EHfive / einat-ebpf

An eBPF-based Endpoint-Independent(Full Cone) NAT for Linux
GNU General Public License v2.0
151 stars 7 forks source link

Send back ICMP Destination Unreachable when NAT can not be performed, RFC 5508 Sec.6 #8

Open EHfive opened 6 months ago

EHfive commented 6 months ago

Rejection of Outbound Flows Disallowed by NAT, https://datatracker.ietf.org/doc/html/rfc5508#section-6

This would further increase the complexity of the BPF program and is not very useful so long as the NAT has enough ports, and generally client can handles packet dropping. So it would be on low priority.