You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/concepts/nat/autonat.md
+59-26Lines changed: 59 additions & 26 deletions
Original file line number
Diff line number
Diff line change
@@ -9,45 +9,78 @@ aliases:
9
9
10
10
## Background
11
11
12
-
While the [identify protocol][spec_identify] lets peers inform each other about their observed network
13
-
addresses, however, it is possible that some of these addresses are not accessible from outside the network, as the peer may be located in a private network that is behind a [NAT](overview.md) and therefore unreachable.
12
+
While the [identify protocol](/concepts/introduction/protocols/identify)
13
+
allows peers to inform each other about their observed network addresses,
14
+
sometimes these addresses are inaccessible as the peer may be located in a
15
+
private network (i.e., behind a NAT or a firewall).
14
16
15
-
To prevent this problem of advertising undialable addresses, libp2p has implemented a protocol called AutoNAT, which allows nodes to determine
16
-
whether or not they are behind a NAT.
17
-
Furthermore, this lays the foundation for nodes to find a way to improve their connectivity to peers in public networks.
17
+
{{< alert icon="" context="info">}}
18
+
Advertising addresses that are not reachable is detrimental for the health of a
19
+
P2P network, as other nodes will unsuccessfully try to dial those addresses wasting
20
+
compute and network resources.
21
+
{{< /alert >}}
22
+
23
+
To prevent this problem of advertising and dialing unreachable addresses,
24
+
libp2p has implemented a protocol called AutoNAT,
25
+
which allows nodes to determine whether or not they are behind a NAT.
18
26
19
27
## What is AutoNAT?
20
28
21
-
AutoNAT allows a node to request other peers to dial its presumed public addresses. If a few of these
22
-
dial attempts are successful, the node can be reasonably ascertain that it is not behind a NAT. On the other
23
-
hand, if a few of these dial attempts fail, it strongly indicates that a NAT is blocking incoming connections.
29
+
AutoNAT allows a node to request other peers to dial its presumed public addresses.
30
+
31
+
For private nodes located behind a NAT, it is strongly recommended:
32
+
to:
33
+
34
+
- Not advertise private addresses
35
+
- Get a reservation with a relay to improve connectivity to public networks
36
+
and advertise relay addresses instead.
37
+
38
+
For public nodes, it is suggested to:
24
39
25
-
The AutoNAT protocol uses the protocol ID `/libp2p/autonat/1.0.0` and involves the exchange of `Dial` and
26
-
`DialResponse` messages.
40
+
- Start a relay to assist other nodes
41
+
- Consider activating DHT server mode to improve connectivity to public
42
+
networks.
43
+
44
+
If most of these dial attempts are successful, the node can be reasonably sure
45
+
that it is not behind a NAT. On the other hand, if most of these dial attempts fail,
46
+
it strongly indicates that a NAT is blocking incoming connections.
47
+
48
+
{{< alert icon="" context="">}}
49
+
Currently, AutoNAT cannot test individual addresses,
50
+
but a [proposal](https://github.com/libp2p/specs/issues/503) for AutoNAT v2 aims to
51
+
add this capability.
52
+
{{< /alert >}}
53
+
54
+
The AutoNAT protocol uses the protocol ID `/libp2p/autonat/1.0.0` and involves
55
+
the exchange of `Dial` and `DialResponse` messages.
27
56
28
57
To initiate the protocol, a node sends a `Dial` message to another peer containing
29
-
a list of multiaddresses. The peer then attempts to dial these addresses using a different IP and peer ID
30
-
than it uses for its regular libp2p connection. If at least one of the dials is successful, the peer sends a
31
-
`DialResponse` message with the `ResponseStatus`: `SUCCESS` to the requesting node.
58
+
a list of multiaddresses. The peer then attempts to dial these addresses using a
59
+
different IP and peer ID than it uses for its regular libp2p connection.
60
+
If at least one of the dials is successful, the peer sends a `DialResponse` message
61
+
with the `ResponseStatus`: `SUCCESS` to the requesting node.
32
62
33
-
If all dials fail, the peer sends a `DialResponse` message with the `ResponseStatus`: `E_DIAL_ERROR`.
34
-
The requesting node can use the response from the peer to determine whether or not it is behind a NAT.
35
-
> If the response indicates success, the node is likely not behind a NAT and does not need to use a relay
36
-
> server to improve its connectivity. If the response indicates an error, the node is likely behind a NAT
37
-
> and may need to use a [relay server](dcutr.md) to communicate with other nodes in the network.
63
+
If all dials fail, the peer sends a `DialResponse` message with the `ResponseStatus`:
64
+
`E_DIAL_ERROR`. The requesting node can use the response from the peer to determine
65
+
whether or not it is behind a NAT.
66
+
> If the response indicates success, the node is likely not behind a NAT and does
67
+
> not need to use a relay server to improve its connectivity. If the response indicates
68
+
> an error, the node is likely behind a NAT and may need to use a
69
+
> [relay server](/concepts/autonat/dcutr) to communicate with other nodes in the network.
38
70
39
71
{{< alert icon="" context="caution">}}
40
-
To prevent [certain types of attacks](https://www.rfc-editor.org/rfc/rfc3489#section-12.1.1), libp2p implementations of AutoNAT must not dial any multiaddress that
41
-
is not based on the IP address of the requesting node AND must not accept dial requests via relayed
42
-
connections (because it is not possible to validate a node's IP address that arrives via a relayed connection).
72
+
To prevent
73
+
[certain types of attacks](https://www.rfc-editor.org/rfc/rfc3489#section-12.1.1),
74
+
libp2p implementations of AutoNAT must not dial any multiaddress that
75
+
is not based on the IP address of the requesting node AND must not accept dial
76
+
requests via relayed connections (because it is not possible to validate a node's
77
+
IP address that arrives via a relayed connection).
43
78
44
-
This is to prevent amplification attacks, in which an attacker provides many clients with the same
45
-
faked [MAPPED-ADDRESS](https://www.rfc-editor.org/rfc/rfc3489#section-11.2.1) that points to the intended target, causing all traffic to be focused on the
46
-
target.
79
+
This is to prevent amplification attacks, in which an attacker provides many clients
80
+
with the same faked [MAPPED-ADDRESS](https://www.rfc-editor.org/rfc/rfc3489#section-11.2.1)
81
+
that points to the intended target, causing all traffic to be focused on the target.
47
82
{{< /alert >}}
48
83
49
84
<!-- ADD DIAGRAM -->
50
85
51
86
{{< alert icon="💡" context="note" text="See the AutoNAT <a class=\"text-muted\" href=\"https://github.com/libp2p/specs/blob/master/autonat/README.md\">technical specification</a> for more details." />}}
0 commit comments