Re: [WireGuard] [ANNOUNCE] Snapshot `experimental-0.0.20160708.1` Available

[Bruno Wolff III <bruno@wolff.to>]

On Fri, Jul 08, 2016 at 16:37:23 +0200,
  "Jason A. Donenfeld" <Jason@zx2c4.com> wrote:
>
>== Changes ==
>
>  * persistent keepalive: start sending immediately -- the previously released
>    feature was not useful without this extra commit. So, getting this in here
>    now so that people can actually test this out. Sorry for the churn. Don't
>    bother packaging the previous snapshot.

I tried this an noticed a problem. The keep alive packets don't set the 
reply IP address and port for the endpoint. (Which makes sense since they 
aren't authenticated.) So in the case of nat, where you won't know what 
the port is (and in some cases the IP address as well) you still can't 
connect to the end point behind the nat until there is some authenticated 
data sent from the end point.

So if nat changes the port at some point, in order to reestablish a path, 
you need to send authenticated data. I am not thinking of an obvious way 
to tell when you just need to hold the port mapping via nat open versus 
when you need to send authenticated data to rebuild a connection after 
a port or IP address change from nat.