3 ms·
> Many home routers try to preserve the source port in external mappings. This is a property called “equal delta mapping” – it won’t work on all routers but for
by EnigmaCurry 7mo ago
> Many home routers try to preserve the source port in external mappings. This is a property called “equal delta mapping” – it won’t work on all routers but for our algorithm we’re sacrificing coverage for simplicity.
It is precisely this point that has flummoxed me when connecting my p2p wireguard config[1] with a friend that uses a pfsense router, no matter what we tried, pfsense always chooses a random source port.
But in the simple case this blog outlines, if both ends use the same source port, this method punches through 2 firewalls effortlessly:
[1] https://blog.rymcg.tech/blog/linux/wireguard_p2p/ https://blog.rymcg.tech/blog/linux/wireguard_p2p/
- jonathanlydall 7mo agoDoes your friend setting up port forwarding on their pfSense not help in your scenario?
- EnigmaCurry 7mo agoYes, that solves it completely. But the exercise we were trying to do was to do it without that.
- hdgvhicv 7mo agoYou’re getting into birthday paradox territory, throw a few hundred packets in each direction and one will get through This hs a good diagram to understand the options https://rajsinghtech.github.io/claude-diagrams/diagrams/network/tailscale-nat-traversal-fallback/ https://rajsinghtech.github.io/claude-diagrams/diagrams/netw...
- patjensen 7mo agoThis is easily solved in your source NAT configuration on pfSense. It's a single checkbox to not randomize ports on outbound flows. This will enable full cone NAT. You can scope it to just your IPsec service, or whatever it is your hosting, or you can enable full cone for the whole subnet. It is not DNAT, nor is it port forwarding. If you host a SIP proxy, SBC or peer to peer gaming, it will enable these use cases as well. https://docs.netgate.com/pfsense/en/latest/nat/outbound.html https://docs.netgate.com/pfsense/en/latest/nat/outbound.html
- getcrunk 7mo ago[flagged]
- lxgr 7mo agoDid you validate this solution yourself?
- getcrunk 7mo agoNo, hence the all caps ai disclaimer. But seems plausible
- nneonneo 7mo agoLord, we're how many years into using LLMs, and people still don't understand that their whole shtick is to produce the most plausible output - not the most correct output? The most plausible output might be correct, or it might be utter bullshit hallucinations that only sound correct; the only way to tell is to actually try it or cross-reference primary sources. Unless you do, the AI answer is worthless. The reason why they're getting so good at code now is that they can check their output by running and testing it; if you're just prompting questions into a chatbot and then copying their output verbatim to a comment, you're not adding any meaningful value.
- anovikov 7mo agoExactly! This is what LLMs do: they bullshit you by coming across as extremely knowledgeable, but as soon as you understand 5% of the topic you realise you've been blatantly lied to.
- lxgr 7mo agoEven if you get 70% blatant lies and 30% helpful ideas, if you can cheaply distinguish the two due to domain expertise, is that not still an extremely useful tool? But to the point of this thread: If you can't validate their output at all, why would you choose to share it? This was even recently added to this site's guidelines, I believe.
- hdgvhicv 7mo agoIn my experience, Cisco ASA does source port persistence by default (when it can’t do it then it falls back to random), fortigates can do it (in various ways depending on version, although fallback method in the map-ports doesn’t work), juniper SRXs can’t, unless you guarentee a 1:1 map.