logoalt Hacker News

aboardRat4today at 3:42 PM1 replyview on HN

The standard way to do it is called ipv6. Implementing it is probably easier than any of those RFCs


Replies

patrakovtoday at 4:28 PM

No, it isn't. Many middleboxes (including OpenWrt by default) drop unsolicited inbound TCP connections even on IPv6, and therefore the same hole-punching algorithm is needed. The hole being punched is in the stateful firewall's connection tracker, not in the NAT. Basically, both parties need to convince their router that it is an outgoing connection initiated by them, not a prohibited-by-policy incoming connection.

show 2 replies