Tunnel through a NAT

Question

I have a router that provides internet connection to a single client device via a wireless cellular data network. This network provides non-public IP addresses which gets natted. I would like to get a static IP address outside of the network that will route everything back to the device on the cell network.

Because this is an embedded device, space is limited (about 500kB to work with here). Because the network is expensive, it has to not consume too much traffic.

First I tried creating an IPIP tunnel using iproute2. From the server, I used the router's egress IP for the remote IP, not the private address the router received. I hoped that once the router communicated over the tunnel to the server, the server could communicate back. This was not the case.

I tried dropbear SSH and found it won't do a generic tunnel, but I thought I could probably get around that using iptables. However, it seems that just having the ssh link open consumes about 150 bytes/sec.

I also tried nc, but the communication is only one direction, so I can initiate a connection to the server, but can't get anything back.

OpenSSH and OpenVPN are too big to fit on the device (both around 1MB).

My next attempt will probably be to write a program that keeps a persistent socket open to the server, and to use iptables to route the traffic to that program. I wanted to see if there were any other ideas first.

So, any ideas?

Answer 1

The only NAT that an IPIP tunnel might work with is one-to-one NAT, which is clearly not what you have in the cellular case.

This "150 bytes/second for an open SSH connection" business is very strange and you should investigate. No such thing happens for me with OpenSSH -> OpenSSH sessions (there's the unavoidable keepalives, but you actually WANT those when you're behind a NAT) and there's no reason it should unless you're actually passing traffic.

You are mistaken about netcat being unidirectional, a TCP session initiated with netcat works both ways.

I would suggest getting a bidirectional stream up any way you can (probably netcat and a TCP listener on the server) and running PPP over that. You get all the usual disadvantages of running IP over TCP, but it's better than not having connectivity at all.

Here's what works for me in a quick test - on the server:

server:~$ sudo pppd noauth passive pty "nc -lp 9999" debug nodetach

On the client:

client:~$ sudo pppd noauth pty "nc server 9999" debug nodetach

I think having dialup semantics also provides a useful model for the cases where your cell device will simply not be reachable.

After you have the IP connection running, you can consider playing IPIP or 1:1 NAT.