alt.hn

3/15/2026 at 3:29:17 AM

A most elegant TCP hole punching algorithm

 https://robertsdotpm.github.io/cryptography/tcp_hole_punching.html

by Uptrenda

3/15/2026 at 6:59:31 AM

- you know each others IP's (or have a way to signal it)

- can't decide on a port in the same message

- don't suffer from NAT port randomization

I'm not saying it will never happen, but the Venn diagram of this being the minimum complexity solution just doesn't seem very large?

by athrowaway3z

3/16/2026 at 11:20:15 AM

There are plenty of free public STUN servers and ways to share the information they return.

The real problem is the port randomization if any client is behind a symmetric NAT. The search space for randomly trying port numbers is too large.

There are some ways to reduce the search space, like port prediction. But ultimately, a large dose of port scanning is the only way I know of to make the connection reliably. And there’s only so much of that you can do before triggering IPS or overwhelming the NAT.

IPv6 makes this way easier, of course!

by sholladay

3/15/2026 at 3:08:13 PM

I think many people know how to google "what is my IP" and send that to a friend, but don't necessarily know what a port is.

NAT randomization, I don't know. Depends on your setup, I guess.

by Arch485

3/15/2026 at 8:46:54 AM

Does TCP hole punching actually work with common CPEs and CG-NATs?

I don’t think I’ve ever seen it done successfully and have often wondered if it’s for a lack of use cases or due to its bad success rate and complexity compared to UDP hole punching.

That said, I really wish there was a standardized way to do it. Some sort of explicit (or at least implicit but unambiguous) indicator to all firewalls that a connection from a given host/port pair is desired for the next few seconds. Basically a lightweight, in-band port mapping protocol.

It could have well been an official recommendation to facilitate TCP hole punching, but I guess it’s too late now, as firewall behaviors have had decades to evolve into different directions.

by lxgr

3/15/2026 at 3:42:04 PM

The standard way to do it is called ipv6. Implementing it is probably easier than any of those RFCs

by aboardRat4

3/15/2026 at 4:28:47 PM

No, it isn't. Many middleboxes (including OpenWrt by default) drop unsolicited inbound TCP connections even on IPv6, and therefore the same hole-punching algorithm is needed. The hole being punched is in the stateful firewall's connection tracker, not in the NAT. Basically, both parties need to convince their router that it is an outgoing connection initiated by them, not a prohibited-by-policy incoming connection.

by patrakov

3/15/2026 at 5:08:31 PM

All you should need is for both sides to connect to each other. Side A connecting to side B opens a hole in side A's firewall and is blocked by side B, then B connects to A, opening B's firewall and going through the already open hole in A's firewall.

It might work better with UDP but I don't think those firewalls boxes tear down the mapping immediately on getting an RST - they wait until it times out.

by gzread

3/15/2026 at 5:42:28 PM

There are two separate problems with IPv4 and only one applies to IPv6. Allowing incoming connections through a restrictive firewall is applicable to both. Address mangling via NAT applies only to one. Note also that in the IPv4 world you might be behind more than one layer of NAT which will make everything infinitely worse.

Honestly ISPs really missed an opportunity to essentially provide IPv6-only as a service and add an IPv4 compatibility layer to that (IPv6 already has a mechanism built in for this but grandma’s old laptop might not fully support it so you might need a local router provided by the ISP to give you native local IPv4 that allows you to access the internet) instead of CGNAT. But they chose to go with duct tape, spit, paper clips, and hope instead of investing in the correct solution. Shame on them and too bad for us.

by IgorPartola

3/15/2026 at 6:37:52 PM

Exactly. And look, the linked Python script only solves one problem: making both firewalls believe that the party behind them is the one who initiated the connection. Address/port mangling is not addressed at all, both public addresses need to be provided externally.

And it's simply not true that there is no NAT in the wild with IPv6: every OPNsense installation with two uplinks and the need for anything better than an "arbitrary and uncontrollable" choice of the correct uplink for each outbound connection needs network prefix translation, as the residential dual-homing story for IPv6 is vaporware otherwise. NPT is used not for address space conservation, but to defer the decision about the correct source address to the router that has the knowledge of the correct policy.

And in this sense, IPv6 is worse than IPv4: there are too many people assuming no firewall and no NAT for IPv6, and designing their applications based on these almost-working (but de-facto now broken) premises. The correct premises are the same as for IPv4.

by patrakov

3/16/2026 at 1:06:33 AM

If you have two uplinks and running OPNSense (saying this as someone that does exactly this), you have a particular setup that you have clearly taken ownership of. If that breaks your experience with standard tech, that is part of what you traded off when you customized your setup as such.

IPv6 is strictly worse for this precisely because it is treated as a second class citizen. If it was the default in all the tutorials and we started naming IPv4 as the legacy protocol developers would know better.

by IgorPartola

3/15/2026 at 7:10:12 PM

IPv6 nat is a thing that exists and is used. IPv6 purists like to imagine it doesn't exist which is cute.

by ectospheno

3/15/2026 at 11:13:53 PM

It’s extremely rare compared to v4, where it’s more common than not. I haven’t seen it with a single consumer ISP, and why should they use it?

by lxgr

3/15/2026 at 11:12:42 PM

> Honestly ISPs really missed an opportunity to essentially provide IPv6-only as a service

This is in fact how many 4G and 5G networks work today. I’m sending this reply via one right now.

For wired connections, many DOCSIS cable ISPs use DS-Lite, which is v6 only on the last hop as well.

by lxgr

3/15/2026 at 11:09:41 PM

Firewalls exist in IPv6 too, so hole punching still has a reason to exist as well.

by lxgr

3/15/2026 at 1:06:16 PM

> really wish there was a standardized way to do it. Some sort of explicit (or at least implicit but unambiguous) indicator to all firewalls that a connection from a given host/port pair is desired for the next few seconds

NAT Behavioural Requirements for Unicast UDP, https://datatracker.ietf.org/doc/html/rfc4787

NAT Behavioural Requirements for TCP, https://datatracker.ietf.org/doc/html/rfc5382

by ignoramous

3/15/2026 at 1:15:25 PM

> NAT Behavioural Requirements for TCP

TIL, thank you! I've been looking for this for quite a while after hearing it indirectly referenced recently, but only found host-side specifications for TCP simultaneous open.

Do you happen to know if common firewalls and NATs support it? If they do, I really wonder why TCP hole punching isn't more common.

by lxgr

3/15/2026 at 5:20:48 PM

Claimed elegance is based on a very bold assumption that the NAT device preserves the source port of outbound connection.

Hardly the case in even half of typical deployment cases.

by abcd_f

3/15/2026 at 5:40:44 PM

I like your comment, but it seems the author acknowledged this as a caveat to the algorithm.

>Many home routers try to preserve the source port in external mappings. This is a property called “equal delta mapping” – it won’t work on all routers but for our algorithm we’re sacrificing coverage for simplicity.

So to what percentage is this coverage sacrificed exactly? No idea. Not as useful if the percentage is high, as you are implying.

by taftster

3/15/2026 at 8:52:44 PM

It’s the same assumption is required for any hole punching handshake (including STUN).

> This is a property called “equal delta mapping”

FWIW I’ve worked in computer networking for 20 years and have never heard it called this. This blog is the only source that comes up when I search for that exact term. I wonder where the author got it from.

by killbot5000

3/15/2026 at 10:02:50 PM

> It’s the same assumption is required for any hole punching handshake (including STUN).

This is incorrect.

Hole punching requires being able to predict external port. That's it. If the port remains the same, it certainly simplifies things, but ports going up (or down) by 1 (or 2, or 5) with each new mapping is quite common, trivial to detect and to punch through.

by abcd_f

3/15/2026 at 9:00:00 PM

I wonder how many new technical terms are going to be created by LLMs - not to say that this post was N necessarily written by an LLM (but, who knows!)

by ray_v

3/16/2026 at 11:20:25 AM

It comes from academic papers on categorizing NAT behaviors which (trust me) is hardly the page turning research most people are used to. In these papers they talk about patterns NATs use between successive external port allocations -- which they call the "delta."

The name "equal delta" just means a type of NAT with a delta that tries to preserve the source port. Not to be confused with "preserving" type deltas (that preserve "the same numerical distance" between successive mappings -- e.g. a "preserving delta" type with a value of +1 means each successive NAT allocation is one more than the previous.)

Edit: It took me a while but I am pretty sure this was the original paper that goes into mapping allocations. https://www.usenix.org/legacy/events/imc05/tech/full_papers/...

In my mind there was a neat table with named deltas and examples but maybe that was what I pulled from the text.

by Uptrenda

3/16/2026 at 12:04:27 AM

>equal delta mapping

Very clearly a hallucination

by DetroitThrow

3/15/2026 at 11:36:24 PM

My internet provider didn't even maintain the ip-address. They have a pool of egress routes and seems to route round-robin. Basically every new connection can be from any address in the pool.

I had to call them to make it stop since it tripped the VPN solution at work, that interpreted it as a MIM attack. They disabled it no questions asked as soon as I called, so I guess it mostly works for most people, but not all.

But on that note, isn't it basically time now for IPv6 so we can stop shit like this and go to directly addressable devices like everyone did in the early 90s.

by kpil

3/15/2026 at 10:14:25 PM

i was also thinking about this, what keeps you from just using a (predefined) random port (or 10)?

by K0IN

3/15/2026 at 11:03:48 PM

Can't both sides just keep trying different ports until they get lucky? There's not that many of them, and even if it takes several minutes to get a match, that's better than nothing at all.

by ranger_danger

3/15/2026 at 5:37:26 AM

> Many home routers try to preserve the source port in external mappings. This is a property called “equal delta mapping” – it won’t work on all routers but for our algorithm we’re sacrificing coverage for simplicity.

It is precisely this point that has flummoxed me when connecting my p2p wireguard config[1] with a friend that uses a pfsense router, no matter what we tried, pfsense always chooses a random source port.

But in the simple case this blog outlines, if both ends use the same source port, this method punches through 2 firewalls effortlessly:

[1] https://blog.rymcg.tech/blog/linux/wireguard_p2p/

by EnigmaCurry

3/15/2026 at 10:56:40 AM

In my experience, Cisco ASA does source port persistence by default (when it can’t do it then it falls back to random), fortigates can do it (in various ways depending on version, although fallback method in the map-ports doesn’t work), juniper SRXs can’t, unless you guarentee a 1:1 map.

by hdgvhicv

3/15/2026 at 6:27:17 AM

Does your friend setting up port forwarding on their pfSense not help in your scenario?

by jonathanlydall

3/15/2026 at 6:48:15 AM

Yes, that solves it completely. But the exercise we were trying to do was to do it without that.

by EnigmaCurry

3/15/2026 at 5:56:46 PM

This is easily solved in your source NAT configuration on pfSense. It's a single checkbox to not randomize ports on outbound flows. This will enable full cone NAT.

You can scope it to just your IPsec service, or whatever it is your hosting, or you can enable full cone for the whole subnet.

It is not DNAT, nor is it port forwarding. If you host a SIP proxy, SBC or peer to peer gaming, it will enable these use cases as well.

https://docs.netgate.com/pfsense/en/latest/nat/outbound.html

by patjensen

3/15/2026 at 8:41:21 AM

[flagged]

by getcrunk

3/15/2026 at 10:20:33 AM

We can all run this through our LLM if choice, why post this?

by Boltgolt

3/15/2026 at 8:48:43 AM

Did you validate this solution yourself?

by lxgr

3/15/2026 at 8:58:33 AM

No, hence the all caps ai disclaimer. But seems plausible

by getcrunk

3/15/2026 at 9:12:55 AM

Lord, we're how many years into using LLMs, and people still don't understand that their whole shtick is to produce the most plausible output - not the most correct output?

The most plausible output might be correct, or it might be utter bullshit hallucinations that only sound correct; the only way to tell is to actually try it or cross-reference primary sources. Unless you do, the AI answer is worthless.

The reason why they're getting so good at code now is that they can check their output by running and testing it; if you're just prompting questions into a chatbot and then copying their output verbatim to a comment, you're not adding any meaningful value.

by nneonneo

3/15/2026 at 9:38:15 AM

Exactly! This is what LLMs do: they bullshit you by coming across as extremely knowledgeable, but as soon as you understand 5% of the topic you realise you've been blatantly lied to.

by anovikov

3/15/2026 at 10:45:30 AM

Even if you get 70% blatant lies and 30% helpful ideas, if you can cheaply distinguish the two due to domain expertise, is that not still an extremely useful tool?

But to the point of this thread: If you can't validate their output at all, why would you choose to share it? This was even recently added to this site's guidelines, I believe.

by lxgr

3/15/2026 at 10:40:11 AM

But then why make this comment at all, even despite the disclaimer? Anyone can prompt an LLM. What's your contribution to the conversation?

To be clear, I use LLMs to gut check ideas all the time, but the absolute minimum required to share their output, in my view, is verification (can you vouch for the generated answer based on your experience or understanding), curation (does this output add anything interesting to the conversation people couldn't have trivially prompted themselves and are missing in their comments), and adding a disclaimer if you're at all unsure about either (thanks for doing that).

But you can't skip any of these, or you're just spreading slop.

by lxgr

3/15/2026 at 3:23:37 PM

You didn't even provide the exact model you pulled that out!

"Seems plausible".... Can you please read up about the ways LLM generate their output?

by subscribed

3/15/2026 at 6:59:42 AM

This is a great algorithm!

In this era where AI is eating away at how deterministic computers are, I really appreciate reading about an elegant solution to a real problem using deterministic logic.

by sholladay

3/15/2026 at 9:13:55 AM

We still live in an age of deterministic computers. It’s the software that’s become fuzzy. (And since we’re on the subject: there’s no AI)

by CamelCaseCondo

3/15/2026 at 9:20:23 PM

Are you saying that "Artificial Intelligence" is just not properly named for now.we.currently use it? Feels like at least the distinction of qualifying it with the term, "LLM" is popular.

by ray_v

3/15/2026 at 12:05:25 PM

Yes, but a computer is just a paperweight without its software. Also, increasingly the hardware is being specifically designed and optimized for that non-deterministic software. The experience of using computers is changing and we’re still in the early days of that shift.

Of course there’s still plenty of deterministic software you can run… for now.

by sholladay

3/15/2026 at 12:15:14 PM

I can almost guarantee that all of AI runs on deterministic hardware and software. AI is just (near?) the top of the stack. There is no reason, and probably never will be to have a purely heuristic computer. Deterministic systems are way simpler and cheaper to handle very routine well defined tasks. Even AI authors code behind the scenes to process data files deterministically.

by ufocia

3/15/2026 at 3:46:13 PM

data = code in the AI age. Fuzzy data = fuzzy code.

Now combining AI with deterministic tool calling brings the best of both worlds.

by mycall

3/15/2026 at 2:25:27 PM

> there’s no AI

This is a theistic statement at this point, no?

by wolttam

3/15/2026 at 6:42:47 PM

Many people conflate "AI" and "AGI". It's disappointing to find people who don't know the difference on HN, though.

by CharlesW

3/15/2026 at 5:28:36 AM

If you're asking "where is the listener", you don't need one: https://datatracker.ietf.org/doc/html/rfc9293#simul_connect

by jcalvinowens

3/15/2026 at 7:22:53 AM

RFCs may say that simultaneous connect must be allowed, but that doesn't mean that firewalls can't block it. Plenty of setups block incoming SYN,!ACK packets, and if both sides do that, the connection is never getting established.

by cperciva

3/15/2026 at 2:00:02 PM

In my experience most consumer routers are dumber than you're assuming they are, and will DNAT any inbound TCP packet that matches the 4-tuple after seeing the initial outbound SYN, including an inbound SYN. But yes, it doesn't work everywhere.

I wrote little paper on this technique in school and did some practical tests, at the time I was actually unable to find an example of consumer grade router that it didn't work on! But my resources were rather limited, they certainly do exist.

by jcalvinowens

3/15/2026 at 3:27:01 PM

> Plenty of setups block incoming SYN,!ACK packets

Even in the presence of a conntrack entry created by an earlier outbound SYN,!ACK ?

Got a source?

by huhtenberg

3/15/2026 at 4:16:15 PM

I've seen plenty of firewall rulesets over the past 25 years which only consult state after doing some initial stateless inspection.

I don't have a convenient source though.

by cperciva

3/15/2026 at 4:37:29 PM

Sanity checks, sure, but SYN,!ACK packets cannot be rejected before the conntrack for obvious reasons.

> Plenty of setups block incoming SYN,!ACK packets

Nowhere close to being "plenty". It's doable, but this is extremely niche.

by huhtenberg

3/15/2026 at 7:50:13 PM

It's not uncommon with routable internal networks to only drop inbound SYN,!ACK to disallow inbound connections while permitting outbound ones, since it doesn't require connection tracking (which can be resource intensive).

I can't really imagine why you would do it for NAT'd v4 since you can't avoid the connection tracking overhead, but you certainly could, and I don't doubt OP has run into it in the wild. I've seen much weirder firewall rules :)

by jcalvinowens

3/15/2026 at 5:02:32 PM

for obvious reasons

What are the obvious reasons? If you're protecting a client system, you don't want to allow in any bare SYNs. (And for that matter, if you're protecting a server, you probably want to discard ill-targeted bare SYNs without consulting conntrack anyway, just as a matter of avoiding extra CPU work.)

by cperciva

3/15/2026 at 5:11:09 PM

Does this mean by establishing a new connection with a SYN,ACK bypasses some firewalls? I expect at least one OS out there ignores the extraneous ACK flag and proceeds to establish a new connection.

by gzread

3/15/2026 at 7:24:04 PM

Why would it mean that?

All inbound packets are matched against existing sessions. In this case none will turn up, so the packet will go through the "new session" flow and be subject to the same filtering as a bare SYN. Look up how connection tracking works, e.g. in the Linux kernel, it's rather simple and logical.

by huhtenberg

3/16/2026 at 12:16:14 AM

This perfectly eliminates the last centralized bottleneck for P2P agent networks.

We are dropping this deterministic punch directly into the grubcrawler.dev edge binaries. Instead of relying on STUN/TURN servers to coordinate a swarm, millions of nodes trapped behind residential NATs will use the unix timestamp to mathematically predict a collision course, aggressively punch through their firewalls, and instantly hand the raw TCP socket over to rust-lightning (LDK).

No DNS. No signaling servers. No legacy IP registries. Just a self-assembling Lightning mesh of autonomous agents spinning up encrypted channels and executing paid RPC calls entirely in the dark.

by kordlessagain

3/15/2026 at 8:43:43 PM

One thing about this get I just realized is that if the defect exists on some home networking equipment, then the defect can be leveraged in corporate network environments to disable this functionality. If the user of the algorithm (or, person using an app using it for userspace) isn't aware of the limitations, that would be super frustrating!

by ray_v

3/15/2026 at 4:29:37 PM

I don’t think the bucket-choosing algorithm works? The two hosts can be just on opposite sides of a bucket edge. For example if one host sees t=61 and another sees t=62, they will get different buckets despite being less than 20 seconds apart. You’ve got to check adjacent buckets within your error tolerance, not expand the bucket windows in size based on it.

by jder

3/15/2026 at 12:27:19 PM

The timestamp bucket idea for generating shared port candidates is clever.

Do you find this works reliably outside routers that preserve source ports? My understanding was that TCP punching tends to depend heavily on NAT behavior.

by ata-sesli

3/15/2026 at 7:32:48 AM

Needing to punch holes in NAT is one of the most idiotic own-goals in the entire field of networking.

NAT is effectively your router doing DHCP with a 17-bit suffix (16-bit port + 1 bit for UDP vs TCP) to each of your applications and then not telling you the address it gave you or how long it is good for (which is what a regular DHCP lease does). This is in addition to it, most likely, already doing regular DHCP and allocating you a IP address that it does tell you about, but which is basically worthless since routing to just that prefix without the hidden suffix goes into a black hole.

If you could just ask your router for a lease on a chunk of IP+NAT addresses that you could allocate to your applications and rotate them as they expire, you would not need this horrifying mess.

The router would just need to maintain the last-leg routing table (what a concept, a router doing routing with routing tables) just like it already does DHCP.

The applications would have short-term stable addresses that they could just tell their peers and just directly tell the router/firewall to block anybody except the desired peer short-term address.

by Veserv

3/15/2026 at 8:52:08 AM

> If you could just ask your router for a lease on a chunk of IP+NAT addresses

The “just” is doing a lot of lifting there. I’m glad the various port mapping protocols didn’t really take off and it looks like IPv6 is going to actually make it instead. Much less complexity in most parts of the stack and network.

by lxgr

3/15/2026 at 9:16:06 AM

It is always a mystery how people just randomly misinterpret what I write. At literally no point did I mention port mapping.

I am pointing out how the problem NAT “solves” is just dynamic address configuration. They have implemented a N+K bit address where the N-bit prefix is routed and allocated using IP and the low K-bits are routed and allocated like a custom fever dream.

You can just do it all the same way instead of doing it differently and worse for the low bits.

To be clear, the router should rewrite zero bits in the packet under the scheme I am describing just like how routers have no need to rewrite any bits when routing to a specific globally-routable IP address.

You get a lease for a /N+K address. /N routes to your router which routes the last K bits just like normal as if it had a /N-M to a /N route. This is a generic description of homogenous hierarchical routing.

by Veserv

3/15/2026 at 10:30:16 AM

If I understand it correctly, you're suggesting formalizing a way to make parts of the (host-specific) port canonically part of the network-wide address, no?

This still sounds like a very bad mixing of layers, even if done in a perfectly standardized and uniform way.

> It is always a mystery how people just randomly misinterpret what I write.

If this is intended literally and not as a general complaint: My main problem of understanding your suggestion is that I don't know what you mean by "IP+NAT address". NAT is a translation scheme, not an address.

Maybe it would be clearer if you could provide an example?

by lxgr

3/15/2026 at 6:31:34 PM

I did provide a example:

> You get a lease for a /N+K address. /N routes to your router which routes the last K bits just like normal as if it had a /N-M to a /N route.

> This still sounds like a very bad mixing of layers, even if done in a perfectly standardized and uniform way.

No, I am describing a generalization of IP to arbitrary concatenated routing prefixs.

NAT has the same problems as if we lived in a alternate world where we decomposed IPv4 into 4 8-bit layers and then used a different protocol for each layer. That is obviously stupid because the subdivision of a /8 into /16s and a /16 into /24s is fractally similar. You can just use the same protocol 4 times. Or even better, use one protocol (i.e IP) that just handles arbitrary subdivision.

In the IPv4 (no NAT) world your application has a 49-bit address. Your router is running a DHCPv4 server and allocates your computer a /32 and your computer is “running” a DHCPvPort server that allocates a 17-bit prefix to your applications.

In the IPv4+NAT world your application has a 49-bit address. Your router is “running” a DHCPv4+Port server and allocates your applications a /49, but only tells them their /32 and then rewrites the packets because the applications do not know their address because the stupid router did not tell them.

In good world your application has a 49-bit address. Your router is “running” a DHCPv4+Port server and allocates your applications a /49 and tells them their /32 prefix and 17-bit segment. No packet rewriting is necessary.

Your router could also choose to allocate your computer a /32 subnet and leave DHCPvPort to your computer. Or it could give your computer a /31 if you have 8 interfaces. Or a /34 as a /32 subnet with 2-bit port prefix. Each node routes as much or as little routing prefix as it understands/cares about.

This is a generalization of IP that can handle arbitrary-length, arbitrarily-concatenated routing in a completely uniform manner and all the pieces are basically already there, just over-specialized.

by Veserv

3/15/2026 at 5:12:45 PM

The original SOCKS proxy specification was something like this. You'd LD_PRELOAD a library that would make the application think it was running directly on the proxy server, and it supported both connecting outbound and listening.

by gzread

3/15/2026 at 12:08:36 PM

I didn’t see it as mysterious. 25 years ago, the problem as stated went through lots of consensus to become IPv6. It took a few years for SLAAC to emerge. But we don’t need it to be homogeneous; the router advertises different feature levels via ICMPv6.

by enoint

3/15/2026 at 10:14:36 AM

NAT allocates ports. If you reserve a port, that's old good port forwarding.

by GoblinSlayer

3/15/2026 at 10:01:43 AM

Assuming IPv6 kills NAT is optimistic, plenty of orgs still stack private addressing and firewalls on top.

by hrmtst93837

3/15/2026 at 10:46:02 AM

Firewalls aren't nearly as bad as NAT.

by lxgr

3/15/2026 at 10:59:00 AM

Basically the same thing. If you legitimately need to establish a connection then put a firewall rule in, whether that needs nat or pat is a function of your available addresses.

If you are tying to work around your firewall because it isn’t yours, that’s not a legitimate use.

by hdgvhicv

3/15/2026 at 11:55:38 AM

Love it when random people tell me whether my use case is legitimate or not without apparently even knowing it exists!

Take mobile data connections, for example: Most people don't want to pay for metered (by the byte) inbound traffic they didn't ask for that also drains their battery, but do want to be able to establish P2P connections for lower latency VoIP etc.

This is a firewall that's definitionally "not theirs", but that still also serves their interests, yet usually doesn't offer any user-accessible management interface.

So may I please traverse this firewall now, or is my use case still illegitimate?

by lxgr

3/15/2026 at 12:31:27 PM

If you are trying to break through a firewall you don’t own then that’s not legitimate.

If you are buying firewall as a service then request a user interface or change your service provider.

by hdgvhicv

3/15/2026 at 1:11:30 PM

Are you even acknowledging my example? Where does it exist in your bimodal model of reality of "my firewall" and "somebody else's firewall"?

What provider would you suggest somebody wanting to make VoIP calls on their smartphone switch to that allows port forwarding of the kind you describe? And which popular VoIP app would support statically forwarded ports like that?

by lxgr

3/15/2026 at 5:13:28 PM

P2P traffic is illegitimate according to you? Like Skype calls? You think Skype should not exist? (Well it doesn't exist any more, but whatever replaced it)

by gzread

3/16/2026 at 9:19:14 AM

I have no problem with p2p traffic as I can open whatever holes I want in my firewall.

I can’t do it on someone else’s network as they have granted me a limited access and do big slow me to open such holes.

by hdgvhicv

3/16/2026 at 4:47:26 PM

You think Skype shouldn't work on other people's networks?

by gzread

3/15/2026 at 12:34:00 PM

You're assuming that the firewall was configured correctly or that the firewall admin is cooperative. That's a big ask.

On the other hand, there is plenty of badly written networked software. I bet most of the networked software developers have no idea how to correctly plumb their software. They just open whatever connection, e.g. sockets, their OS provides and just run with it without care of the underlying layers. The OSI model theory in fact encourages this ignorance.

by ufocia

3/16/2026 at 9:21:10 AM

If I get someone else to administer my firewall then they had better be cooperative or I will replace them.

Typically these complaints come from people using other people’s firewalls against the policy of that firewall.

by hdgvhicv

3/15/2026 at 7:35:26 AM

Why not use plain IPv6 instead?

by eptcyka

3/15/2026 at 12:03:04 PM

Even with IPv6 you still might have stateful firewalls allowing only for outbound connection at both ends (e.g. a CPE a.k.a. “WiFi router”) and to establish communication you’d need to punch a hole in those firewalls.

by TuxPowered

3/15/2026 at 3:33:10 PM

That’s true we won’t get rid of hole-punching with IPv6. But at least it will get rid of TURN.

by brewmarche

3/15/2026 at 5:14:30 PM

The hole punching is so much simpler because you don't need to guess your own address and port - you just know it

by gzread

3/16/2026 at 1:52:48 AM

Doesn't that assume that your machine is given its own world-routable (and unfiltered) v6 address?

by ranger_danger

3/16/2026 at 2:25:19 AM

That's how it works in ipv6. If your network doesn't give you an address, it's broken. We do not assume unfiltered since we are talking about hole punching.

by gzread

3/16/2026 at 1:54:46 AM

How will it get rid of TURN? Can't IPv6 addresses still be firewalled by your carrier like they do already for IPv4?

by majorchord

3/15/2026 at 7:52:40 AM

it's been already done ISPs just don't properly implement it (NAT-PMP and it's relatives)

by takipsizad

3/15/2026 at 3:48:06 PM

If only router manufacturers could be trusted to implement UPnP safely, then none I'd this bullshit would be necessary.

At least with IPv6 this crap becomes a little easier because you no longer have randomized source ports (which this article just ignores because some devices indeed maintain the same source port) and the IP address contains all the routing information you need. A simple simultaneous open is all you need.

by jeroenhd

3/15/2026 at 5:15:02 PM

If you use UDP transport you don't even need to try to make it simultaneous.

by gzread

3/15/2026 at 9:10:40 AM

Hole punching is doing exactly what you describe, just in a non-standardized way.

We could have a standard for doing that directly at the NAT box level instead of relying on a third party STUN server, it simply didn't happen (and in fairness, the benefits would be quite minimal).

by littlestymaar

3/15/2026 at 12:29:22 PM

Looks like a typo in the degraded timestamp “bucket”. That “window” value should be based on the min threshold.

by enoint

3/15/2026 at 12:53:14 PM

Dudes: IPv6, please, come on, meh.

by sylware

3/16/2026 at 1:55:41 AM

maybe in another 20 years my local monopoly will consider IPv6 adoption, but I'm not holding my breath

by majorchord

3/16/2026 at 12:50:11 PM

You live in one of those places... sad for you.

In my country: only a few mobile ISPs are not yet native IPv6. The thing now would be to get a fixed IPv6 for mobile internet (which would remove the need of a name->IP "resolver"), but I wonder if the mobile ISPs can handle the quality of "security" this requires. (we all know about enshitific*tion).

by sylware

3/15/2026 at 12:02:49 PM

Meh. "It is assumed another process will coordinate the running of this tool." Coordination is the crux of the problem for fast convergence. Otherwise you're stuck with an infinity cubed, hypercubed, or worse problem.

by ufocia

3/16/2026 at 1:49:40 AM

[flagged]

by stainlu

3/15/2026 at 7:32:58 PM

[dead]

by andrewmcwatters

3/15/2026 at 9:14:02 AM

[flagged]

by elophanto_agent

3/15/2026 at 9:32:06 AM

This is an AI slop bot

by mudkipdev

3/15/2026 at 11:40:12 AM

That's fine, it's pretty good slop and from the comments history even entertaining at times.

> my grandmother had a cookie jar collection and I always thought it was weird until I realized she was basically running a primitive NFT gallery except the tokens were actually useful because they contained cookies

by vntok