Re:NAT-to-NAT direct connections with no proxy/STUN needed
by latitude on Sunday March 28, 2010 @05:21PM
(#1225253)
The trick with priming NAT for receiving bogus inbound TTL-Exceeded ICMP packets is really clever. However keep in mind that this method assumes that:
(a) the client knows server's external ("Internet") IP
(b) there is exactly one server behind the NAT device
Latter is obviously quite limiting unless the "3.3.3.3" changes for every server and the client learns it together with server's external IP. This in turn means that the client still needs to communicate with some 3rd party, so this method only partly alleviates the need for the 3rd party during the tunnel setup process, but it does not completely eliminate it.
(a) the client knows server's external ("Internet") IP
(b) there is exactly one server behind the NAT device
Latter is obviously quite limiting unless the "3.3.3.3" changes for every server and the client learns it together with server's external IP. This in turn means that the client still needs to communicate with some 3rd party, so this method only partly alleviates the need for the 3rd party during the tunnel setup process, but it does not completely eliminate it.