Skip to content
Search

Hole punching

lastmod 2024-05-31created 2015-03-2619 edits

Hole punching (or sometimes punch-through) is a technique in computer networking for establishing a direct connection between two parties in which one or both are behind firewalls or behind routers that use network address translation (NAT). To punch a hole, each client connects to an unrestricted third-party server that temporarily stores external and internal address and port information for each client. The server then relays each client's information to the other, and using that information each client tries to establish direct connection; as a result of the connections using valid port numbers, restrictive firewalls or routers accept and forward the incoming packets on each side.

Hole punching does not require any knowledge of the network topology to function. ICMP hole punching, UDP hole punching and TCP hole punching respectively use Internet Control Message, User Datagram and Transmission Control Protocols.

Introduction to NAT traversal techniques (RFC 5128)

NAT Traversal

See the corresponding page.

Relaying

When ClientA and ClientB communicate, they may in some cases be placed under NAT (Network Address Translation). In this approach, a relay server is set up to relay their communication, and they communicate through the server. They can keep exchanging data as long as the connection is valid, but this wastes unnecessary bandwidth and consumes server resources.

Connection Reversal

When one client is behind a NAT and B tries to connect to A, connecting to A's private IP is of course impossible, and connecting to the NAT's public IP observed by server S is also impossible because the NAT only allows connections going out from A. So the relay server S is used to tell server S the public IP of B, and then A, in reverse, attempts to connect and establish the connection.

TCP Hole punching

UDP Hole punching

This is the case where both clients are each behind their own NAT. This case is further divided depending on whether the two clients are behind the same NAT or behind different NATs.

See also

Favorite site

References

  1. About_hole_punching_technology.pdf ↩

author Zer0 sitemap