How to connect from Internet to local Mashine behind a router? lazarus / 38-Networking and Web Programming ---------------------------------------------------------------------- Key-Real · 2023-05-25 09:01 Hi, I'm new at networking I can start a synapse server. When I listen local with my IP Server address, i can connect. When I listen from my root-server(outside), which has an static IP address connected direct to the network card (same address from outside and which shown in ifconfig), i can connect. Now I have following situation: I wanna listen at home, I'm behind a router, so I have a different address of my router(internet, detected with https://whatismyipaddress.com/) and my machine(address detected with ifconfig). who to listen in this scenario from home to get a connection from outside? ---------------------------------------------------------------------- af0815 · 2023-05-25 09:46 A good idea is, to learn something about Security in Networking :-) Open the port in your router and told NAT to forward the port can open a major security risk. Normal such things are handled best with "road warrior" configuration aka VPN connections. ---------------------------------------------------------------------- birin · 2023-05-25 09:47 What you describe is a classic situation. You have to inform your router that communications for the port used by your server must be routed to the IP address of this server on your local network. Look for the NAT mechanism (Network Adress Translation). For example: If the public address of your router is 100.100.100.100, that the local address of your server is 192.168.1.10 and the port used by your server software is 6950, you can create a NAT rule on your router to route communications arriving at 100.100.100.100 and port 6950 to local address 192.168.1.10 (and port 6950 too). ---------------------------------------------------------------------- Key-Real · 2023-05-25 09:51 Is it possible to configure this with my pascal program? ---------------------------------------------------------------------- af0815 · 2023-05-25 09:56 Quote from: Key-Real on May 25, 2023, 11:51:14 amIs it possible to configure this with my pascal program? This is configuration of your internet hardware (router), nothing to do with pascal. ---------------------------------------------------------------------- birin · 2023-05-25 09:56 No, I think no. You need to configure your router, accessing the admin page, with login and password. ---------------------------------------------------------------------- Key-Real · 2023-05-25 11:22 so there are no higher level solution? I can imagine my users couldn't configure there router. how other software solve this? ---------------------------------------------------------------------- TRon · 2023-05-25 11:23 Quote from: Key-Real on May 25, 2023, 01:22:19 pmhow other software solve this? Quote from: af0815 on May 25, 2023, 11:46:04 amA good idea is, to learn something about Security in Networking :-) NAT traversal in particular ---------------------------------------------------------------------- Warfley · 2023-05-25 16:20 As already said, the problem is that you are behind a NAT. Basically introduced because of IP address range exhaustion (but today also seen as a security feature), your router is the only device connected to the internet and all devices connected to that router  are just in the home network. When you want to connect outwards,  you basically send your packets to the router, the router then relays them into the internet. The router thereby remembers your computer for the used port, so when a response comes to the same port it can relay it to your computer. When you forward a port through your NAT you basically hardcode this as a rule that all packets to  a specific port should be relayed to your computer. But you can also "Trick" your router to register a port for you, this is called Hole punching. Basically you connect outwards to the internet, this causes the router to register a port to be redirected to your computer. From that point onwards, any time a packet arrives to that port it will be relayed to your PC, as if you statically forwarded a port in your router. But unlike the static forwarding, after some time the router will forgett about this forwarding (basically close the hole). So what you can do is to regularly punch a new hole and then listen for anyone connecting to that port. The only thing you need is a way to publish that port. This is usually done by having a lookup server. When punching the hole, you connect to that lookup server. The server registers the port the request came from. When a client wants to connect to you, they ask the lookup server for the correct port, and then connect through the punched hole to your server. This is how Skype  calls or many streaming and remote control apps like Teamviewer are operating. Instead of having all the communication being handled by a big central server, they just have a register server, which maps usernames onto IP addresses and ports, and all the streaming is then directly between the users. This allows the lookup servers to be very small and lightweight and allow those systems to be operated cheaply (and also much more privacy preserving then the alternatives like MS Teams or Discord) ---------------------------------------------------------------------- ASBzone · 2023-05-25 20:39 Quote from: Key-Real on May 25, 2023, 01:22:19 pmso there are no higher level solution? At a basic level, no. If you really want to get sophisticated, then look into uPnP and/or DLNA For instance: https://www.linksys.com/ca/support- article/?articleNum=138198 Otherwise, this is not easily addressed without making changes on an end-users networking gateway device (router/firewall/proxy/etc) Quote from: Key-Real on May 25, 2023, 01:22:19 pmI can imagine my users couldn't configure there router. They are not going to get the benefit of any software that needs to listen to traffic on the other side of a NATing device without network level configuration. Quote from: Key-Real on May 25, 2023, 01:22:19 pmhow other software solve this? Most other software of this type provides instructions on how the end- user needs to adjust their network.     Or, you add uPnP or DLNA to your application (which has some security implications). ---------------------------------------------------------------------- TRon · 2023-05-25 21:15 In addition Quote from: ASBzone on May 25, 2023, 10:39:25 pmMost other software of this type provides instructions on how the end-user needs to adjust their network. These days the site is a bit riddled with popups trying to sell you their network utilities but https://portforward.com has a bunch of routers and software listed and explains the process for users that have no clue whatsoever. Though as already mentioned it does pose a security risk. You have to know what you are doing but so is using/installing software that requires it. ---------------------------------------------------------------------- Key-Real · 2023-05-25 21:26 So as I understand hole punching is my solution. The Theory is clear. Is there some examples / demos with synapse out there? ---------------------------------------------------------------------- balazsszekely · 2023-05-26 04:27 @Key-Real QuoteSo as I understand hole punching is my solution. The Theory is clear. The theory is clear, however covering all the NAT traversal mechanism it's incredibly difficult and you need a lookup server. QuoteIs there some examples / demos with synapse out there?https://for um.lazarus.freepascal.org/index.php/topic,52110.0.html ---------------------------------------------------------------------- Key-Real · 2023-06-01 16:17 I managed to establish Hole Punching, see: https://forum.lazarus.freepascal.org/index.php/topic,63491.0.html But it doesn't work everywhere I think the next step is to look at uPnP ---------------------------------------------------------------------- rvk · 2023-06-02 10:29 Quote from: Key-Real on June 01, 2023, 06:17:48 pmI think the next step is to look at uPnP uPnP should be a lot easier  https://www.rapid7.com/blog/post/2020/12/22/upnp-with-a-holiday-cheer/ But you'll notice it's turned off in the majority of the routers. ---------------------------------------------------------------------- mercurhyo · 2023-06-02 10:56 http://miniupnp.free.fr/ this library / .DLL / .SO allows you to manage at higher level most of the router-nat things if you bind its API to your application and are good programmer you can then open a port without manually configuring all the rest is litterature from beginers ---------------------------------------------------------------------- rvk · 2023-06-02 11:01 Using a library/tool is indeed the easiest (non cross-platform) method. But using M-SEARCH and taking directly to the router to map a port shouldn't be that difficult. And it would be cross-platform. ---------------------------------------------------------------------- mercurhyo · 2023-06-02 11:05 Quote from: rvk on June 02, 2023, 01:01:14 pmUsing a library/tool is indeed the easiest (non cross-platform) method. But using M-SEARCH and taking directly to the router to map a port shouldn't be that difficult. And it would be cross-platform. non crossplatfarn ? go to the site please http://miniupnp.free.fr/ I am too nice lol ---------------------------------------------------------------------- rvk · 2023-06-02 11:15 Ok, I was only familiar with MiniUPnP on Linux. That said... I myself would go the native route. But that's totally up to the programmer. But you're correct, it is cross-platform. ---------------------------------------------------------------------- mercurhyo · 2023-06-02 14:59 you're welcome @rvk I used miniUpnpC under windows XP. As mentioned on the site you download stuffs for your fav platformS and rely on them by API .. Linux, BSD, Mac, AmigaOS, Windows.. etc etc source code is also available Enjoy ---------------------------------------------------------------------- Key-Real · 2023-06-13 20:36 rvk was so kindly to help me with the UPnP code, see: https://forum.lazarus.freepascal.org/index.php/topic,63652.0.html ---------------------------------------------------------------------- Key-Real · 2023-06-13 20:37 I have now  - Hole Punching and  - UPnP are there other solutions? ---------------------------------------------------------------------- rvk · 2023-06-13 21:32 Quote from: Key-Real on June 13, 2023, 10:37:44 pmare there other solutions? For Hole Punching there are several techinques. The one described is for when the router can be fooled with trying to connect from both ends at the same time. But there are routers which have NAT implementations where the outgoing port isn't predictable. In that case you will need to use additional techniques to try to punch the whole (which not always works). If that, and UPnP doesn't work... you can always communicatie via the common server (without a direct connection). BTW. If I get to it, I will also implement username/password for the TUPNP class. Because allowing UPNP on your network is a security issue. Putting Authentication on UPNP is at least a bit more secure (but that's not standard, not all implementations have authentication). (Does your router have authenticated / secure UPnP ? Mine does, Asus with Asuswrt-Merlin.) ---------------------------------------------------------------------- TRon · 2023-06-18 08:01 When surfing around regarding another networking related topic I came across this blog-post about NAT traversal which might be interesting (it describes all the hurdles you can come across and how to approach/solve). edit: not an (indirect) advertisement for using their services. I have no affiliation nor interest. ---------------------------------------------------------------------- delphius · 2023-06-20 07:54 Use something like localtunnel and don't bother your head with such nonsense anymore ---------------------------------------------------------------------- rvk · 2023-06-20 08:13 Quote from: delphius on June 20, 2023, 09:54:55 amUse something like localtunnel and don't bother your head with such nonsense anymore How would this work if both clients are behind a NAT/Firewall??? Also... this is about http(s) traffic, not any random developed protocol you might have. And localtunnel doesn't make direct contact between both clients. ---------------------------------------------------------------------- delphius · 2023-06-20 08:41 If I understood the original task correctly, it was only to provide access to the server located behind the NAT at the address and port. As for protocols, it seemed to be about a kind of training example, in which http(s) is most likely involved ---------------------------------------------------------------------- rvk · 2023-06-20 08:47 Ok, maybe I used too much information from similar topics by the same user at the same time (about udp hole punching and direct contact between clients behind a NAT. etc). TS can elaborate if this is incorrect or not. ---------------------------------------------------------------------- delphius · 2023-06-20 09:01 If we could also implement a free pascal localtunnel client, which does not seem such a difficult task, then happiness will come for an ordinary topicstarter P.S. I got acquainted with all the topics on this topic from the author and could not understand the specific use case and requirements. It seems to me that it is necessary to start with the exact formulation of the task, at least in general terms, in order to give specific advice. All I understood was that the server would be behind NAT and that development should rely only on modules distributed with fpc.