Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3780 > unrolled thread

How could I get a connection to an UDP port through two NATs that I don't own?

Back to article view | Back to comp.os.linux.networking

Contents

  How could I get a connection to an UDP port through two NATs that I don't own? Laszlo Lebrun <lazlo.lebrun@googlemail.com> - 2016-05-30 06:39 +0200
    Re: How could I get a connection to an UDP port through two NATs that I don't own? Laszlo Lebrun <lazlo.lebrun@googlemail.com> - 2016-05-30 06:54 +0200
      Re: How could I get a connection to an UDP port through two NATs that I don't own? Jorgen Grahn <grahn+nntp@snipabacken.se> - 2016-05-30 09:07 +0000
        Re: How could I get a connection to an UDP port through two NATs that I don't own? "Carlos E.R." <robin_listas@invalid.es> - 2016-05-30 14:14 +0200
        Re: How could I get a connection to an UDP port through two NATs that I don't own? Laszlo Lebrun <lazlo.lebrun@googlemail.com> - 2016-05-30 21:09 +0200
          Re: How could I get a connection to an UDP port through two NATs that I don't own? William Unruh <unruh@invalid.ca> - 2016-05-30 20:56 +0000
            Re: How could I get a connection to an UDP port through two NATs that I don't own? Laszlo Lebrun <lazlo.lebrun@googlemail.com> - 2016-05-31 07:24 +0200
              Re: How could I get a connection to an UDP port through two NATs that I don't own? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2016-05-31 09:39 +0300
              Re: How could I get a connection to an UDP port through two NATs that I don't own? William Unruh <unruh@invalid.ca> - 2016-05-31 14:53 +0000
          Re: How could I get a connection to an UDP port through two NATs that I don't own? Aleksandar Kuktin <akuktin@gmail.com> - 2016-06-11 10:51 +0000
            Re: How could I get a connection to an UDP port through two NATs that I don't own? "Carlos E. R." <robin_listas@invalid.es> - 2016-06-11 14:15 +0200
            Re: How could I get a connection to an UDP port through two NATs that I don't own? Rick Jones <rick.jones2@hpe.com> - 2016-06-11 23:21 +0000
              Re: How could I get a connection to an UDP port through two NATs that I don't own? Stefan Monnier <monnier@iro.umontreal.ca> - 2016-06-15 23:11 -0400
        Re: How could I get a connection to an UDP port through two NATs that I don't own? Stefan Monnier <monnier@iro.umontreal.ca> - 2016-05-31 22:10 -0400
          Re: How could I get a connection to an UDP port through two NATs that I don't own? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2016-06-01 09:58 +0300
            Re: How could I get a connection to an UDP port through two NATs that I don't own? Stefan Monnier <monnier@iro.umontreal.ca> - 2016-06-01 09:22 -0400

#3780 — How could I get a connection to an UDP port through two NATs that I don't own?

Hi experts here,

I am trying to get an internet connection between two UMTS provided 
networks.

The problem ist that the UMTS providers don't provide public IPs at 
each side.

Has anyone got a clue how to encapsulate the communication to achiev 
this?

-- 
Stop TTIP / CETA !

[toc] | [next] | [standalone]

#3781

Laszlo Lebrun schrieb am 30.05.2016 :
> Hi experts here,
>
> I am trying to get an internet connection between two UMTS provided networks.
>
> The problem ist that the UMTS providers don't provide public IPs at each 
> side.
>
> Has anyone got a clue how to encapsulate the communication to achiev this?

Of course, I have got no way to enable VPN pass-thoughs on the UMTS 
provided NATs, but i could run a PHP "buttler" routine on a third party 
server with a fixed IP.
The volume of data is low: (Domotic application)

-- 
Stop TTIP / CETA !

[toc] | [prev] | [next] | [standalone]

#3782

On Mon, 2016-05-30, Laszlo Lebrun wrote:
> Laszlo Lebrun schrieb am 30.05.2016 :
>> Hi experts here,
>>
>> I am trying to get an internet connection between two UMTS provided networks.
>>
>> The problem ist that the UMTS providers don't provide public IPs at each 
>> side.
>>
>> Has anyone got a clue how to encapsulate the communication to achiev this?
>
> Of course, I have got no way to enable VPN pass-thoughs on the UMTS 
> provided NATs, but i could run a PHP "buttler" routine on a third party 
> server with a fixed IP.
> The volume of data is low: (Domotic application)

To clarify the description a bit: you have two hosts A and B.  Both
have internet access, but are behind NAT (different NAT devices I
guess).  And you want to be able to use UDP from A to B (and the other
way around?)

I don't know the answer; just wanted to boil down the question.  It
feels like you need at least one more host with a public address to
pull this off.  And some kind of tunneling.

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#3783

On 2016-05-30 11:07, Jorgen Grahn wrote:
> On Mon, 2016-05-30, Laszlo Lebrun wrote:
>> Laszlo Lebrun schrieb am 30.05.2016 :
>>> Hi experts here,
>>>
>>> I am trying to get an internet connection between two UMTS provided networks.
>>>
>>> The problem ist that the UMTS providers don't provide public IPs at each 
>>> side.
>>>
>>> Has anyone got a clue how to encapsulate the communication to achiev this?
>>
>> Of course, I have got no way to enable VPN pass-thoughs on the UMTS 
>> provided NATs, but i could run a PHP "buttler" routine on a third party 
>> server with a fixed IP.
>> The volume of data is low: (Domotic application)
> 
> To clarify the description a bit: you have two hosts A and B.  Both
> have internet access, but are behind NAT (different NAT devices I
> guess).  And you want to be able to use UDP from A to B (and the other
> way around?)
> 
> I don't know the answer; just wanted to boil down the question.  It
> feels like you need at least one more host with a public address to
> pull this off.  And some kind of tunneling.

This is what most do, use a known server as intermediary, and have both
extremes register there. That is, both sides have to initiate and keep a
connection with the intermediary.

Mail would do: one side sends an email to a server, the other side picks
up the email with imap. No direct connection between the two sides.

Have a read at STUN (wikipedia). Perhaps there are ideas or uses there.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#3784

Jorgen Grahn beschrieb am 30.05.2016 :
> To clarify the description a bit: you have two hosts A and B.  Both
> have internet access, but are behind NAT (different NAT devices I
> guess).  

Exactly, and the NATs are not under my control (UMTS provider)

> And you want to be able to use UDP from A to B (and the other
> way around?)

Only one way.

-- 
Stop TTIP / CETA !

[toc] | [prev] | [next] | [standalone]

#3785

On 2016-05-30, Laszlo Lebrun <lazlo.lebrun@googlemail.com> wrote:
> Jorgen Grahn beschrieb am 30.05.2016 :
>> To clarify the description a bit: you have two hosts A and B.  Both
>> have internet access, but are behind NAT (different NAT devices I
>> guess).  
>
> Exactly, and the NATs are not under my control (UMTS provider)
>
>> And you want to be able to use UDP from A to B (and the other
>> way around?)
>
> Only one way.

Essentially it cannot be done, unless your provider does port
forwarding for something-- eg port 80 (http) or 22(ssh) or really any
other port. If they do so, you could have ssh listen on that port and
create and ssh tunnel between the two. But without that, there is no way
to get any message from one to the other. 


>

[toc] | [prev] | [next] | [standalone]

#3786

Am 30.05.2016, William Unruh vermutete :
> On 2016-05-30, Laszlo Lebrun <lazlo.lebrun@googlemail.com> wrote:
>> Jorgen Grahn beschrieb am 30.05.2016 :
>>> To clarify the description a bit: you have two hosts A and B.  Both
>>> have internet access, but are behind NAT (different NAT devices I
>>> guess).  
>> 
>> Exactly, and the NATs are not under my control (UMTS provider)
>> 
>>> And you want to be able to use UDP from A to B (and the other
>>> way around?)
>> 
>> Only one way.
>
> Essentially it cannot be done, unless your provider does port
> forwarding for something-- eg port 80 (http) or 22(ssh) or really any
> other port. If they do so, you could have ssh listen on that port and
> create and ssh tunnel between the two. But without that, there is no way
> to get any message from one to the other. 

The provider opens at least HTTP and FTP.

-- 
Stop TTIP / CETA !

[toc] | [prev] | [next] | [standalone]

#3787

On 31.5.16 08:24, Laszlo Lebrun wrote:
> Am 30.05.2016, William Unruh vermutete :
>> On 2016-05-30, Laszlo Lebrun <lazlo.lebrun@googlemail.com> wrote:
>>> Jorgen Grahn beschrieb am 30.05.2016 :
>>>> To clarify the description a bit: you have two hosts A and B.  Both
>>>> have internet access, but are behind NAT (different NAT devices I
>>>> guess).
>>>
>>> Exactly, and the NATs are not under my control (UMTS provider)
>>>
>>>> And you want to be able to use UDP from A to B (and the other
>>>> way around?)
>>>
>>> Only one way.
>>
>> Essentially it cannot be done, unless your provider does port
>> forwarding for something-- eg port 80 (http) or 22(ssh) or really any
>> other port. If they do so, you could have ssh listen on that port and
>> create and ssh tunnel between the two. But without that, there is no way
>> to get any message from one to the other.
>
> The provider opens at least HTTP and FTP.


Careful with that. It is easy to mix inbound and outbound
directions here. Are you saying thet the network provider
gives a UMTS client HTTP or FTP inbound connection (server)?

If you really have an inbound HTTP possibility, have a look
at httptunnel.

-- 

-TV

[toc] | [prev] | [next] | [standalone]

#3788

On 2016-05-31, Laszlo Lebrun <lazlo.lebrun@googlemail.com> wrote:
> Am 30.05.2016, William Unruh vermutete :
>> On 2016-05-30, Laszlo Lebrun <lazlo.lebrun@googlemail.com> wrote:
>>> Jorgen Grahn beschrieb am 30.05.2016 :
>>>> To clarify the description a bit: you have two hosts A and B.  Both
>>>> have internet access, but are behind NAT (different NAT devices I
>>>> guess).  
>>> 
>>> Exactly, and the NATs are not under my control (UMTS provider)
>>> 
>>>> And you want to be able to use UDP from A to B (and the other
>>>> way around?)
>>> 
>>> Only one way.
>>
>> Essentially it cannot be done, unless your provider does port
>> forwarding for something-- eg port 80 (http) or 22(ssh) or really any
>> other port. If they do so, you could have ssh listen on that port and
>> create and ssh tunnel between the two. But without that, there is no way
>> to get any message from one to the other. 
>
> The provider opens at least HTTP and FTP.

Ingoing? Then you can use those to open say an ssh tunnel. Tell ssh to
listen to port 80 (/etc/ssh/sshd_config) and have the other machine open
an ssh tunnel to that port. Now you will have a full tunnel between the
two that you can do with what you want. 
If on the otherhand it is just an outgoing (Ie, you can do ftp from the
machine to the WWW, then it is useless, and it would be extremely
unusual for them not to do that. 

>

[toc] | [prev] | [next] | [standalone]

#3798

On Mon, 30 May 2016 21:09:03 +0200, Laszlo Lebrun wrote:

> Jorgen Grahn beschrieb am 30.05.2016 :
>> To clarify the description a bit: you have two hosts A and B.  Both
>> have internet access, but are behind NAT (different NAT devices I
>> guess).
> 
> Exactly, and the NATs are not under my control (UMTS provider)

This is tantalizing. I'm almost certain Skype figured out a way to do NAT 
firewall punching using UDP in this exact situation. There's supposed to 
be an article on Wikipedia with the explanation, unless it got removed 
for whatever reason.

I'm rusty on NATs, and a lot of the solution depends on exact details of 
NAT operation. *IF* the NAT adds a bidirectional entry to itself for 
every outgoing UDP, then this can be done. Have your outside server. Host 
A registers with it using UDP. The purpose of twofold: one, it opens a 
port on the NAT and two, the server now knows the address-port pair that 
routes to A. Host B then registers with the server, for the same reasons, 
and gets a response telling it the address-port of host A. B then talks 
to that address-port, the packets reaching A. A responds to address-port 
it received the packets from.

As long as they keep talking, the NAT entries stay alive and the party is 
on.

Also, I think this is how various torrent programs communicate as well.

[toc] | [prev] | [next] | [standalone]

#3799

On 2016-06-11 12:51, Aleksandar Kuktin wrote:
> On Mon, 30 May 2016 21:09:03 +0200, Laszlo Lebrun wrote:
> 
>> Jorgen Grahn beschrieb am 30.05.2016 :
>>> To clarify the description a bit: you have two hosts A and B.  Both
>>> have internet access, but are behind NAT (different NAT devices I
>>> guess).
>>
>> Exactly, and the NATs are not under my control (UMTS provider)
> 
> This is tantalizing. I'm almost certain Skype figured out a way to do NAT 
> firewall punching using UDP in this exact situation. There's supposed to 
> be an article on Wikipedia with the explanation, unless it got removed 
> for whatever reason.

The main trick is both sides registering with an intermediate server in
Internet. Without that it is impossible.

-- 
Cheers,
       Carlos E.R.

[toc] | [prev] | [next] | [standalone]

#3800

Aleksandar Kuktin <akuktin@gmail.com> wrote:

> I'm rusty on NATs, and a lot of the solution depends on exact details of 
> NAT operation. *IF* the NAT adds a bidirectional entry to itself for 
> every outgoing UDP, then this can be done. Have your outside server. Host 
> A registers with it using UDP. The purpose of twofold: one, it opens a 
> port on the NAT and two, the server now knows the address-port pair that 
> routes to A. Host B then registers with the server, for the same reasons, 
> and gets a response telling it the address-port of host A. B then talks 
> to that address-port, the packets reaching A. A responds to address-port 
> it received the packets from.

I gather you are saying it would be:
A -> Server
B -> Server
therefore
A<->B

The NAT state will include the IP address of the common server and
unless it is a very permissive NAT is unlikely to pass traffic with a
different IP.

rick jones
-- 
web2.0 n, the dot.com reunion tour...
these opinions are mine, all mine; HPE might not want them anyway... :)
feel free to post, OR email to rick.jones2 in hpe.com but NOT BOTH...

[toc] | [prev] | [next] | [standalone]

#3801

> The NAT state will include the IP address of the common server and
> unless it is a very permissive NAT is unlikely to pass traffic with a
> different IP.

Check out STUN.  Indeed, it doesn't always work.  But it apparently
works with several home routers.  Don't know what kind of NAT is used by
the Linux kernel (i.e. by an OpenWRT router), tho.


        Stefan

[toc] | [prev] | [next] | [standalone]

#3789

> I don't know the answer; just wanted to boil down the question.  It
> feels like you need at least one more host with a public address to
> pull this off.  And some kind of tunneling.

That's right.  ID do it as follows:
- get a server machine somewhere on the internet (your home, your
  office, or some VPS hosting somewhere).
- run an OpenVPN server on that server.
- setup OpenVPN clients on your two UMTS-connected machines to connect
  to your server.
- you can now talk via UDP over your very own VPN network at will.

OpenVPN can run over UDP or TCP as well, and over any port (including
443), so you don't need any "passthrough" support from the NAT (IOW it
works over any NAT).  And it's rock-solid in my experience.


        Stefan

[toc] | [prev] | [next] | [standalone]

#3790

On 1.6.16 05:10, Stefan Monnier wrote:
>> I don't know the answer; just wanted to boil down the question.  It
>> feels like you need at least one more host with a public address to
>> pull this off.  And some kind of tunneling.
>
> That's right.  ID do it as follows:
> - get a server machine somewhere on the internet (your home, your
>   office, or some VPS hosting somewhere).
> - run an OpenVPN server on that server.
> - setup OpenVPN clients on your two UMTS-connected machines to connect
>   to your server.
> - you can now talk via UDP over your very own VPN network at will.
>
> OpenVPN can run over UDP or TCP as well, and over any port (including
> 443), so you don't need any "passthrough" support from the NAT (IOW it
> works over any NAT).  And it's rock-solid in my experience.
>
>
>         Stefan


The preferred port for OpenVPN is UDP/1194. There are good reasons
to avoid running VPN over TCP.

-- 

-TV

[toc] | [prev] | [next] | [standalone]

#3791

> The preferred port for OpenVPN is UDP/1194.

Sure.  But it works just as well over any other port you like.

It's common to use 443 so as to make sure it's available from pretty much
anywhere since 443 is almost never firewalled.  It even has special
support for sharing the 443 port with a web-server (config var
"port-share" which tells OpenVPN to forward incoming connections which
look like HTTPS instead of OpenVPN to some other port).

> There are good reasons to avoid running VPN over TCP.

UDP is preferable all things being equal, indeed.  But TCP works pretty
darn well, especially compared to "no other option" (when UDP is blocked
by a firewall).


        Stefan

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web