One-liner: Establish a VPN Between Two Hosts Behind NAT (Case 1)
If you've ever tried to connect two hosts A and B that are both behind NAT, you probably know that most solutions require having a third server in the middle with a real IP address.
But what if you do not have access to a server with a real IP address? Can you still connect two hosts that are behind NAT?
Well, turns out that in some cases you can. Here is a one liner that's going to do the trick for you. The one-liner is going to use a free script to punch a hole in NAT called nat-traverse.pl. The script can be downloaded at http://linide.sourceforge.net/nat-traverse.
After downloading and installing the script, run this on host A:
a# ./nat-traverse.pl 7000:`curl checkip.dyndns.org 2>&1|sed -e 's/.*Current IP Address: //' -e 's/<.*$//'|tail -1`:7002 --cmd="pppd updetach noauth passive notty ipparam vpn 10.10.10.1:10.10.10.2"
Run this on host B:
b# ./nat-traverse.pl 7002:`curl checkip.dyndns.org 2>&1|sed -e 's/.*Current IP Address: //' -e 's/<.*$//'|tail -1`:7000 --cmd="pppd nodetach notty noauth"
Here is how it works.
First, you'll want to determine the external IP used by your NAT device. This is done by the following part of the command above:
curl checkip.dyndns.org 2>&1|sed -e 's/.*Current IP Address: //' -e 's/<.*$//'|tail -1
The external IP is then passed as input to the ./nat-traverse.pl script.
The nat-traverse script is going to punch a hole in your NAT device by sending ten UDP packets on ports {7000,7002}, and, if everything works, establish a PPP session (-cmd parameter).
Keep in mind that this approach works for NAT devices that do not change port numbers corresponding to IP addresses.
There are other approaches to address the issue. I'll cover some more approaches and examples later.
Enjoy!