4 ms·
Needing to punch holes in NAT is one of the most idiotic own-goals in the entire field of networking. NAT is effectively your router doing DHCP with a 17-bit s
by Veserv 7mo ago
Needing to punch holes in NAT is one of the most idiotic own-goals in the entire field of networking.
NAT is effectively your router doing DHCP with a 17-bit suffix (16-bit port + 1 bit for UDP vs TCP) to each of your applications and then not telling you the address it gave you or how long it is good for (which is what a regular DHCP lease does). This is in addition to it, most likely, already doing regular DHCP and allocating you a IP address that it does tell you about, but which is basically worthless since routing to just that prefix without the hidden suffix goes into a black hole.
If you could just ask your router for a lease on a chunk of IP+NAT addresses that you could allocate to your applications and rotate them as they expire, you would not need this horrifying mess.
The router would just need to maintain the last-leg routing table (what a concept, a router doing routing with routing tables) just like it already does DHCP.
The applications would have short-term stable addresses that they could just tell their peers and just directly tell the router/firewall to block anybody except the desired peer short-term address.
- eptcyka 7mo agoWhy not use plain IPv6 instead?
- cbdevidal 7mo agoV6 adoption has reached 46.82%[1]. So it is increasingly viable for this. [1] https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
- TuxPowered 7mo agoEven with IPv6 you still might have stateful firewalls allowing only for outbound connection at both ends (e.g. a CPE a.k.a. “WiFi router”) and to establish communication you’d need to punch a hole in those firewalls.
- brewmarche 7mo agoThat’s true we won’t get rid of hole-punching with IPv6. But at least it will get rid of TURN.
- gzread 7mo agoThe hole punching is so much simpler because you don't need to guess your own address and port - you just know it
- ranger_danger 7mo agoDoesn't that assume that your machine is given its own world-routable (and unfiltered) v6 address?
- gzread 7mo agoThat's how it works in ipv6. If your network doesn't give you an address, it's broken. We do not assume unfiltered since we are talking about hole punching.
- brewmarche 7mo agoIPv6 still allows proper NAT (prefix translation), but even then finding your global address wouldn’t need TURN, just STUN, actually not even that, just a service like “What’s My IP.”
- gzread 7mo agoIt does allow it in the sense that it's possible, and even useful in some scenarios, but then you're on a weird experimental network and not a normal one.
- brewmarche 7mo agoYes, you are right, quite literally, as RFC 6296 is marked ‘experimental.’
- 7mo ago
- takipsizad 7mo agoit's been already done ISPs just don't properly implement it (NAT-PMP and it's relatives)
- lxgr 7mo ago> If you could just ask your router for a lease on a chunk of IP+NAT addresses The “just” is doing a lot of lifting there. I’m glad the various port mapping protocols didn’t really take off and it looks like IPv6 is going to actually make it instead. Much less complexity in most parts of the stack and network.
- Veserv 7mo agoIt is always a mystery how people just randomly misinterpret what I write. At literally no point did I mention port mapping. I am pointing out how the problem NAT “solves” is just dynamic address configuration. They have implemented a N+K bit address where the N-bit prefix is routed and allocated using IP and the low K-bits are routed and allocated like a custom fever dream. You can just do it all the same way instead of doing it differently and worse for the low bits. To be clear, the router should rewrite zero bits in the packet under the scheme I am describing just like how routers have no need to rewrite any bits when routing to a specific globally-routable IP address. You get a lease for a /N+K address. /N routes to your router which routes the last K bits just like normal as if it had a /N-M to a /N route. This is a generic description of homogenous hierarchical routing.
- GoblinSlayer 7mo agoNAT allocates ports. If you reserve a port, that's old good port forwarding.
- lxgr 7mo agoIf I understand it correctly, you're suggesting formalizing a way to make parts of the (host-specific) port canonically part of the network-wide address, no? This still sounds like a very bad mixing of layers, even if done in a perfectly standardized and uniform way. > It is always a mystery how people just randomly misinterpret what I write. If this is intended literally and not as a general complaint: My main problem of understanding your suggestion is that I don't know what you mean by "IP+NAT address". NAT is a translation scheme, not an address. Maybe it would be clearer if you could provide an example?
- littlestymaar 7mo agoHole punching is doing exactly what you describe, just in a non-standardized way. We could have a standard for doing that directly at the NAT box level instead of relying on a third party STUN server, it simply didn't happen (and in fairness, the benefits would be quite minimal).
- jeroenhd 7mo agoIf only router manufacturers could be trusted to implement UPnP safely, then none I'd this bullshit would be necessary. At least with IPv6 this crap becomes a little easier because you no longer have randomized source ports (which this article just ignores because some devices indeed maintain the same source port) and the IP address contains all the routing information you need. A simple simultaneous open is all you need.
- gzread 7mo agoIf you use UDP transport you don't even need to try to make it simultaneous.