Home Relays and UPnP-IGD/PCP?

[lorenzleutgeb]

I am new to iroh, and learning about the concept of a "home relay". From what I understand, it seems that as long as the accept side has not advertised an external address (for example, set via Builder::external_addr), the connect side will connect to the "home relay" of the accept side, and use the relayed connection to "upgrade" to a direct, possibly hole-punched, one. (Please correct me if I haven't understood it up to here or missed something important.)

I would like to understand/ask more about alternative solutions, and in particular port mapping protocols: If the accept side has a public IP (=no NAT) or their gateway supports port mapping, for example via UPnP IGD or PCP, I think the connect side could (should?) attempt to connect via the public IP or the IP of the gateway that mapped a port, skipping any relay.

The docs on relays and NAT traversal are not in conflict with that, but they do only mention port mapping in passing.

My naive view is that an endpoint that has a public IP or got a port mapped would not even need a "home
relay", yet it seems that all connections start off relayed. Is this true? Or does iroh already implement what I am describing?

I did find iroh/src/portmapper.rs and the portmapper crate, but I thought I might ask around before I dive deep...

[matheus23]

If you know your Endpoint is in a network that supports UPnP or PCP and you know that all firewalls are configured to allow incoming traffic on those ports through, then you can just turn off relays on that endpoint via RelayMode::Disabled.

This will make your Endpoint advertise its known IP addresses instead of a home relay URL via Pkarr or whatever you use for AddressLookup.

You should keep in mind that this cuts off any Endpoints that don't support UDP from connecting to you. (This is common on more restrictive networks, where only DNS-like UDP is traffic that's allowed through.)

[flub]

Buidler::external_addr is very different. It is to add addresses that are not discovered by iroh. E.g. if you manually forward an incoming port on your firewall to a specific iroh endpoint (which then also has to be manually bound to a fixed address).

Iroh will try and discover all its own addresses: local interfaces, using QUIC Address Discovery (QAD), and iroh will also use UPnP IGD and PCP if they are available and collect the addresses from those. So these are then all the addresses that a local endpoint thinks it might be reachable on. The relay URL of the home relay is just another such address as far as iroh is concerned: an address the endpoint might be reachable on.

Now at this point the remote endpoint that wants to dial this endpoints needs to learn about at least one such address, but the more the better.

• One way is to create an EndpointAddress containing just everything: the EndpointId, home relay, all possible socket addrs. This can then be serialised to a "ticket" and passed via another channel.
• But this is also where Address Discovery comes in for true dial-by-id. The endpoint will publish addresses at each configured address lookup service.
  • By default for pkarr/dns publishing we only publish the relay url to preseve some privacy. But you can change this to publish everything or another subset. This is why the "canonical" connection starts relayed and then upgrades to direct.

And once the remote endpoint has found one or more addresses on which the endpoint it wants to dial might be reached it will try to connect to all the addresses it has found: all socket addrs and the home relay. If any of these work a connection is established. Once there's an established connection both peers exchange addresses that can be used for holepunching (i.e. all socket addresses currently). They will then perform holepunching (even if already on a non-relayed connection!) and upgrade to the best direct (IP) connection they can get.

---

So back to the question: the UPnP/PCP addresses are just part of the pool of addresses an endpoint has available to send to a peer. Either via address lookup (but by default not every addresslookup service publishes every address type) or manually out of band. They are also used as holepunching candidates over an already established connection. If that established connection was a relay connection and you get a PCP address then "holepunching" just succeeds very easily and you get a direct connection.

Hopefully that all makes some sense. I feel like we still have to improve our docs if you have these questions :)