4 ms·
The existence of PASV mode and STUN/TURN is because the end-to-end addressibility of the IP protocol was broken with CGNAT. Furthermore, in populous countries
by supriyo-biswas 3y ago
The existence of PASV mode and STUN/TURN is because the end-to-end addressibility of the IP protocol was broken with CGNAT.
Furthermore, in populous countries like India, ISPs enforce extremely aggressive timeouts on IPv4 connections in order to keep the 5-tuples on the egress side of things manageable. Trying to make a request that takes 10 seconds to process (like a user requesting a report consisting of multiple SQL queries)? You get a connection reset.
I must also must point out the HN guidelines because you bring a combative tone to this entire conversation which is not helping it.
> Be kind. Don't be snarky. Converse curiously; don't cross-examine.
- LegionMammal978 3y ago> The existence of PASV mode and STUN/TURN is because the end-to-end addressibility of the IP protocol was broken with CGNAT. But isn't all that still necessary as long as the typical user isn't going to be opening their firewall on those ports to arbitrary incoming connections? That's the whole point here.
- lxgr 3y agoSTUN (or something similar) yes (since you'll need to coordinate outbound traffic which creates the appropriate inbound rules), TURN no (since STUN will always succeed with stateful but non-translating firewalls). And STUN scales almost infinitely better than TURN.