pwnat

Older solution that seems to have issues with some modern routers: https://github.com/samyk/pwnat/issues/18

I've always found this path to be more compelling: https://github.com/samyk/pwnat It has more edges and doesn't handle all cases, but it also avoids the need for any kind of intermediary.

Not bad, though you don't even need STUN or ICE; https://github.com/samyk/pwnat https://github.com/samyk/slipstream

Hacker usually has some kind of relay at hand: https://github.com/nwtgck/piping-server https://github.com/schollz/croc Or a NAT traversal tool: https://github.com/shawwwn/Gole https://github.com/samyk/pwnat Or can just manually ncat simultaneously from both sides to proper addresses and ports, probably with the help of some public STUN server. Note that if worst case combination of NATs doesn't allow direct connection, then by definition a relay is needed, hacker or not, it doesn't matter.

In addition to this: Carrier grade NAT ISPs sometimes have global scope ipv6s assigned, and if the other endpoint has ipv6 support, too, you can breakout easily using the assigned ipv6. Rather than that I would recommend reading up on DNS exfiltration techniques [1] and things like pwnat [2] that use faked SNMP reply packets that make routers think they forgot to let a data packet through for hop traces. And if you have the time, I'd recommend to use websockets as a tunneling protocol because it's very flexible in its payload size and allows compressions via websocket extensions and the srv flags. I wrote a detailed article that explains the WS13 protocol and all its quirks [3] Additionally to that it's good to know the limitations of a SOCKS proxy, hence that's what most "easy to use" implementations provide. Spoiler: forget ipv6 via soc

> To connect between NATted hosts, you need control of a host that is not Um, no? https://github.com/samyk/pwnat

I recently discovered zyre. Its from the same guy that brought us the wonderful zeromq library While it does a lot of the connection and communication part, it lacks a way to bypass nat routers. Here is a book on zyre http://zguide.zeromq.org/php:chapter8 I also found this thing called pwnat which bypasses nat routers without the need for UDP hole punching ! https://github.com/samyk/pwnat I feel like if someone made a high level wrapper combining these two, we can have a very good framework.

> There does exist at least one NAT hole-punching technique that can traverse two NATs with no central server using ICMP-based holepunching and UDP. Obviously, like all hole punching techniques, it only works on certain kinds of NATs, and firewalls can kill it. I think you're referring to this? Clever hack indeed. https://github.com/samyk/pwnat