NAT support for peer-to-peer games

NAT support for peer-to-peer games

[Serguei I. Ivantsov]

Hello!

I just interesting - whether something changes in Netfilter to support
peer-to-peer games.
How to implement the scheme described below using netfilter?

<from the article>
...
Here's how the hosts know where to send the packets:

1) There is a well-known server with a well-known port, not
behind any NAT or firewall. Its only purpose is to relay
the public and local addresses of all participants in a session
to each other. (A host's public address is the address/ UDP port pair
seen by the outside world; its local address is the pair it
thinks it has.)

2) To join the session, a new host sends its local address
to the well-known server. The server then stores the new
host's public address (from the UDP header) together with its
local address (embedded in the packet).
The list of all participants' public and local addresses are
then sent down to the new host. The new host notes its own public
address in the reply from the server.

3) The server sends the public and local address of the
new host to all existing participants.

4) The new host then sends a hello packet to both the public and
local addresses of each participant; likewise, the existing
participants all send hello packets to both the public and
local addresses of the new host. The packet contains
the sending host's public and local addresses.
These are analogous to TCP's SYN packet, and are retransmitted
periodically if no response is received (see below).

5) The act of sending a packet to the other participants
signals the firewall that a reply will be coming back along
the reverse path. It opens up a return path which just
reverses the source and destination address/ UDP port pairs.
This seems to be a common feature of many firewalls and
SOHO routers (e.g. the Cisco PIX). I don't know how
widespread it is. Is there any data on what firewalls
support this behavior?

6) For participants behind different firewalls / NATs / masquerading
hosts, one packet (the one sent to the peer's public address)
will make it through. For participants behind the same firewall / NAT /
masquerading host, the other packet (the one sent to the peer's
local address) will make it through.
For participants with two IP interfaces, one or the other packet
will make it through; it doesn't matter which.


The entire Dan Kegel article can be found here:

http://www.hasenstein.com/HyperNews/get/linux-ip-nat/97.html

--
 Serguei I. Ivantsov

Re: NAT support for peer-to-peer games

[Jason Opperisano]

On Tue, 2004-09-21 at 04:04, Serguei I. Ivantsov wrote:
> Hello!
> 
> I just interesting - whether something changes in Netfilter to support
> peer-to-peer games.
> How to implement the scheme described below using netfilter?
> 
> <from the article>

[ snip ]

DNAT the necessary ports on the outside of your netfilter box to the
host on the inside that your playing games from, and put a rule in the
FORWARD chain that allows the traffic as well.

example--game port is UDP 7777:

  iptables -t nat -A PREROUTING -i $EXTERNAL_IF -p udp \
    -d $EXTERNAL_IP --dport 7777 -j DNAT --to-destination $CLIENT_IP

  iptables -A FORWARD -p udp -d $CLIENT_IP --dport 7777 -j ACCEPT

adjust accordingly for you particular level of paranoia.

-j

-- 
Jason Opperisano <opie@817west.com>

Re: NAT support for peer-to-peer games

[Kenneth Porter]

--On Tuesday, September 21, 2004 11:04 AM +0300 "Serguei I. Ivantsov" 
<manowar@gsc-game.kiev.ua> wrote:

> How to implement the scheme described below using netfilter?

Note that the Linux-based Linksys WRT54G consumer router has "port 
triggering", which opens an inbound forwarding when an outbound packet 
matches a pattern. You could look at the implementation to see how Linksys 
did it. The code can be downloaded from Linksys' site.

Re: NAT support for peer-to-peer games

[Andy Furniss]

Serguei I. Ivantsov wrote:
> Hello!
> 
> I just interesting - whether something changes in Netfilter to support
> peer-to-peer games.
> How to implement the scheme described below using netfilter?
> 
> <from the article>

It's a bit old - 1998.

Andy.