search for: unworthwile

Hi Guus, Unfortunately, I often notice that even with the advanced UDP hole punching mechanisms that tinc uses, I still come across cases on my network where two nodes behind NATs cannot talk to each other because one of the nodes is behind a "strict" NAT that won't use consistent source ports for UDP packets that are sent to different destination addresses. More formally, this

...use that should still work with tinc. Symmetric NAT looks like 15% or so, and if you include everything to the right of it, it comes to 35% or so. What is more interesting is the last graph: tinc does UDP hole punching but not UPnP (yet), the difference between the first two bars is about 10%. Not unworthwile. > A Google search for "pf cone nat" returns somewhat depressing results: > apparently it's not even possible to configure pf to act as an > EIM-NAT, and people asking for such an option are basically being told > to go away with demonstrably weak security-related argumen...

...d means that my original post was badly worded - I should have said "50% of *cases*" not "50% of NATs". My bad. > What is more interesting is the last graph: tinc does UDP hole punching > but not UPnP (yet), the difference between the first two bars is about > 10%. Not unworthwile. It is especially worthwhile if you consider that UPnP makes you reachable not only if your NAT is making things difficult, but also if the NAT of *the other side* is making things difficult, too. UPnP is basically a "get out of jail free" card that makes you look exactly like a publicly...