search

zerotier / ZeroTierOne

A Smart Ethernet Switch for Earth
https://zerotier.com
Other
14.6k stars 1.71k forks source link

ICMP hole punching #209

Closed maci0 closed 9 years ago

maci0 commented 9 years ago

Would it be beneficial to support ICMP hole punching in addition to UDP hole punching? See http://samy.pl/pwnat/ and http://samy.pl/pwnat/pwnat.pdf

adamierymenko commented 9 years ago

Have to give that a read... looks potentially interesting.

One problem you can run into with some NAT traversal techniques is that they look like port scans or other funny business, and can therefore set off IDS alarms. This is to some extent unavoidable -- when I did netsec I saw VoIP phones and similar things set off the IDS. But it's something to be aware and careful about.

adamierymenko commented 9 years ago

Looked into this a bit, and I'm not sure the success rate would be high enough to justify the work. I've also been researching IP TTL external port mapping discovery and found that the success rate there is also pretty low -- many NATs remap inside ICMP replies, rendering the information invisible.

adamierymenko commented 9 years ago

The other problem with this is multiple devices behind the same NAT. ICMP has no port number concept, so it doesn't seem like this would be useful in that case. Multiple devices behind the same NAT would all step on each other.