search for: nattest

On 10 February 2015 at 09:02, jg <webaccounts173 at jgoettgens.de> wrote: > > >> >> I get an occasional similar problem, we have Mikrotik firewalls and from >> tcpdump monitoring on the asterisk boxes I can see that the firewall >> (unbidden) has changed the IAX port. Usually a firewall reset and sometimes >> PBX reset combination fixes it. >>

...uot; (as opposed to "full cone NAT"). This type of NAT will stop any UDP hole punching attempt dead in its tracks, and there's nothing we can do about it. According to an online NAT check service, around 50% of NATs in the wild have this problem, making this a very real issue: http://nattest.net.in.tum.de/results.php I have at least two examples of users on my network who are hitting this issue: one is using an ISP-provided home router based on a model from ZTE (ZXHN H298N), the other one is using pfSense. The latter is especially worrying, since I would expect it to be used as the ba...

> > Some firewalls have a 'consistent NAT' option that needs to be enabled, otherwise you get the > symptoms described. > While reading about NAT, I came across this web site: http://nattest.net.in.tum.de/ The test tool looks at various NAT related properties and prints the results related to TCP/UDP binding properties, TCP/UDP hole punching, etc. In my case a very short value was reported for the UDP timeout, such that depending on the sequence of packets, the entry in the mapping...

...ary 2015 at 12:55, jg <webaccounts173 at jgoettgens.de> wrote: > >> Some firewalls have a 'consistent NAT' option that needs to be enabled, >> otherwise you get the symptoms described. >> >> While reading about NAT, I came across this web site: > http://nattest.net.in.tum.de/ > The test tool looks at various NAT related properties and prints the > results related to TCP/UDP binding properties, TCP/UDP hole punching, etc. > > In my case a very short value was reported for the UDP timeout, such that > depending on the sequence of packets, the...

..." NAT [...]. This type of NAT > will stop any UDP hole punching attempt dead in its tracks, and > there's nothing we can do about it. > > According to an online NAT check service, around 50% of NATs in the > wild have this problem, making this a very real issue: > http://nattest.net.in.tum.de/results.php Are you referring to port restricted NAT in the first graph? Because that should still work with tinc. Symmetric NAT looks like 15% or so, and if you include everything to the right of it, it comes to 35% or so. What is more interesting is the last graph: tinc does UDP h...

...ovember 2015 at 21:29, Guus Sliepen <guus at tinc-vpn.org> wrote: > On Wed, Nov 11, 2015 at 09:04:20PM +0000, Etienne Dechamps wrote: >> According to an online NAT check service, around 50% of NATs in the >> wild have this problem, making this a very real issue: >> http://nattest.net.in.tum.de/results.php > > Are you referring to port restricted NAT in the first graph? Because > that should still work with tinc. Symmetric NAT looks like 15% or so, > and if you include everything to the right of it, it comes to 35% or so. Hmm. Well I was only looking at the thir...