6 ms·
Pwnat – Autonomous Nat Traversal (2010)
- jgeralnik 7y agoThe really cool part about this is that the server does not need to know the client's ip address. Instead a new original form of ICMP hole punching is used to allow any client to punch the NAT so that the server can dynamically learn the client ip, and then regular UDP hole punching is used.
- mempko 7y agoI'm sad that P2P never took off in the messaging world and now we are stuck with servers storing data even if it's E2E encrypted. I use NAT traversal for Firestr (http://firestr.com http://firestr.com) back in 2013 though this is still cool because of the ICMP hole punching. I'll have to see if I can incorporate that.
- imglorp 7y agoThere's some progress. See https://libp2p.io https://libp2p.io eg.
- toast0 7y agoP2P messaging is a hard sell, in my opinion for a couple of reasons: P2P requires knowledge of the peer's IP, which can be unwelcome depending on the messaging partner (and it's hard to make a config for do you trust this person enough to see your IP: yes, no, only if I'm on network X, not if I'm on network Y, etc) P2P requires both nodes to be online simultaneously, so it's difficult to make work well for asynchronous messaging with smart phones or mobile laptops or desktops that are regularly turned off. Maybe you remember how Skype used to be? So, I think you definitely want a server based store and forward messaging path to ensure delivery and for (optional) privacy from peers, and adding an optional P2P path is additional work, without a lot of gain; at least if it's text. When you start sending media, the bandwidth/storage savings from going P2P make it worth exploring.
- noname120 7y ago> This will work behind many NATs and firewalls, but not all. While this is an interesting concept, the hard part in NAT traversal is getting it to work on all the possible NAT types. In particular, I believe that this method doesn't work for symmetric NAT devices[1], which are widespread in corporate environments. It's not a surprise that this idea from 2010 didn't take off, ICE/TURN are still kings. [1] These devices assign a different port for each destination address, and this ICMP method doesn't help predict the port that will be assigned.
- jgeralnik 7y agoAs long as only one side of the connection is behind a corporate NAT you could simply try all 65535 ports until you find the one that works. The side behind the NAT would receive the packet and then be able to respond.
- noname120 7y agoAnd then you're blacklisted by the corporate firewall for doing what looks like port scanning.
- jacobush 7y agoAll 3 corporate firewalls I have been behind have been HTTP only. No actual internet connection. (Except for DNS, which worked.)
- imglorp 7y agoDNS working in a corporate IT environment is a surprise. Often, clients are issued an internal DNS server via DHCP, and outbound DNS to arbitrary servers is blocked. This helps mitigate DNS hijacking and also allows some additional outbound domain filtering and logging.
- jacobush 7y agoOh, yes, DNS is an internal DNS. You can't change it. I meant, it's the only way to "trickle leak" data without it going through the filtering proxy. But who knows, maybe the DNS requests are logged too, but they don't seem to be filtered. Edit: they are filtered. Suspicious names go to 127.0.0.1
- oriettaxx 7y agoI had a quick test, not working for me many previous comments about this script https://hn.algolia.com/?q=pwnat https://hn.algolia.com/?q=pwnat
- oriettaxx 7y agoah, I've got it, it's a pretty old code :)
- archergod 7y agoYou will have better luck with IPv6 if needed why bother for NAT traversing . IPv6 just works without it.
- big_chungus 7y agoOnly because IPv6 doesn't need NAT theoretically. In practice, most people are stuck using it because the router doesn't hand a public-facing IP to most clients. When building an application, you still need it.
- farisjarrah 7y agoSo is this a tool or an exploit? Or both? Is this something likely to get patched by the major software/hardware vendors? Would this be a tool that would be safe to use at home if I wanted to connect to a private network on AWS or GCP and did not want to poke a hole through my nat gateway at home?
- api 7y agoNAT is an ugly hack to extend IPv4 address space that breaks the internet. There are numerous ugly hacks for NAT traversal to fix what NAT breaks, all of which kind of seem like exploits, and some of which are effectively standardized in RFCs and used heavily for things like VoIP. The whole thing is a hideous mess that IPv6 will hopefully eventually kill.
- AnIdiotOnTheNet 7y ago> NAT is an ugly hack to extend IPv4 address space that breaks the internet Or to phrase it more generously, NAT is an ugly but simple hack that allowed the internet grow despite limited address space and without a gigantic investment in hardware to support an over-engineered replacement protocol.
- api 7y agoIt may have done that back when 128 bit addresses were actually expensive, but it also altered the evolution of that network from a more open peer to peer architecture to a closed silo mediated architecture. Things that should be simple and easy became complex and expensive. We are all poorer for it. You could say that instead of paying to upgrade we are paying for lost capabilities and technical debt.
- AnIdiotOnTheNet 7y agoI'm not sure that wouldn't have happened anyway, just with firewalls. ISPs were not above port blocking regardless.
- zerocool2750 7y agoI think you might have a typo in your FAQ. "Does the server have to specify the client host? No!..... The server does need to have any unique prior knowledge about the client. " Should that read, "The server does NOT need to have any unique...." ?
- armitron 7y agoThis is old technique from early 2000 and flawed as others have described. Outgoing ICMP is blocked in every corporate environment I have ever been to and never makes it to the Internet facing gateway.
- testvox 7y agoI'm on a large corporate network right now and I get responses back from `ping www.google.com`. But also this technique doesn't depend on ICMP that is just what the example happens to use. Pwnat itself uses only UDP for outgoing requests.
- armitron 7y agoICMP is used by the server in order to find out the IP of the client. Then they switch to UDP. This method does not work without ICMP. Now, of course you can use outgoing UDP in probe fashion instead of ICMP, but that's again most probably blocked.
- deleted 7y ago[deleted]
- hoppla 7y agoCool, I used to do this by spoofing udp packets from 3.3.3.3 from the client to the servers public up, but was unreliable due to anti spoofing filter. This way is better