0

Let's say my IP is 198.51.100.27 and my friend's IP is 203.0.113.11. We both are connected to internet behind a standard consumer ISP router.

How can we send a few bytes to each other without using a 3rd party server? (and without having to do router port forwarding configuration)

I've heard about netcat or ncat but I'm not sure how I could use it to send "hello world" to my friend, and how he would see this message in his terminal

Should he do:

ncat -C 198.51.100.27 80     # this IP is mine

and me:

ncat -l 203.0.113.11 80 < echo "hello world"      # this IP is my friend's IP

?

I'm even not sure if netcat / ncat is the right tool for this. I also looked at chownat / pwnat but I couldn't figure out how to use it in such a simple example: just sending / receiving "hello world".

Notes:

  • I don't want to connect to my friend's computer via SSH or SFTP. I just want to send him "hello world" or send short text messages to each other.

  • I don't have a precise goal other than just understanding how bytes can be sent directly peer-to-peer without a centralized server. So if I can just send him one or two bytes, such that he sees them in his console, that will be fine!

Basj
  • 2,351
  • 9
  • 37
  • 70
  • If both are being NATs, the easiest solution is a 3rd party relay; that is others have been doing for decades. This is not a Linux problem per se. – Rui F Ribeiro Jan 29 '18 at 03:07
  • @RuiFRibeiro can you give an example about how to do this with Linux commands? (It's ok with a 3rd party relay during initialization but after init I'd like direct peer to peer connection). – Basj Jan 29 '18 at 08:31

3 Answers3

0

Basically, running nc -l -p $port on one host, and nc $ipaddr $port for an appropriate value of $ipaddr and some value of $port would be enough. But that requires any firewalls between the machines don't block the connection.

You mentioned you're "both behind a standard consumer ISP router", which usually implies some sort NAT, which means that the machines behind the routers don't have public IP addresses, and so you can't connect directly to the hosts, but would have to configure port forwarding on the router.

In addition, there's the question of your ISP allowing the connection, too. Depending on a number of things, you might not be able to receive TCP connections in a run-of-the-mill consumer connection.

As for the redirection and echo, you need either echo "message" | nc ... to pipe the output of another command to nc, or nc ... <<< "message" to direct a string directly to nc. (That's not a feature of standard sh)

ilkkachu
  • 133,243
  • 15
  • 236
  • 397
  • Thank you for your answer! That's right, our machines don't have public IP. So probably the router wouldn't know to which computer connected to the router (I have 2 or 3 devices connected to router) the packets must be transmitted... I'm looking for solutions without router configuration. Is your `nc` solution like that? I heard there were solutions without port forwarding on router, like chownat / pwnat. How to do that? – Basj Jan 28 '18 at 17:15
  • PS: what do you mean by `Without configuring some port forwarding to the router, that is.`? (that is *possible* or *not possible*?). `so you connect directly to them`: to the routers or the machines? – Basj Jan 28 '18 at 17:19
  • @Basj, I meant that you can't connect directly. Since the NATted addresses the hosts have, aren't valid to the outside world. So you would have to configure port forwarding, or use an external host where you could both connect to. – ilkkachu Jan 28 '18 at 17:24
  • Wouldn't chownat or pwnat allow to do this? – Basj Jan 28 '18 at 17:37
0

The "client" needs to use the "servers" public IP (find a whatismyip site), and agree on a port number to be "port forwarded" by the router of whom is playing "server". The server doesn't need to know the clients public IP, unless he wants to protect himself and only accept connections from that specific client.

Gerard H. Pille
  • 2,350
  • 9
  • 13
  • I hope you're wrong, or I'll feel even more unsafe when my systems are connected to the internet. – Gerard H. Pille Jan 28 '18 at 18:36
  • @GerardH.Pille Could you give an example of code `nc ...`? I have tried extensively to implement what you said, but it didn't work. – Basj Dec 04 '18 at 21:09
0

What you're probably looking for is called TCP Hole Punching.

You can do this when you don't have any control over the NAT router (not even port fowarding) at the condition you use a 3rd party broker to synchronize the communication and your NAT is a simple NAT, not a "Carrier Grade NAT", including thus not altering seen ports, only IPs (everything becomes more difficult else). The broker can be anything, even a real phone call, but of course automation would require something specialized. The role of the broker is to synchronize actions as well as letting both peers know their public IPs. A STUN server might be part of an automatic solution.

The basic principle is that TCP as initially defined in RFC 793 allows either the usual SYN , SYN/ACK , ACK triple handcheck, or also to do simultaneous SYN+SYN, simultaneous SYN+ACK and ACK (see previous link, figure 8). While doing this, both NAT routers will open the "return flow" of the TCP connection.

Caveat: communications should be synchronized (possibly with NTP), or a RST will be sent by the slower peer's NAT router and might close the "hole" on the other NAT router. This isn't a problem if the router drops packets instead of sending back a RST. Many home NAT routers just drop those packets so there's no issue then.

So an example to be done: 198.51.100.27's owner A phones to 203.0.113.11's owner B and they agree that at a given time, after having checked their IPs using online sites ("What is my IP" ...) and using netcat traditional version,

A will type:

nc -p 7777 203.0.113.11 8888

B will simultaneously type:

nc -p 8888 198.51.100.27 7777

What will happen is that each user will see a single established TCP connection, the same connection.

A is now free to type "hello world", which will be read by B.

I actually made a similar answer on stackoverflow, with perhaps more details, but it was never checked as a solution: https://stackoverflow.com/questions/39545461/tcp-based-hole-punching/39581596#39581596

Instead of using netcat, socat should be prefered because it can more easily integrate with anything else for automation.

Community
  • 1
A.B
  • 31,762
  • 2
  • 62
  • 101
  • The method described here works *in some cases*, but generally **it won't work** [for the reason described here](https://unix.stackexchange.com/a/421993/59989). – Basj Feb 05 '18 at 10:25
  • read my answer: "and your NAT is a simple NAT, not a "Carrier Grade NAT", including thus not altering seen ports, only IPs". Nothing new – A.B Feb 05 '18 at 22:37