2

I am now convinced that direct "UDP hole punching" between 2 people each of them behind a NAT, without a 3rd party server is really difficult / sometimes impossible (see question here and my answer below).

So, how to do a UDP hole punching with a 3rd party server?

Example:

peerA$ nc -u -p 7777 serverIP 8888

Now this packet is translated by peerA's NAT from localnetworkIP to peerApublicIP and the source port is translated from 7777 to 55123.

Now the server sees this packet arriving and remembers peerA's public IP + port 55123. It gives these information (peerA's public IP + 55123) to peerB, and vice versa (the similar process described before happens for peerB, and server remembers peerB's publicIP + source port that has been translated by peerB's NAT from 8888 to 42000).

Now peerA can do this

peerA$ nc -u -p 7777 peerBpublicIP 8888    # will be dropped by peerB but at least it will 
                                           # punch a hole in peerA's firewall, port 55123

and peerB knows that, to connect peerA, he has to use port destination 55123 (this info was given by server):

peerB$ nc -u -p 8888 peerApublicIP 55123

Question: this seems to work under the following assumption:

If

peerA$ nc -u -p 7777 serverIP 8888

gets its source port translated from 7777 to 55123, then

peerA$ nc -u -p 7777 peerBpublicIP 8888

Will also get source port 7777 translated to 55123.

But is this really true on most routers?

If not (example: when connecting to server, NAT translates 7777 to 55123, but when connecting to peerB, NAT translates 7777 to 51098), how is UDP hole punching working?

TL;DR: More generally, how to do an UDP hole punching with just netcat, involving peerA, peerB, and a server (the latter used only at the beginning, and not later)?

Note: I already read this article, but it's not obvious if the port translation is done in the same way when connecting server and then peerB.

Pablo A
  • 2,307
  • 1
  • 22
  • 34
Basj
  • 2,351
  • 9
  • 37
  • 70
  • If you're going to involve a third party, might as well use a $5 VPS and go through OpenVPN. Otherwise you'll just have to keep shooting at random ports until you find a match. Or see if you can disable this randomization in your router. If your ISP is forcing it due to shared IPv4, maybe you could go via IPv6? – frostschutz Feb 09 '18 at 02:00
  • Yes @frostschutz I already have a vps this part is ok. Let's say both peers are on a public WiFi hotspot (e.g. in a bar / cafe), so we don't habe access to NAT configuration, nor ipv6 access. – Basj Feb 09 '18 at 08:51
  • The [Wikipedia article](https://en.wikipedia.org/wiki/UDP_hole_punching) describes one UDP hole punching algorithm in detail. And [here](https://www.quora.com/What-are-the-differences-between-STUN-and-UDP-hole-punching) are some more well-known algorithms with names. – dirkt Feb 09 '18 at 14:33
  • @dirkt: I mentioned this article at the end of my question; my question is about something not really explained in that article. – Basj Feb 09 '18 at 15:11

0 Answers0