Penetrate the Intranet, connect to dynamic IP addresses, and penetrate the Intranet IP address-P2P implementation principle

I found a lot online,CodeThere are not many details about the principles.

I 'd like to explain a few articles.

One TechnologyArticle, The most important thing is to clarify the principle, if there is a complete operationSource codeAlso, the key is to clearly analyze the core part of the code.

(1) origin:

Most computers use dynamic IP addresses to access the Internet. Intranet IP addresses are allocated by net (routes and gateways). When net is sent, It is mapped to a public IP address. This is a process of dynamic calculation (especially the port number ), therefore, it is called a dynamic IP address. External networks cannot directly access computers on the Intranet. However, in most cases, a computer with a public IP address (called a server) can be connected in some way, this technology is more "hitting holes ".

(2) Dynamic IP analysis:

 

There is a private network 192.168.0.2, Client A is one of the computers, the Network Gateway Nata (a NAT device)'s Internet IP address is 202.103.142.29 (there should be an intranet IP address, for example, 10.0.0.10 ). If a process in Client A (this process creates a socket, this socket is bound to port 1234) wants to access port 2000 of the Internet host 129.208.12.38, so what will happen when a packet passes through Nat?

Nat changes the original IP address of the packet to 202.103.142.29. Next, Nat creates a session for this transmission (session is an abstract concept. If it is TCP, the session may start from a SYN Packet and end with a FIN packet. For UDP, it starts with the first UDP port of the IP address. The end is uncertain. It may be a few minutes or hours. It depends on the specific implementation) and assign a port for the session, such as 62000, and then change the source port of the packet to 62000. So it was

(192.168.0.2: 1234-> 129.208.12.38: 2000)

To the Internet.

(202.103.142.29: 62000-> 129.208.12.38: 2000 ).

Once a session is created, Nat remembers that port 62000 corresponds to port 1234 of 192.168.0.2. data sent from 129.208.12.38 to port 62000 will be automatically forwarded to 192.168.0.2 by Nat. (Note: data sent from 129.208.12.38 to port 62000 will be forwarded,Data sent from other IP addresses to this port will be discarded by Nat, which is a real headache.In this way, client a establishes a connection with server S1.

If the original socket of Client A (the UDP socket bound with port 1234) then sends a UDP packet to another server S2, what will happen when this UDP packet passes through Nat?

The answer is determined by net, and different net have different answers.

Here we need to introduce the NAT type:
The type of NAT device has a very important impact on tcp nat traversal. According to the port ing method, Nat can be divided into the following four categories. The first three Nat types can be collectively referred to as the cone type.
(1) Full Cone: Nat maps all requests from the same internal IP address and port to the same external IP address and port. Any external host can send IP packets to the internal host through the ing.
(2) Restricted Cone: Nat maps all requests from the same internal IP address and port to the same external IP address and port.However, an internal host can only send an IP packet to an external host whose IP address is X.
(3) Port restricted Cone: the port restriction clone is similar to the restriction clone,Only the port number restriction is added.That is, only an internal host sends an IP packet to an external host whose IP address is X and whose port number is P can send an IP packet whose source port number is P to the internal host.
(4) symmetric NAT: This type of NAT is different from the preceding three types, when the same internal host uses the same port to communicate with the external host with different addresses, Nat maps the internal host differently. Symmetric Nat does not guarantee the consistency between the private and public IP addresses in all sessions. Instead, it assigns a new port number for each new session.

The first is the most ideal. Basically, no holes are needed;

The fourth type is the worst. The good news is that this type of net basically does not exist.

So the key is the second and third net types.

Therefore, the essence of holes is to use the net feature"Only when an internal host sends an IP packet to an external host whose IP address is X can the external host send an IP packet to the internal host."

(3) implementation steps (each implementation may be different)

Let's assume that there is a server s there is an IP address on the public network, two private networks are connected to the public network by the NAT-A and NAT-B, there is a client a behind the NAT-A, there is a client B behind the NAT-B, now, we need to use s to establish a direct TCP connection between A and B, that is, B to a hole, let a connect directly to host B along this hole, as if the NAT-B does not exist.
The implementation process is as follows:
1. s starts two network listeners. One is the listener of the primary connection and the other is the listener of the assisted hole.
2. A and B maintain contact with the master connection of S.
3. When a needs to establish a direct TCP connection with B, first connect to the "assist hole" Port of S and send a request for assistance with the connection. At the same time, start listening on the port number (ensure that the net type 3 can also be successful) . Note that to bind a socket to the same network terminal, you must set the so_reuseaddr attribute (that is, allow reuse) for these sockets. Otherwise, the listening will fail.
4, s [assist hole] After receiving the application of a through the [master connection] to notify B, and a after the NAT-A conversion of public network IP address and port information to B.
5. B First connects to the "assist hole" Port of s after receiving the connection notification from S, and disconnects immediately after sending some data, the purpose of this is to let s know the Internet IP address and port number of B after NAT-B conversion.
6, B tries to connect to a's public IP address and port after NAT-A conversion (this is the so-called "hole ") According to different vrouters, some vrouters can establish connections in this operation (for example, the tplink R402 I use ), most routers directly discard the SYN request packet that is not from, leading to connect failure, but the NAT-A will record the source address and port number of the connection, to prepare for the next real connection, this is called a hole, that is, B has made a hole in a, and next time a can directly connect to the port number that B just used.
7. Start listening on the same port while logging in to client B. B. After everything is ready, reply to the message "I am ready" through the master connection with S ", s tells a after receiving the Internet IP address and port number of B after NAT-B conversion.
8. After receiving the Internet IP address and port number of B replied by S, A starts to connect to Internet IP address and port number of B, since B tried to connect to a's public IP address and port in step 6, the NAT-A records the information of this connection, so when a actively connects to B, the NAT-B will think of it as valid SYN data and allow it to be established through a direct TCP connection.

(4) Enable Intranet hosts as servers

The above applications mainly involve P2P software. If we want to use a home computer as a server, we do not need this technology ("hitting holes, therefore, we can set the vro to net1 and directly set port ing:

However, a server with an Internet fixed IP address is still required to notify other customer service terminals, because the IP address obtained during dialing (this is actually an Internet IP address, that is, other computers can directly access you) it changes every time.

(5) What is a peanut shell?

Peanut shells map the changed IP addresses to domain name service providers with fixed domain names. If you do not need domain name services, you only need to use IP addresses to access applications (such as databases ), you cannot use this software.

But there is another way. If you already have a server with a static IP address, deploy a proxy server (such as nginx) on it, and then notify it of this dynamic IP address.