undefined | Better HN

0 pointsbewo0012y ago0 comments

Most of the applications that could communicate peer-to-peer use relay servers that make delay and scalability worse. Some combinations of NAT may sometimes work without a relay server, but figuring this out is complex and increases connection setup time. Every early SIP/VoIP user had the 'the connection only works in one direction' experience, usually caused by NAT.

A CGNAT is a stateful component which makes it expensive to operate. Failover to a backup is hard, as is scalability with this kind of components. And then there are legal requirements. You have to know what user had which IP address at a given time. I'd rather invest in dual stack instead.

0 comments

simiones2y ago

Peer-to-peer still wouldn't work even in a fully IPv6 world without something like STUN or TURN, since endpoints would still be protected by stateful firewalls preventing external connections to them.

bewo001OP2y ago

With a firewall, the application knows its public-facing ipv6 address/src port number without STUN. A stateful firewall does not alter packets.

It can open the firewall simply by sending something. If it can communicate its public-facing ipv6 address/src port number to the remote side using a SIP proxy (ok, for this signalling, you need a relay), it can receive traffic. No TURN needed either.

What scenario do you have in mind?

simiones2y ago

If the two peers are each behind its own stateful firewall (as would be common with something like BitTorrent), then you still need some 3rd party server accessible to both of them that either relays traffic between them, or at least allows them to negotiate the port pair that they'll communicate on (so that the one which will accept the TCP connection can send a TCP SYN with the other's source port as destination).

The second option may not even work with more paranoid firewalls, which might not allow TCP SYN packets on existing connections.

j / k navigate · click thread line to collapse

0 comments

simiones2y ago

bewo001OP2y ago

With a firewall, the application knows its public-facing ipv6 address/src port number without STUN. A stateful firewall does not alter packets.

What scenario do you have in mind?

simiones2y ago

The second option may not even work with more paranoid firewalls, which might not allow TCP SYN packets on existing connections.

j / k navigate · click thread line to collapse