EHfive
commented
8 months ago IIUIC, what you requested is actually ADM(Address-Dependent Mapping) + ADF(Address-Dependent Filtering) with maximum external source port reuse if possible.
Then we will have following bi-directional NAT binding for packet translation and filtering. This can be easily modeled with O(1) hashmap in eBPF.
(internal source address, internal source port, destination address)
<=> (external source address, external source port, destination address)
And we need the following transformed mapping for querying if a certain external source port has been assigned for destination addresses to determine if that port can be reused.
(external source address, external source port)
=> { (destination address), ... } "set of all related destination addresses"
OR
(external source address, destination address)
=> { (external source port), ... } "set of all related external source ports"This can be modeled with O(1) hashmap with nested value of O(1) hashmap/hashset or O(n) list in normal program. However it's not possible to have nested hashmap in eBPF, so we would need to model it in hashmap with value linked list. And that would be a O(n) operation which would be inefficient, so I am not considering implement that yet until we have nested hashmap support in eBPF.
This is expecially useful in ISP services which provide IP address shared with other tens of users and only hundreds of ports per user (such ISPs do exist in my country, Japan).
A proper ISP CGNAT should have a IP address pool though, i.e. your source port would be mapped to another external IP address if all ports of previous mapped external IP have been assigned for other users.
UDP hole punching will succeed between netfilter and netfilter, but not between netfilter and Symmetric NAT.
If you are individual user, I would recommend just use port forwarding solutions like miniupnp ,#5 or plain old nftable/iptables DNAT rule if you have control over your hole punching software.
Also the external port exhaust can be addressed by adding more external IP address, i.e. IP address pool. It's a planned feature.
Closing as not planned.
ge9
Hi, Sorry if this feature request is arrogant (at least it's outside the scope of "full cone NAT"), but I'm very interested in this topic. As you may know, netfilter's NAT behaves as follows:
Port overloading is useful because it can save the number of external ports consumed; When we have only 100 external port, it can manage far more than 100 connections at once (100 port per endpoint). This is expecially useful in ISP services which provide IP address shared with other tens of users and only hundreds of ports per user (such ISPs do exist in my country, Japan). However, since it is basically EIM/APDF (Port restricted cone NAT), UDP hole punching will succeed between netfilter and netfilter, but not between netfilter and Symmetric NAT.
Therefore, we should use mapping not per [address, port] but per only address. Such a NAT can be Address Dependent Filtering, because we can find the mapping for traffic from unknown port of known address. Of course, with this NAT policy, we can do "port overloading" only if the address of the endpoint is different (192.168.1.1:40000 <-> example.com:80 and 192.168.1.2:40000 <-> example.com:8080 won't be able to share port). However, this won't actually be disadvantage because we rarely want to access different ports of the same address. We usually use only 53 or 80 or 443 of the specific address and will be content with port overloading only for different address.
Since this NAT is basically EIM/ADF, UDP hole punching between this NAT and symmetric NAT (as long as the address is preserved).
I don't have knowledge on eBPF and don't know how difficult this would be, but hope this fascinating feature.