TCP hole punching for Bitcoin nodes behind home NATs?

Ensuring secure and robust peer-to-peer (p2p) connectivity involves balancing two critical objectives: maximizing the likelihood of establishing connections with honest nodes to safeguard against censorship, and minimizing the probability of connecting to malicious actors to prevent spying, denial of service, or targeted exploits. Achieving both goals is challenging, particularly in the context where message boards, which facilitate node discovery, are not relayed among peers. This setup enables attackers to advertise their own IPs and ports widely across all message boards, while honest participants typically appear on only a few. Such a disparity grants attackers a multiplicative advantage by increasing their visibility and potential reach within the network.

The effectiveness of message boards in promoting connections with honest nodes appears limited. When an honest message board node is discovered, continuous connection can be maintained for block and transaction propagation. However, if such a node cannot be found, the model provides little recourse, leaving honest participants at a disadvantage. Furthermore, message boards under the control of an attacker will inherently prioritize connections to the attacker's infrastructure, further compromising the integrity and reliability of p2p connectivity.

Hole punching, a technique intended to facilitate inbound connections through network address translation (NAT), introduces additional risks. By making it easier for external entities—including potential attackers—to directly connect to more honest nodes, hole punching could exacerbate exposure to various attacks, undermining the second objective of limiting attacker access. While an ideal scenario assumes flawless code and protocol design that eliminate vulnerabilities and privacy leaks, current realities fall short of this standard, necessitating continued vigilance regarding who can establish direct connections.

Recent developments, as discussed in this pull request, highlight that the default behavior now encourages more nodes to accept inbound connections. This change aims to strengthen overall network connectivity, but also underscores the importance of carefully considering the associated security trade-offs, especially when factoring in the potential for increased attacker presence resulting from methods like hole punching and the limitations of message board-based peer discovery.