet to the client's Teredo server, whose IP address can be inferred from the Teredo IPv6 address of the Teredo client.