5 ms·

This does not break DNS, HTTP/3, whatever. It does not affect outgoing connections at all, only incoming connections from the WAN to your router.

by iqanq 5y ago

mulmen 5y ago
I'd tell you the joke about UDP but you might not get it.
- leokennis 5y ago
  Or that joke about TCP: 1: Do you want to hear a joke about TCP? 2: Yes I do want to hear it. 1: I confirm you want to hear it. 1: I am now going to tell the joke. 2: I acknowledge you are now going to tell the joke. 1: I will now start the first sentence of the joke. 2: I acknowledge I am now ready to hear the first sentence of the joke. 1: So a network packet walks into a bar 2: Sorry I couldn't quite here you. Please start over. 1: Do you want to hear a joke about TCP?
  - CPLX 5y ago
    I’ve always wanted to add an HTTP joke to these sorts of networking humor threads but the prospect makes me feel mildly insecure.
    - jordanrobinson 5y ago
      Perhaps you should go with an HTTPS one instead then.
      - JAlexoid 5y ago
        Do we start with a handshake then?
chrismorgan 5y ago
Sure, you can send a DNS query, but how do you propose to receive the response? The response is an incoming connection from the WAN to your router. (UDP doesn’t do sessions, remember.) (I dunno, I’m not a network engineer, perhaps routers ignore the port forwarding and keep doing their normal NAT stuff in cases like this, but I would expect them not to because… well, you told them you wanted all the ports to go to a certain place, and nothing says UDP has to symmetrical anyway, maybe you honestly do only want tot send UDP from other machines and not receive it.)
- xeyownt 5y ago
  So, you are sure this is a mind-bogglingly stupid advice, but in fact you don't know ?
- foxfluff 5y ago
  > (UDP doesn’t do sessions, remember.) Operating systems do. You can associate remote & local port-ip tuples with UDP just as much as you can with TCP.
  - zaarn 5y ago
    And the router has a clue about those UDP "sessions"? They're not sessions either, it's just an application declaring that incoming UDP packets with a certain destination port (and optionally destination IP, source IP or source Port) be delivered to it. Nothing about sessions.
    - foxfluff 5y ago
      If you send from local ip/port X to remote ip/port Y, your router will see both pairs. The router has no problem sending responses back your way after it has stored the tuple, assuming you're receiving responses on the same port you sent from. UDP connection tracking is nothing new at all. If you haven't sent anything at all, then you're not a normal client, you're a server and need port forwarding anyway (or you're ftp and should be shot).
hyperman1 5y ago
They are talking about UDP, which is connectionless. There are just packets, going in or out. So you can send a DNS request, but the response will go to the switch, not to you.
- kazen44 5y ago
  modern firewalls do however match on tuple in their session table. Sure, the protocol is connectionless, that doesn't mean a firewall can't reason about which side the traffic is originating from in its session table.
  - notimetorelax 5y ago
    True, those instructions are for those users for whom UPNP failed.
    - jaywalk 5y ago
      That's not a UPnP feature, it's NAT.
  - oarsinsync 5y ago
    Which is arguably a security issue if things do work as you've described. Scenario A: I've forwarded anything sent to UDP/80 to 192.168.1.20. You're on 192.168.1.30 and you send a packet to 10.20.30.40:50 using UDP, source port 80. An incoming packet from 10.20.30.40:50 now goes where? 192.168.1.20:80 or 192.168.1.30:80? What stops me at 192.168.1.30:80 sending out packets to every IP, flooding the connection state table and effectively DoSing 192.168.1.20:80 without ever touching it? ...or should the connection actually go to 192.168.1.20:80 always, because that's what I've statically defined for all traffic on UDP/80 to do? I guess the question is: which should take precendence, the dynamic session table, or the static configuration?
    - deleted 5y ago
      [deleted]
qalmakka 5y ago
If all ephemeral ports (1024-65535) are forwarded to the Nintendo Switch, it means that the NAT gateway can't allocate ports for the other devices that require to send or receive something on UDP. Also, even if "it did only affect incoming connections", where do you expect to receive your reply if all UDP traffic is redirected to the Switch?

This does not break DNS, HTTP/3, whatever. It does not affect outgoing connections at all, only incoming connections from the WAN to your router.

by iqanq 5y ago

This does not break DNS, HTTP/3, whatever. It does not affect outgoing connections at all, only incoming connections from the WAN to your router.

mulmen 5y ago

I'd tell you the joke about UDP but you might not get it.

leokennis 5y ago
Or that joke about TCP: 1: Do you want to hear a joke about TCP? 2: Yes I do want to hear it. 1: I confirm you want to hear it. 1: I am now going to tell the joke. 2: I acknowledge you are now going to tell the joke. 1: I will now start the first sentence of the joke. 2: I acknowledge I am now ready to hear the first sentence of the joke. 1: So a network packet walks into a bar 2: Sorry I couldn't quite here you. Please start over. 1: Do you want to hear a joke about TCP?
- CPLX 5y ago
  I’ve always wanted to add an HTTP joke to these sorts of networking humor threads but the prospect makes me feel mildly insecure.
  - jordanrobinson 5y ago
    Perhaps you should go with an HTTPS one instead then.
    - JAlexoid 5y ago
      Do we start with a handshake then?

chrismorgan 5y ago

Sure, you can send a DNS query, but how do you propose to receive the response? The response is an incoming connection from the WAN to your router. (UDP doesn’t do sessions, remember.) (I dunno, I’m not a network engineer, perhaps routers ignore the port forwarding and keep doing their normal NAT stuff in cases like this, but I would expect them not to because… well, you told them you wanted all the ports to go to a certain place, and nothing says UDP has to symmetrical anyway, maybe you honestly do only want tot send UDP from other machines and not receive it.)

xeyownt 5y ago
So, you are sure this is a mind-bogglingly stupid advice, but in fact you don't know ?
foxfluff 5y ago
> (UDP doesn’t do sessions, remember.) Operating systems do. You can associate remote & local port-ip tuples with UDP just as much as you can with TCP.
- zaarn 5y ago
  And the router has a clue about those UDP "sessions"? They're not sessions either, it's just an application declaring that incoming UDP packets with a certain destination port (and optionally destination IP, source IP or source Port) be delivered to it. Nothing about sessions.
  - foxfluff 5y ago
    If you send from local ip/port X to remote ip/port Y, your router will see both pairs. The router has no problem sending responses back your way after it has stored the tuple, assuming you're receiving responses on the same port you sent from. UDP connection tracking is nothing new at all. If you haven't sent anything at all, then you're not a normal client, you're a server and need port forwarding anyway (or you're ftp and should be shot).

hyperman1 5y ago

They are talking about UDP, which is connectionless. There are just packets, going in or out. So you can send a DNS request, but the response will go to the switch, not to you.

kazen44 5y ago
modern firewalls do however match on tuple in their session table. Sure, the protocol is connectionless, that doesn't mean a firewall can't reason about which side the traffic is originating from in its session table.
- notimetorelax 5y ago
  True, those instructions are for those users for whom UPNP failed.
  - jaywalk 5y ago
    That's not a UPnP feature, it's NAT.
- oarsinsync 5y ago
  Which is arguably a security issue if things do work as you've described. Scenario A: I've forwarded anything sent to UDP/80 to 192.168.1.20. You're on 192.168.1.30 and you send a packet to 10.20.30.40:50 using UDP, source port 80. An incoming packet from 10.20.30.40:50 now goes where? 192.168.1.20:80 or 192.168.1.30:80? What stops me at 192.168.1.30:80 sending out packets to every IP, flooding the connection state table and effectively DoSing 192.168.1.20:80 without ever touching it? ...or should the connection actually go to 192.168.1.20:80 always, because that's what I've statically defined for all traffic on UDP/80 to do? I guess the question is: which should take precendence, the dynamic session table, or the static configuration?
  - deleted 5y ago
    [deleted]

qalmakka 5y ago

If all ephemeral ports (1024-65535) are forwarded to the Nintendo Switch, it means that the NAT gateway can't allocate ports for the other devices that require to send or receive something on UDP. Also, even if "it did only affect incoming connections", where do you expect to receive your reply if all UDP traffic is redirected to the Switch?