'How picky is your average Stateful Firewall system?
Given a scenario:
- The Client, described as a user of sorts on a home network with a standard router running NAT/PAT on a residential network. Imagine all traffic within their network is allowed, but the router is configured with a Stateful Firewall that performs basic SPI on incoming and outgoing data.
- A Primary server that the client can always reach, and has no security, available on the open internet. Only responds to HTTP, and relays the information (IP:PORT) to the secondary server for later processing
- A secondary server that can always contact the primary server, has a fundamentally different physical location and IP address/Network scheme from both the primary and client. It cannot contact the Client until the client contacts the Primary Server to relay its ip and port.
Given this data, my question is this: If the client sends an HTTP GET request to the primary server, and then immediately takes the ephemeral source port attached to that GET request and sets up an HTTP server with that same source port, after the GET is finished, could the secondary server solicit that harvested port and IP address combination with a GET request and receive a response?
This would be effectively, NAT Traversal using ONLY HTTP. Would the stateful firewall reject the packets from the secondary server given that a different IP is now poking at a port that originally had the primary server poke at? Could multiple computers connect to this now opened server on the client?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
