Skip to content

Commit 663a37d

Browse files
authored
update: tweaks to autonat (#283)
1 parent cbfaa8f commit 663a37d

File tree

1 file changed

+59
-26
lines changed

1 file changed

+59
-26
lines changed

content/concepts/nat/autonat.md

Lines changed: 59 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -9,45 +9,78 @@ aliases:
99

1010
## Background
1111

12-
While the [identify protocol][spec_identify] lets peers inform each other about their observed network
13-
addresses, however, it is possible that some of these addresses are not accessible from outside the network, as the peer may be located in a private network that is behind a [NAT](overview.md) and therefore unreachable.
12+
While the [identify protocol](/concepts/introduction/protocols/identify)
13+
allows peers to inform each other about their observed network addresses,
14+
sometimes these addresses are inaccessible as the peer may be located in a
15+
private network (i.e., behind a NAT or a firewall).
1416

15-
To prevent this problem of advertising undialable addresses, libp2p has implemented a protocol called AutoNAT, which allows nodes to determine
16-
whether or not they are behind a NAT.
17-
Furthermore, this lays the foundation for nodes to find a way to improve their connectivity to peers in public networks.
17+
{{< alert icon="" context="info">}}
18+
Advertising addresses that are not reachable is detrimental for the health of a
19+
P2P network, as other nodes will unsuccessfully try to dial those addresses wasting
20+
compute and network resources.
21+
{{< /alert >}}
22+
23+
To prevent this problem of advertising and dialing unreachable addresses,
24+
libp2p has implemented a protocol called AutoNAT,
25+
which allows nodes to determine whether or not they are behind a NAT.
1826

1927
## What is AutoNAT?
2028

21-
AutoNAT allows a node to request other peers to dial its presumed public addresses. If a few of these
22-
dial attempts are successful, the node can be reasonably ascertain that it is not behind a NAT. On the other
23-
hand, if a few of these dial attempts fail, it strongly indicates that a NAT is blocking incoming connections.
29+
AutoNAT allows a node to request other peers to dial its presumed public addresses.
30+
31+
For private nodes located behind a NAT, it is strongly recommended:
32+
to:
33+
34+
- Not advertise private addresses
35+
- Get a reservation with a relay to improve connectivity to public networks
36+
and advertise relay addresses instead.
37+
38+
For public nodes, it is suggested to:
2439

25-
The AutoNAT protocol uses the protocol ID `/libp2p/autonat/1.0.0` and involves the exchange of `Dial` and
26-
`DialResponse` messages.
40+
- Start a relay to assist other nodes
41+
- Consider activating DHT server mode to improve connectivity to public
42+
networks.
43+
44+
If most of these dial attempts are successful, the node can be reasonably sure
45+
that it is not behind a NAT. On the other hand, if most of these dial attempts fail,
46+
it strongly indicates that a NAT is blocking incoming connections.
47+
48+
{{< alert icon="" context="">}}
49+
Currently, AutoNAT cannot test individual addresses,
50+
but a [proposal](https://github.com/libp2p/specs/issues/503) for AutoNAT v2 aims to
51+
add this capability.
52+
{{< /alert >}}
53+
54+
The AutoNAT protocol uses the protocol ID `/libp2p/autonat/1.0.0` and involves
55+
the exchange of `Dial` and `DialResponse` messages.
2756

2857
To initiate the protocol, a node sends a `Dial` message to another peer containing
29-
a list of multiaddresses. The peer then attempts to dial these addresses using a different IP and peer ID
30-
than it uses for its regular libp2p connection. If at least one of the dials is successful, the peer sends a
31-
`DialResponse` message with the `ResponseStatus`: `SUCCESS` to the requesting node.
58+
a list of multiaddresses. The peer then attempts to dial these addresses using a
59+
different IP and peer ID than it uses for its regular libp2p connection.
60+
If at least one of the dials is successful, the peer sends a `DialResponse` message
61+
with the `ResponseStatus`: `SUCCESS` to the requesting node.
3262

33-
If all dials fail, the peer sends a `DialResponse` message with the `ResponseStatus`: `E_DIAL_ERROR`.
34-
The requesting node can use the response from the peer to determine whether or not it is behind a NAT.
35-
> If the response indicates success, the node is likely not behind a NAT and does not need to use a relay
36-
> server to improve its connectivity. If the response indicates an error, the node is likely behind a NAT
37-
> and may need to use a [relay server](dcutr.md) to communicate with other nodes in the network.
63+
If all dials fail, the peer sends a `DialResponse` message with the `ResponseStatus`:
64+
`E_DIAL_ERROR`. The requesting node can use the response from the peer to determine
65+
whether or not it is behind a NAT.
66+
> If the response indicates success, the node is likely not behind a NAT and does
67+
> not need to use a relay server to improve its connectivity. If the response indicates
68+
> an error, the node is likely behind a NAT and may need to use a
69+
> [relay server](/concepts/autonat/dcutr) to communicate with other nodes in the network.
3870
3971
{{< alert icon="" context="caution">}}
40-
To prevent [certain types of attacks](https://www.rfc-editor.org/rfc/rfc3489#section-12.1.1), libp2p implementations of AutoNAT must not dial any multiaddress that
41-
is not based on the IP address of the requesting node AND must not accept dial requests via relayed
42-
connections (because it is not possible to validate a node's IP address that arrives via a relayed connection).
72+
To prevent
73+
[certain types of attacks](https://www.rfc-editor.org/rfc/rfc3489#section-12.1.1),
74+
libp2p implementations of AutoNAT must not dial any multiaddress that
75+
is not based on the IP address of the requesting node AND must not accept dial
76+
requests via relayed connections (because it is not possible to validate a node's
77+
IP address that arrives via a relayed connection).
4378

44-
This is to prevent amplification attacks, in which an attacker provides many clients with the same
45-
faked [MAPPED-ADDRESS](https://www.rfc-editor.org/rfc/rfc3489#section-11.2.1) that points to the intended target, causing all traffic to be focused on the
46-
target.
79+
This is to prevent amplification attacks, in which an attacker provides many clients
80+
with the same faked [MAPPED-ADDRESS](https://www.rfc-editor.org/rfc/rfc3489#section-11.2.1)
81+
that points to the intended target, causing all traffic to be focused on the target.
4782
{{< /alert >}}
4883

4984
<!-- ADD DIAGRAM -->
5085

5186
{{< alert icon="💡" context="note" text="See the AutoNAT <a class=\"text-muted\" href=\"https://github.com/libp2p/specs/blob/master/autonat/README.md\">technical specification</a> for more details." />}}
52-
53-
[spec_identify]: https://github.com/libp2p/specs/tree/master/identify

0 commit comments

Comments
 (0)