3 ms·
> It's a good primer. It's also more complicated than that. Subjective, but I think primer is an understatement. Tailscale did an absolute stellar job of simpl
by klabb3 3y ago
> It's a good primer. It's also more complicated than that.
Subjective, but I think primer is an understatement. Tailscale did an absolute stellar job of simplifying the problem to something that works very well in practice, and is relatively simple to implement.
> NAT mappings can change (your router can reboot etc). So you have to be ready to 'try again' dynamically.
Yes, this is a big issue and indeed a source of a lot of stateful complicated logic in the tailscale client and anyone else who attempts it. And that’s aside from the absolute clusterfuck that is UPnP – super complicated for what it does. In my view it’s not enough bang for the buck; if STUN won’t work (some mobile carriers and enterprise networks) then port-mapping protocols probably won’t work either. You gotta cut your losses somewhere.
> The STUN server can see one port number, but a different one may be used by your gateway for talking to the real desired endpoint.
The post covers this in detail. They call it endpoint-dependent mapping.
- anyfoo 3y ago> > NAT mappings can change (your router can reboot etc). So you have to be ready to 'try again' dynamically. > Yes, this is a big issue [...] You gotta cut your losses somewhere. And the article also gets into that, in detail. It appears that tailscale not only dynamically retries, they also test out all possible paths to switch to the best one.
- dave_universetf 3y agoWe do. This is also not our own insight/invention, to be clear. We're implementing the spiritual core (but not the SIP clothing) of the ICE protocol (https://datatracker.ietf.org/doc/html/rfc8445 https://datatracker.ietf.org/doc/html/rfc8445), which was developed by Google and the XMPP foundation as part of Jingle, the XMPP extension for p2p voice and video. That same stuff lives on in browsers today as part of WebRTC. ICE in particular provides a model for probing potentially feasible datapaths, selecting the best if multiple paths are available, and suggests how to handle datapath failure. It's not a weekend's worth of hacking to get it working robustly, but it's also very doable.
- anyfoo 3y agoThanks for your article. I’m not even currently working on any network-related stuff, and I found it very interesting and enlightening to read.
- kortilla 3y ago> if STUN won’t work (some mobile carriers and enterprise networks) then port-mapping protocols probably won’t work either This is a bad conclusion. STUN dies on endpoint dependent mappings and proper port mapping setups are specifically to allow this. The oversubscription enabled by endpoint dependent mapping is drastically higher if you have the memory to run it. The correlation between modes and support for the protocols does not work in the way you think.
- klabb3 3y agoApologies for the confusion. I did not know about this type of setup. I am aware of the oversubscription problem but didn’t know it was being mitigated in any way. Do you have examples on environments that use PMPs in such a way? And if so, which PMPs? (I’m asking because if I can avoid UPnP and use the other more sane protocols, it’d still be a win)