1

With port forwarding, anyone can turn a computer into a server and use it to accept direct connections from any other computers on the internet (of course there's some server-side code running). That's great, but what about when someone doesn't have access to a physical router (as is the case for many people in apartments), or perhaps there isn't even one (many new kinds of internet connections have emerged, such as cell phone data, which operate differently)... I guess they're out of luck?

However, there is one simple situation which I still find very useful, for which something might be done: the connection is being made between two parties who know each other and have already exchanged IP addresses. Of course these IPs may change occasionally, but I don't consider this a great hindrance and there are many free DDNS services available if necessary. They also have agreed upon port numbers, or a method to run through port numbers until finding one that works. Neither of the parties has port forwarding available.

But look, the router or whatever is providing internet service must be capable of forwarding data sent from the address of a connection to whatever local computer established that connection, as happens in normal internet use. So let's say the following procedure occurs:

  1. One user says that it has established a connection with the other user's address, specifying both local and external ports to use, and the router (or whatever it is) therefore makes the appropriate action to direct data coming from that other user to this one. However, as the first user knows (but not the router), it didn't actually connect, and instead it is waiting and listening for a request from the other user.
  2. Meanwhile, the other user just tries to connect to the first one as any client would connect to a server, using the same ports (though swapped) as chosen by the first user.
  3. When the first one receives the request to form an actual connection, it sends the appropriate reply so that the second user's request for a connection is accepted.

It's possible that the actual code could just behave normally, with the first user as a server and the second as a client, but with the crucial part being that the first user's router (or whatever performs those duties) thinks that the first user is a client who first established a connection with the other user.

I do not see anything which makes this impossible, but I also do not see how it would be done. First the fact that the initial connection attempt was rejected would have to be ignored somehow (at least by the router). Second, the attempt to use that port again to listen for and accept a true connection would have to be allowed (somehow don't notify the router that those steps are occurring).

If this could be done, it would mean any internet-enabled device (rather than just home computers) could connect directly to any other enabled device, without the need for any third-party servers in between. These connections could be used to transfer files of arbitrary size directly, for instance, again without requiring third party servers. And the connection could do anything else a normal connection would do as well.

So I am here to ask, does anyone know how this could be done?

4
  • What you are trying to do is basically NAT punching. Several techniques are already in place for that, but they always need a third party server to initiate, as you need to guess the port number you will have once you have crossed the (potentially multiple) layers of NATs. NAT is there to solve IPv4 exhaustion, so once IPv6 is deployed, computers should once again have at least one globally routable address to establish direct communications to one another. Jan 19, 2014 at 8:42
  • @user2313067 That's interesting; in my scenario I assume each user knows the ports which will be chosen by the other, and I know it is possible to specify both internal and external ports used for a new connection at the application level. Does that change anything?
    – user11424
    Jan 20, 2014 at 18:52
  • And yes, ipv6 would solve the issue, whenever it's fully implemented. That will probably take another decade though o_O
    – user11424
    Jan 20, 2014 at 21:19
  • Okay, I see that "NAT traversal" (wikipedia) is essentially what I was asking about, and it is sometimes possible without a third-party host, though symmetric NATs can make it impossible altogether and would also ruin the procedure I proposed in the question.
    – user11424
    Jan 20, 2014 at 23:32

2 Answers 2

2

That's great, but what about when someone doesn't have access to a physical router

Generally all Internet traffic traverses multiple ISP and carrier-grade routers, none of which are usually physically accessible by the users.

Your fourth paragraph is a bit unclear. I think you don't understand how NAT works.

The reason why port forwarding is needed is due to NAT. NAT hides multiple systems behind 1 IP address. You can only talk to this 1 publicly visible IP address. If you want to get to anything behind this IP, you must go through this IP. You do not have a choice. Without the port forwarding, the NAT-enabled router does not know which machine behind it to send unsolicited incoming traffic to and will assume you are trying to talk to the router itself.

If you are talking about a program that accepts requests on behalf of a client behind it, the name for that is "proxy" and you can certainly do that. A router is a logical, but not necessarily best, place to have that running and accessible. There are proxies for many protocols, HTTP, SIP, etc.

When the first one receives the request to form an actual connection, it accepts

This would never happen. The "first one" is behind a NAT router, the NAT router receives the request at first, not anyone behind the router.

IPv6 fixes this by providing a large enough address space that NAT isn't necessary to preserve addresses.


There is no special protocol involved in NAT, it's all TCP/IP.

What is different from a standard non-NAT router is that, from the outside, nodes only see and know about the single public IP. As far as they know from a TCP/IP level, there is only one system on that IP sending out many requests. If nothing like Javascript, a proxy, or other application-level traffic is snitching on someone's private IP, then the outside cannot know the private IP.

The NAT facility must keep track of who initiated what connections (only behind it) so it can forward incoming traffic destined for itself to the appropriate host. (This is possible because each outgoing connection has a unique random source port, so it can simply map source ports to LAN destination addresses).

I think there was a program that tried to work the way you are saying by sending a NAT router an out-of-sequence TCP packet (the sequence is SYN, ACK, SYN-ACK) which may fool it. I have also heard of NAT routers that erroneously allow incoming TCP connections on ports that UDP traffic is sent.

But a good NAT implementation is going to check its internal tables for mapped connections, and drop the packet if it doesn't match anything it has seen from the inside. You can't count on implementation flaws to provide a reliable solution in the manner you are asking.

6
  • 1
    "NAT hides multiple systems behind 1 IP address." Yes, but when the user behind the router establishes a connection with any outside server, the router must acknowledge that connection in order to send incoming traffic (from the specific server IP) to the right user - how else would it be possible to receive any data from the internet when you are behind a router? My thought was to utilize that normal functioning in order to make a single connection.
    – user11424
    Jan 20, 2014 at 17:22
  • "unsolicited incoming traffic" - basically, by pretending that the connection is already established, the idea is that the connection request by the second user is not unsolicited, but rather the router treats it as the traffic of a normal connection between the user and some outside server (which is actually the second user).
    – user11424
    Jan 20, 2014 at 17:27
  • Some NAT routers may allow arbitrary source IPs to "sneak" in when a system behind a NAT makes any type of outgoing connection. You can't count on that, though.
    – LawrenceC
    Jan 20, 2014 at 17:36
  • Hm. I understand what I'm trying to do is against what most routers normally do. I don't suppose you know the protocol for a router to establish a connection? I guess that after the user behind the router sends out a request, the server replies to the router, at which point the router can accept the connection, and afterwards data coming from that server would be directed to the user given that the connection was established. Then if I can get the router to think it receives the reply, despite no actual server on the other end (second user instead), that would be the first step.
    – user11424
    Jan 20, 2014 at 17:49
  • See my edit. Too long for a comment. :)
    – LawrenceC
    Jan 20, 2014 at 18:55
0

If you don't have access to a router you can't run the program on it to do your direct connection scheme, even if you took the time to create the program. If you don't have a router then either:
A. there's no need to port forward since you have a direct connection.
B. It's not your network(1/2/3/4G) so you need to do a reverse connection or talk to the sysadmin.
I don't mean to say your idea is bad, because it defiantly isn't, but it's impracticable because if you have access to a router running openwrt where you could run your program to do this, then you might as well just forward the port.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .