Hacker News Reader

Comment by blahgeek | Hacker News Reader

Is it common for routers to create a new mapping for TCP packets that is NOT SYN (in figure 3 in this article)? Is there a legit use case for this behavior? Wouldn't it be simpler and more secure not to do that?

View on HN

T̶a̶i̶l̶s̶c̶a̶l̶e̶: https://tailscale.com/blog/how-nat-traversal-works

Libp2p: https://docs.libp2p.io/concepts/nat/hole-punching/

B̶o̶t̶h̶ (update: Only Libp2p works with TCP) use similar method for hold-punching. Libp2p can use such method for establishing direct connection between hosts behind different NAT networks.

The tailscale one at least isn't TCP, it's UDP

My bad, I forget about this.

im pretty sure any router that uses fast path does this.

its meant to speed up connections and allow for more throughput through a router.

Connection tracking != fast path flow tracking in a lot of cases.

well yeah but one of the main reasons for a different path after a syn packet is fast path behavior.

fast path changes the packet flow so it doesn't get processed by all firewall rules.

just explaining the use case for OPs question.

The legit use case is to pick up connections that were established before the router reboot.

If the router reboots, it cannot remember the correct mapping of the last connection, right? (The mapped port may not be the original source port)

That's why port preservation is the usual behavior.

(edited) Correct, this pickup of ports from the ACKs that the internal host keeps resending only works if the externally mapped port didn't change from the default (same as internal).

wouldn't it also work for connections established on another router that then failed or otherwise had traffic shift to it?

The answer to this might be severely unsettling

Reply on news.ycombinator.com