3 ms·

I suspect that what andreasvc meant is that the default "NAT" configuration of most consumer-grade gear is such that it will block UDP (unless some other mechan

I suspect that what andreasvc meant is that the default "NAT" configuration of most consumer-grade gear is such that it will block UDP (unless some other mechanism such as UPnP is used)...

noselasd 9y ago
But it doesn't. Consumer gear NATs UDP pretty much as nice as it does TCP.
- trav4225 9y ago
  Hmm, perhaps you are right... I switched from consumer gear to more "enterprise-y" gear a few years back, so my data points may be a bit outdated.
  - testvox 9y ago
    I've been using normal consumer routers for NATed home connects since 2004 or so and I've never had an issue with outgoing UDP. It's required for basically every video game after all.
lmns 9y ago
That's true for TCP as well. Almost all consumer-grade routers block all incoming connection attempts, not just UDP. From a stateful firewall's point of view both UDP and TCP have state.
- trav4225 9y ago
  Right. I was assuming that the context here was connections being initiated by the client (as most are).
  - kelnos 9y ago
    ... in which case blocking is not an issue. Consumer-grade NAT hardware will no more block client-initiated UDP than it'll block client-initiated TCP, at least not without extra configuration.
  - deleted 9y ago
    [deleted]
da_chicken 9y ago
If NAT blocked UDP, the DNS client on home computers would never work.
- icebraining 9y ago
  I think most routers set themselves as the DNS server, so NAT is not in effect (the computer only sends the request to a local address) unless you define a custom DNS server, which isn't common for home users. That said, I've never seen a router that didn't allow UDP packets to flow back to the origin client.
  - da_chicken 9y ago
    > I think most routers set themselves as the DNS server DNS forwarders like dnsmasq are a relatively recent inclusion in home routers. Sure, they've been there for 10 years or so, but they weren't there for the 5+ years before that. Before Linux took over the embedded OS on home routers, the DHCP servers just passed the DNS configuration that the WAN port got from the ISP, and you can still do that now if you want. That's why nslookup.exe and dig still work on your workstation when you specify an external DNS server instead of the one your DHCP server on your home router gives you. > That said, I've never seen a router that didn't allow UDP packets to flow back to the origin client. Which is the point I was making.
johncolanduoni 9y ago
Most consumer-grade gear can easily handle two-sided NAT transversal with merely a STUN server (no UPnP or relaying required).

I suspect that what andreasvc meant is that the default "NAT" configuration of most consumer-grade gear is such that it will block UDP (unless some other mechanism such as UPnP is used)...

noselasd 9y ago

But it doesn't. Consumer gear NATs UDP pretty much as nice as it does TCP.

trav4225 9y ago
Hmm, perhaps you are right... I switched from consumer gear to more "enterprise-y" gear a few years back, so my data points may be a bit outdated.
- testvox 9y ago
  I've been using normal consumer routers for NATed home connects since 2004 or so and I've never had an issue with outgoing UDP. It's required for basically every video game after all.

lmns 9y ago

That's true for TCP as well. Almost all consumer-grade routers block all incoming connection attempts, not just UDP. From a stateful firewall's point of view both UDP and TCP have state.

trav4225 9y ago
Right. I was assuming that the context here was connections being initiated by the client (as most are).
- kelnos 9y ago
  ... in which case blocking is not an issue. Consumer-grade NAT hardware will no more block client-initiated UDP than it'll block client-initiated TCP, at least not without extra configuration.
- deleted 9y ago
  [deleted]

da_chicken 9y ago

If NAT blocked UDP, the DNS client on home computers would never work.

icebraining 9y ago
I think most routers set themselves as the DNS server, so NAT is not in effect (the computer only sends the request to a local address) unless you define a custom DNS server, which isn't common for home users. That said, I've never seen a router that didn't allow UDP packets to flow back to the origin client.
- da_chicken 9y ago
  > I think most routers set themselves as the DNS server DNS forwarders like dnsmasq are a relatively recent inclusion in home routers. Sure, they've been there for 10 years or so, but they weren't there for the 5+ years before that. Before Linux took over the embedded OS on home routers, the DHCP servers just passed the DNS configuration that the WAN port got from the ISP, and you can still do that now if you want. That's why nslookup.exe and dig still work on your workstation when you specify an external DNS server instead of the one your DHCP server on your home router gives you. > That said, I've never seen a router that didn't allow UDP packets to flow back to the origin client. Which is the point I was making.

johncolanduoni 9y ago

Most consumer-grade gear can easily handle two-sided NAT transversal with merely a STUN server (no UPnP or relaying required).