2 ms·
> and afaict, inexplicably, vendors listened That got a good laugh out of me. That idea sounds really clever, but even if NATs wouldn't mangle the ICMP reply,
by iforgotpassword 6y ago
> and afaict, inexplicably, vendors listened
That got a good laugh out of me.
That idea sounds really clever, but even if NATs wouldn't mangle the ICMP reply, don't you need elevated privileges to receive it in your application? And I wouldn't be too surprised if a bunch of devices would just drop it entirely.
Another thing that just came to my mind: Do any of those hard NATs assign the outgoing port in a predictable pattern for some inexplicable reason? I'd guess no, since those already seem to be security focused and not randomizing the port sounds stupid, but you never know... Would be a cool last resort for hard/hard.
- dave_universetf 6y ago"it depends". There used to be NATs that did linear allocation or some other weird schemes (e.g. linear, but matching the lower bit of the WAN port to the LAN port, for reasons to do with SIP weirdness). These days, due to the misguided narrative that NATs are security devices, random port selection dominates. Certainly it does in linux (which accounts for most home routers), and all the commercial vendors (Juniper, Cisco, etc.). Some of the latter might let you configure it if you have esoteric needs, I haven't dug into that. Tailscale just assumes that port allocation is random.