I've been largely ignoring STUN protocol as noise for a while, but I keep encountering it here and there, and I'm wondering of it's general usability.
If I understand it right, STUN is only useful if the most outer NAT allows in packets sent from
addr:port pair than what the source used when establishing the mapping.
I had an obviously delusional understanding that a sane NAT will only allow back packets from the same
addr:port pair that a connection was established to (Endpoint-Dependent Filtering). Not enforcing this seems to be a serious security problem in and of itself. Building whole protocols and RFCs on top of that seems crazy.
- Are there truly a lot of NATs that only do Endpoint-Independent Filtering?
- Is there any good reason behind doing Endpoint-Independent Filtering on a NAT besides being lazy, endangering the systems behind it, and charging extra $$ for a "p2p friendly" feature?