IPv6 the technology solves it, IPv6 as it exists in the real world does not. Even if we got 100% IPv6 adoption overnight, you would still not have a universally adopted API for punching holes through router firewalls for p2p applications.

Yep, and such a thing would never be allowed anyway because what network administrator will look at “yes random client devices can punch holes in my network from the outside to your not very securely assigned address” and rightfully say nope.

Here’s the attack:

- You want to get to A

- And you’re on a device B that has access to hole-punch-as-a-service but no direct access to A. Good network administrator / sysadmin!

- Attack NDP (ie ARP spoofing but IPv6 flavored) to trick the firewall just for a moment that you’re A [1] and request the port be opened to your evil server C on the public internet.

- Oops.

Yep, tunneling is way more secure than direct p2p. Especially if you run the service inside some sort of sandbox/container/VM which is possible on all major OSes these days.

SSL?

... you mean like UPnP?

The first google result for "upnp adoption" is from 2012. The second is from 2022 and recommends you turn it off for security reasons.

EDIT: I agree we definitely need something like UPnP, or maybe even UPnP itself, but it's another adoption problem currently.

UPnP needs management. I'd like to be able to set rules about what ports can be opened by UPnP, from where, by whom, with or without a notification in email/logs/alerts etc.

Pretty much every consumer router has UPnP enabled by default.

How does Syncthing solve this?

AFAIK it doesn't use third party servers and it seems to get through any router just fine...

It uses third party (community-provided) relay servers: https://docs.syncthing.net/users/strelaysrv.html

This can have quite an effect on sync speed. I set it up for my dad and initially his PC and laptop were syncing incredibly slowly. It turned out they both thought his home network was a public one, so everything was going out to a relay server and back.

WebRTC solves this via signalling servers. Data channels are peer-to-peer and traverse NAT.

As others have mentioned, NAT traversal and relays. Tailscale has the best article on NAT traversal I'm aware of: https://tailscale.com/blog/how-nat-traversal-works/

We love IPv6 at Tailscale! It's just not pervasive yet, so we do what we gotta do.