5 ms·

Is it common for routers to create a new mapping for TCP packets that is NOT SYN (in figure 3 in this article)? Is there a legit use case for this behavior? Wou

Is it common for routers to create a new mapping for TCP packets that is NOT SYN (in figure 3 in this article)? Is there a legit use case for this behavior? Wouldn't it be simpler and more secure not to do that?

ytch 2y ago
T̶a̶i̶l̶s̶c̶a̶l̶e̶: https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works Libp2p: https://docs.libp2p.io/concepts/nat/hole-punching/ https://docs.libp2p.io/concepts/nat/hole-punching/ B̶o̶t̶h̶ (update: Only Libp2p works with TCP) use similar method for hold-punching. Libp2p can use such method for establishing direct connection between hosts behind different NAT networks.
- mkj 2y ago
  The tailscale one at least isn't TCP, it's UDP
  - ytch 2y ago
    My bad, I forget about this.
damsalor 2y ago
The answer to this might be severely unsettling
patrakov 2y ago
The legit use case is to pick up connections that were established before the router reboot.
- blahgeek 2y ago
  If the router reboots, it cannot remember the correct mapping of the last connection, right? (The mapped port may not be the original source port)
  - patrakov 2y ago
    (edited) Correct, this pickup of ports from the ACKs that the internal host keeps resending only works if the externally mapped port didn't change from the default (same as internal).
  - r1ch 2y ago
    That's why port preservation is the usual behavior.
- semi 2y ago
  wouldn't it also work for connections established on another router that then failed or otherwise had traffic shift to it?
Wheaties466 2y ago
im pretty sure any router that uses fast path does this. its meant to speed up connections and allow for more throughput through a router.
- xxpor 2y ago
  Connection tracking != fast path flow tracking in a lot of cases.
  - Wheaties466 2y ago
    well yeah but one of the main reasons for a different path after a syn packet is fast path behavior. fast path changes the packet flow so it doesn't get processed by all firewall rules. just explaining the use case for OPs question.

ytch 2y ago

T̶a̶i̶l̶s̶c̶a̶l̶e̶: https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works Libp2p: https://docs.libp2p.io/concepts/nat/hole-punching/ https://docs.libp2p.io/concepts/nat/hole-punching/ B̶o̶t̶h̶ (update: Only Libp2p works with TCP) use similar method for hold-punching. Libp2p can use such method for establishing direct connection between hosts behind different NAT networks.

mkj 2y ago
The tailscale one at least isn't TCP, it's UDP
- ytch 2y ago
  My bad, I forget about this.

damsalor 2y ago

The answer to this might be severely unsettling

patrakov 2y ago

The legit use case is to pick up connections that were established before the router reboot.

blahgeek 2y ago
If the router reboots, it cannot remember the correct mapping of the last connection, right? (The mapped port may not be the original source port)
- patrakov 2y ago
  (edited) Correct, this pickup of ports from the ACKs that the internal host keeps resending only works if the externally mapped port didn't change from the default (same as internal).
- r1ch 2y ago
  That's why port preservation is the usual behavior.
semi 2y ago
wouldn't it also work for connections established on another router that then failed or otherwise had traffic shift to it?

Wheaties466 2y ago

im pretty sure any router that uses fast path does this. its meant to speed up connections and allow for more throughput through a router.

xxpor 2y ago
Connection tracking != fast path flow tracking in a lot of cases.
- Wheaties466 2y ago
  well yeah but one of the main reasons for a different path after a syn packet is fast path behavior. fast path changes the packet flow so it doesn't get processed by all firewall rules. just explaining the use case for OPs question.