4 ms·

I'm still not sure I follow you regarding how the above applies to my situation. I believe in your case, you mean to say that A is a local machine and B is a re

by rufugee 11y ago

I'm still not sure I follow you regarding how the above applies to my situation. I believe in your case, you mean to say that A is a local machine and B is a remote machine, and if they're complicit together, allowing A to connect outbound to B then allows B to communicate back to A, which could allow the two of them to do things you really don't want. However, if I have the cameras on a completely separate subnet and network interface on the firewall and block communication from this subnet to my regular lan and to the outside world, I should be immune to this, correct? A is in my DMZ, and can't communicate with the outside world based on my firewall rules, so A would never reach B.

dimman 11y ago
If the device can't communicate outbound then no you're completely safe. There's no magic into this, hole punching is just a silly name for a simple technique. Hole punching works when both A and B are behind NAT. It also allows B to contact A if A is behind a NAT (no matter if B is behind one or not). If both A and B have public IP's then the hole punching is "already done", they can already connect to eachother.