3 ms·
Author here. You are correct, the challenge in an easy/hard pair is the stateful firewall built into the easy side. Even thought the _NAT_ is easy (we can disco
by dave_universetf 6y ago
Author here. You are correct, the challenge in an easy/hard pair is the stateful firewall built into the easy side. Even thought the _NAT_ is easy (we can discover our public ip:port), the firewall still wants to see transmissions to/from the correct ip:port on the hard side in order to let the traffic through. The hard side defeats that by not letting us discover what the correct ip:port should be, so we can't punch through the firewall component.
So, we're left with two options: make one of the NATs vanish via the port-mapping protocols, or use the birthday paradox to find a usable ip:port in reasonable time.
- iforgotpassword 6y agoThanks to both of you. So it would only work the way I assumed if the easy one is that full cone type that doesn't have a firewall at all.
- dave_universetf 6y agoYup, exactly right. In the article, I tried to call those "trivial" NATs, because from a NAT traversal POV they might as well not exist. You do need to do a tiny bit of work to get them up and running, but once that's done, you effectively have an open port on the internet that anyone can connect to.