Assume you have a host (hosta) that is running a TCP service (e.g. a VNC server on port 5901). You want to access to this service from another host (hostb) running a VNC client. Both hosts are connected to Internet, but there are some restrictions:
1. hosta can be reached from the Internet using any of its TCP ports
VNC client on hostb connects to hosta:5091 directly.
2. hosta can be reached from the Internet only through SSH
From hostb:
ssh -L 5901:localhost:5901 usera@hosta
VNC client on hostb connects to localhost:5901
3. hosta cannot be reached from the Internet (e.g. it is behind CGN / CGNAT). However, hostb can be reached from the Internet
From hosta:
ssh -R 5901:localhost:5901 userb@hostb
VNC client on hostb connects to localhost:5901
4. hosta and hostb cannot be reached from the Internet. They are behind CGN / CGNAT; they can only create outbound connections
We can use another host (hostc) which can be reached from the Internet using ssh.
From hosta:
ssh -R 5555:localhost:5901 userc@hostc
From hostb:
ssh -L 5901:localhost:5555 userc@hostc
VNC client on hostb connects to localhost:5901
I have a case like the 4th scenario above, but I do not wish to use a third host (hostc), mainly because of performance and cost reasons.
What are my alternative (cheaper [=free] and better performance) options?
Note 1: I have tested and determined that although TCP hole punching does not work in my case, UDP hole punching does work. However, I need a tool that will establish connection oriented (similar to TCP) session over UDP that will utilize UDP hole punching.
Note 2: Failing to use any of "UDP hole punching" programs available on the Internet, I decided to write my own. I am still improving it, but, as it is, it works fairly well. You can find it here.
