[WireGuard] [ANNOUNCE] Snapshot `experimental-0.0.20160708.1` Available
Bruno Wolff III
bruno at wolff.to
Fri Jul 8 18:23:37 CEST 2016
On Fri, Jul 08, 2016 at 16:37:23 +0200,
"Jason A. Donenfeld" <Jason at zx2c4.com> wrote:
>== Changes ==
> * persistent keepalive: start sending immediately -- the previously released
> feature was not useful without this extra commit. So, getting this in here
> now so that people can actually test this out. Sorry for the churn. Don't
> bother packaging the previous snapshot.
I tried this an noticed a problem. The keep alive packets don't set the
reply IP address and port for the endpoint. (Which makes sense since they
aren't authenticated.) So in the case of nat, where you won't know what
the port is (and in some cases the IP address as well) you still can't
connect to the end point behind the nat until there is some authenticated
data sent from the end point.
So if nat changes the port at some point, in order to reestablish a path,
you need to send authenticated data. I am not thinking of an obvious way
to tell when you just need to hold the port mapping via nat open versus
when you need to send authenticated data to rebuild a connection after
a port or IP address change from nat.
More information about the WireGuard