[WireGuard] NAT-T Keepalives

[Bruno Wolff III]

On Thu, Jul 07, 2016 at 18:33:11 +0200,
  "Jason A. Donenfeld" <Jason at zx2c4.com> wrote:
>
>The most bootleg solution for this is to just run "ping $server" from
>userspace. What a disgusting fix.

This also forces encrypted traffic, which your solution would avoid.

>1. What should the payload be? Should it be a single fixed byte? Or
>should it be a zero length UDP packet?

The packet doesn't even need to make it to the endpoint, just through 
the NAT or firewall. So you don't want something that would get blocked 
by those. I don't know of anything that would be likely to. Otherwise 
you probably want minimum resources expended by the end points producing 
and receiving the packet.

>5. Is there a good resource for real world NAT mapping timings found
>in the wild?

Our NAT defaults to one minute for random UDP ports. So 30 seconds seems 
like a reasonable time if there isn't much packet loss.

>What are your thoughts?

It sounds like a nice improvement.