0

I have the following scenario. There are two users on their own home networks, with their own routers with the following settings.

User 1

  • Public IP of router - 111.111.111.111
  • Private IP of router (gateway) - 192.168.0.1
  • Subnet mask - 255.255.255.0
  • Local IP of connected device - 192.168.0.2

User 2

  • Public IP of router - 222.222.222.222
  • Private IP of router (gateway) - 192.168.0.1
  • Subnet mask - 255.255.255.0
  • Local IP of connected device - 192.168.0.3

Now, I want to understand how User 1 on their local device can connect to User 2 on their local device. My current understanding is that we have two options.

  • Option 1: Perform port forwarding on User 2's router with port 9000 for example to the local device port 9000. So that when User 1 wants to access the other computer, they could hit the endpoint 222.222.222.222:9000 which gets mapped to 192.168.0.3:9000 because of the port forwarding rule in User 2's which does static NAT (network address translation)
    • Is there a way to open all ports on the local device without having to do port forwarding individually for each server User 2 has running on their local device?
  • Option 2: Create a VPN (virtual private network) server on one of the local devices, let's say User 2's device, and have both users added on that VPN. Now both devices appear to be on the same local network and communicate with each other using their assigned IPs from the VPN server. (This should still require port forwarding I believe).

With this in mind, is there any other way that these two local devices can communicate with each other without the use of a 3rd party server? If a hacker were to gain access to your router from it's public IP, how could they get into your local machine without using one of the options I described above?

4
  • There's a lot to cover here. Lets start with the first question, if you were to drop the firewall on both router and user2 local machine you would effectively "opened all ports", but the destination machine must have a service or application that is actually "Listening" on any given port number to actually "hear" you reaching out to it. (This also assumes that the router is forwarding all port numbers to the local machine.) Any "hacker" would have all the same access rights as you. This would be a serious security flaw, amongst other issues. – Larryc May 17 at 21:59
  • Addressing would be another concern, user 1 would reach out to user 2 as 222.222.222.222:(port number) at all times, and never speak to it directly as 192.168.0.3(port number). There's just to much here to cover in the comments section. – Larryc May 17 at 22:04
  • @Larryc, yeah I should have clarified. When I said open all ports, I meant basically to connect to all listening services on user2 without having to map each port in user2's router. – nick2225 May 17 at 22:21
  • You could use a DMZ to map all incoming ports to a specific IP. That said the ideal would be to move one of the users lans off 192.168.0.0/24 - If you have routers that support it you can then set up a vpn to allow traffic between the networks to flow freely without resorting to hacks. – davidgo May 18 at 3:04
0

My current understanding is that we have two options.

Correct, those two options would work.

Is there a way to open all ports on the local device without having to do port forwarding individually for each server User 2 has running on their local device?

It depends on the type of "rules" your router allows for NAT, some can forward a range of ports to a specific IP (or all ports - basically a static NAT without PAT).

(This should still require port forwarding I believe).

You don't need port forward with the VPN option since the two machines are basically in a LAN with individual IP addresses.

is there any other way that these two local devices can communicate with each other without the use of a 3rd party server?

No, accept for giving those devices public IP addresses, which would get rid of the port forwarding.

how could they get into your local machine without using one of the options I described above?

They could try to find a security hole within the services that can be accessed over the internet. First they need to access the service itself (e.g. by brute force) from there it really depends on the service. If we are talking about a remote shell service with admin right they would have access right away.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.