4 ms·
Makes it hard to do hole punching I think? At any rate, direct connections currently cannot be established between multi-hop peers, traffic gets routed through
by blurbleblurble 2y ago
Makes it hard to do hole punching I think? At any rate, direct connections currently cannot be established between multi-hop peers, traffic gets routed through peers instead. I think this has something to do with the TCP choice.
- foundry27 2y agoYeaaah. TCP hole punching is goofy and unreliable, last I checked. You have to do some arcane ritual of having both peers start a three-way handshake to each others’s public endpoints simultaneously, relying on NATs to accept inbound SYN packets if they match the outgoing SYN. And nobody’s NAT devices implement simultaneous-open the same way, so all your connections just fail. Naturally this leads to slapping even more arcane fixes on top of that, like NAT port assignment oracles to adversarial interoperate with different port allocation strategies (random, sequential, single, etc.) by analyzing patterns in previous port assignments. Networking sucks.
- beeflet 2y agohttps://xkcd.com/2044/ https://xkcd.com/2044/
- paulddraper 2y agoActuate
- ionspin 2y agoI presume you meant to say "Accurate", but it made me think of a off-brand Picard that says "Actuate" instead of "Engage".
- gtirloni 2y agoIf the new technology referenced in the comic provides a way to securely connect, including auditing, I don't see how it applies to the hole punching hack.
- beeflet 2y agoPeople (like ISPs offering routers) set up NAT, often justifying it on the basis of security. Application developers use hole-punching techniques to get past NAT (including stuff like UPnP that requires cooperation from the NAT). The end product is: #1 A sandboxing system that cannot reliably sandbox. #2 A connection system that cannot reliably connect. So now you have two problems.
- dev_hugepages 2y agoNAT is not a security measure but a way to save on IP space or avoid remaking a topology on network addresses changes. For actual security you need a firewall
- Karrot_Kream 2y agoI think this is a pragmatic choice. NAT Hole Punching can be hit or miss no matter the method but doing peer routing guarantees even a client that can only initiate outbound connections can route packets. It can be slow though. I also know there's support for other transports like QUIC but TCP is the main default.
- AyyEye 2y ago> At any rate, direct connections currently cannot be established between multi-hop peers, traffic gets routed through peers instead. I think this has something to do with the TCP choice. Yggdrasil is designed for physical links and multi-hop routing first and foremost. Internet peering is just a way to test/use/join the network until then.
- blurbleblurble 2y agoI'd love if my private nodes could peer directly so I wouldn't need to route all traffic through my budget VPs.
- wolletd 2y agoIf only there was some technology that would allow every peer to have its globally unique address, making direct connections only a matter of firewalls. I don't know, something like IPv4, but with more addresses...
- dinosaurdynasty 2y agoBoth tailscale (partially open source) and nebula (entirely open source, you have to host the "lighthouses" which assist in NAT punching yourself) do this. (Also tinc.) Yggdrasil is basically researching a replacement for BGP, so hole punching isn't a priority. (There is a 3rd party project that does something like this for Yggdrasil, but nebula is probably the better fully open source option.)
- AyyEye 2y agoOn ygg as long as the nodes are reachable they can peer. If your nodes are on LAN just turn on multicast peering it's fire and forget.