Why TCP Over TCP Is a Bad Idea (2001)

Re:Why TCP Over TCP Is a Bad Idea (2001) by minimax on Saturday March 28, 2015 @02:19PM (#9282245)

I'm just saying in a previous life I used to spend a ton of time fighting with IPSec NAT traversal issues. With TCP encapsulation (e.g. SSL VPN), you don't have that problem. Most NAT firewalls do a good job dealing with TCP. Other protocols are more questionable.

When I'm using wifi at a coffee shop and start getting a bunch of packet loss, I will switch to a tethered 3G connection. When my SSL VPN reconnects, the VPN server hands me back the same IP address I had before. In some cases, my SSH sessions don't even drop.

[ Parent | on HN ]

Re:Why TCP Over TCP Is a Bad Idea (2001) by agwa on Saturday March 28, 2015 @02:26PM (#9282268)

IPSec is indeed hell with NATs, and an SSL VPN would be much better. But UDP is even better - most NATs do a good job with UDP too, and if done right, it's possible to switch Internet connections without the VPN having to reconnect.

[ Parent | on HN ]

Re:Why TCP Over TCP Is a Bad Idea (2001) by eps on Saturday March 28, 2015 @06:04PM (#9282910)

The hell are you fellas smoking? IPsec NAT traversal has been a non-issue since it was standardized about 10 years ago.

[ Parent | on HN ]

Re:Why TCP Over TCP Is a Bad Idea (2001) by mordechai9000 on Saturday March 28, 2015 @05:06PM (#9282771)

DTLS is a standard protocol for TLS over UDP. It is used by existing commercial products, such as Cisco Anyconnect.

[ Parent | on HN ]