This article is a loose translation of a post in .
With the author's permission (and for clarity and interest), I have embellished it with links and added some personal insights.
Introduction
Currently, at least one user in a pair of connecting users must be in active mode. The NAT bypass mechanism will be useful when neither side has active mode set up. This usually happens due to incoming connection blocks by a firewall or a NAT device.
If both clients are in active mode
The initiating client sends a command containing its own IP address and port to the other client. Using this information, the receiving client establishes a connection with the initiator.
If one of the clients is in passive mode
Through the hub, the passive client A sends the command to the active client B, which then responds with the command $ConnectToMe.
As a server S the DC hub acts in the above case
If both clients are in passive mode on
Clients behind different NATs A and B joined the hub S.
This is how the connection to the hub looks from the client's perspective A
The hub accepts connections on port 1511. The client A makes outgoing connections from its private network through port 50758. The hub, in turn, sees the NAT device's address, works with it, and forwards to clients accordingly to their identifiers.
Client A sends a message to the server S requesting help to connect to the client B.
Hub: [Outgoing][178.79.159.147:1511] DRCM AAAA BBBB ADCS/0.10 1649612991
Also being in passive mode, the client B, upon receiving this command, must inform its private port used for connecting to the hub via NAT.
Hub: [Incoming][178.79.159.147:1511] DNAT BBBB AAAA ADCS/0.10 59566 1649612991
After receiving this information, the client A immediately tries to establish a connection with the client B and informs of its own private port.
Hub: [Outgoing][178.79.159.147:1511] D<b>RNT</b> AAAA BBBB ADCS/0.10 <b>50758</b> 1649612991What’s interesting? The interest lies in shifting the endpoint of the same connection by creating a new connection to the public address through an already used private port.
Bingo!
Certainly, the client’s NAT B has every right to reject the first connection request from the client A, but already its own request rushes into the 'hole' created by this very connection, and a connection is established.
An illustration suitable for the entire process with the qualification that does not use public ports opened by the session NAT‒S, as well as private addresses.
Epilogue
At the time of writing this article, approximately half of DC clients operate in passive mode. This means that a quarter of all possible connections cannot be established.
In the future , using existing connections A‒S and B‒S to establish a direct client-to-client connection, even if A and B they are in passive mode.
Source: habr.com
