Understanding port forwarding and NAT

Question

I've got some confusion about port forwarding vs NAT. I know the problems NAT causes for P2P, and that there exist some solutions to it (STUN,TURN,etc) which require a relay server to setup direct connections between the peers.

Is port forwarding an alternative to STUN/TURN regarding the NAT problem? Can two peers behind NAT who have both port forwarded connect with TCP to each other directly? For example I want to develop an app and I'd rather not have to have a server sitting 24/7 to relay connections, but instead having peers maybe do port forwarding and then they can speak to each other directly.

Answer 1

Two peers behind a NAT, using DNAT (or "port forwarding") aren't technically behind the NAT anymore.

When this scheme is used, connecting to the public IP makes the NAT box forward the packets to an internal system. So, to everyone involved, it looks just like the internal machine is actually not behind the NAT. So if at least one of the peers is using this scheme, STUN is no longer needed.

Of course, the fact that the NAT box mangles packets introduces lots of problems, but if you don't include IPs and ports in your messages you should be fine.

Another problem with this scheme is that you need the cooperation of the NAT box administrator, which isn't always easy to get.

Answer 2

This is quite complicated... Also, based as it was on Stack Overflow, I am assuming you want to know this from a programming perspective and what you need to do for communication between clients.

... NAT is the process of having a single (or more) IP addresses one side of a network, and then forwarding any port on any of those addresses to any internal address.

Most NAT devices have a default rule of allow all outgoing and only allow named incoming.

A STUN or similar server basically means that both machines make an outgoing request and the server sort of acts as a proxy so neither client needs to set up an incoming rule.

If you do not want to set something like this up, I would recommend in your program, you design it so you let people know what ports they need to open (so only one person needs to do configuration), or alternatively, look in to UPnP which has techniques that allow you to programatically open ports in some firewalls.

Answer 3

Can two peers behind NAT who have both port forwarded connect with TCP to each other directly?

A peer behind NAT can initiate a connection from itself to outside, but the reverse can't happen unless port forwarding is setup.

With ports forwarded, either host can initiate a connection to the other host with nothing in the middle, but only on that specific port.

but instead having peers maybe do port forwarding

First, if your app supports mobile users from cellular ISPs, it's likely they are behind a "carrier grade NAT" (CGNAT) and the NAT is ISP-controlled. They're not going to be able to make their cellular provider forward ports. There are also landline ISPs that have CGNAT.

UPnP is a scheme to allow applications to ask routers to open ports. Security conscious individuals may not have this enabled.

Second, maybe users want to use your app on a guest Wifi network they don't control, or from their work network if policies allow.

Requiring users to port forward limits your user base.