TCP hole punching for Bitcoin nodes behind home NATs?

Today’s Bitcoin network infrastructure predominantly depends on nodes operating within major cloud providers such as Hetzner, AWS, Google Cloud, and Digital Ocean to facilitate inbound connections. A significant concern arises if these platforms restrict or prohibit the operation of Bitcoin nodes, necessitating alternative solutions to maintain network connectivity. In this scenario, the ability to interconnect home-operated nodes becomes crucial. However, the risk profile changes when relying on residential ISPs, as it is generally more challenging for individuals to switch ISPs compared to deploying a node on a new virtual private server (VPS). Additionally, security implications intensify; a successful peer-to-peer exploit on a home network could have more severe consequences than one affecting an isolated VPS.

The current network topology largely follows a two-layer model. At its core lies a mesh of listening nodes—primarily situated in data centers—interconnected with one another. Endpoint nodes maintain long-term connections to several randomly selected nodes within this mesh. Listening nodes typically offer enhanced performance but entail increased risks and, to some extent, higher operational costs, whereas endpoint nodes experience reduced exposure and lower costs but at the expense of performance. Both layers remain susceptible to infiltration by attackers or surveillance nodes.

Transitioning towards techniques such as hole punching would alter the network from a hub-and-spoke architecture, where data center nodes act as central hubs, toward a more distributed mesh topology. This shift could help mitigate the reliance on large-scale cloud providers and support greater decentralization by empowering home nodes to connect directly.

Exploration of connection longevity also presents important trade-offs. Increasing the use of short-lived connections—lasting only a few hours or a day—for relaying blocks and transactions introduces greater dynamism to the network. This approach can reduce the likelihood of successful attacks, as adversaries must repeatedly compromise transient connections. Moreover, a dynamic topology can obscure the network structure, complicating attacks that depend on mapping node relationships. It also helps level the operational playing field between high-uptime nodes and newcomers, potentially fostering a healthier network environment.

Connection types may be categorized based on trust and directionality: outbound connections to partners deemed trustworthy, inbound connections from strangers, hole-punched connections between two unknown parties, and authenticated connections where both peers are trusted. Each pairing carries distinct reliability, security, and strategic considerations for maintaining robust decentralized communication across the Bitcoin network.