Interesting idea. It would seem that 'id' is effectively equivalent of (sport, dport), but 16 bits is a much smaller space than 32. But isn't the main problem

Interesting idea. It would seem that 'id' is effectively equivalent of (sport, dport), but 16 bits is a much smaller space than 32. But isn't the main problem with NAT punching that it requires activity on both ends to create a connection? Thus it always requires a coordination server to let node T (target) that node S (source) is trying to talk to it. You've got me thinking though. I wonder if there is a way to do this with ICMP routing messages - unreachable, TTL expired, etc. You can traceroute to some IP address, and get back packets from other arbitrary IP addresses, and this generally works through NAT. I'm envisioning a host T that wanted incoming connections to pick a random "dummy" IP address , publish (router IP, dummy IP) as its identity, and periodically send packets to the dummy IP address. Now a host S that wants to talk to T might be able to send an ICMP TTL-expired to T's router, pertaining to the dummy address. The router should see this and forward the packet to T. Of course this is contingent upon if IP addresses in ICMP fields are ingress policed the way the addresses in the IP header have become. (edit: hah. There is now a top-level comment pointing to an implementation of this idea)