TCP hole punching for Bitcoin nodes behind home NATs?

When utilizing the same IP and port for multiple connections behind a NAT, the mapping remains effective as long as the NAT does not end the session. The behavior enabled by SO_REUSEADDR or SO_REUSEPORT is more sophisticated than might be initially assumed, allowing honest peers to establish additional connections without necessarily requiring new port numbers each time. This approach minimizes the window of opportunity for attackers, as honest nodes typically initiate connections infrequently compared to the persistent attempts made by adversaries. However, this disparity in connection frequency presents challenges, since attackers can continuously try to establish connections, making it difficult to secure the network without introducing additional barriers such as financial costs, proof-of-work requirements, or identity verification mechanisms.

Sustaining long-term open ports for successful holepunch connections introduces another consideration: message handling must differentiate between listening and connecting roles. Without this distinction, there is a risk that long-term peers will occupy all available connection slots with each other, creating an exclusionary environment where new peers struggle to join the network. This design flaw could undermine the network’s resilience and accessibility.

An attacker targeting an honest peer behind a NAT could exploit announcement channels by publishing numerous holepunch requests and then attempting to connect through the most promising IP and port combinations. By repeatedly trying these combinations, especially during intervals when the honest peer is receptive to new connections, an attacker increases their chances of success. Such vulnerabilities suggest that determined adversaries may still find direct pathways into the network, raising concerns about privacy and security.

A potential improvement involves enabling authenticated, two-way peer-to-peer communication and developing interactive mechanisms for coordinating hole-punching. This would allow users to directly connect to their own nodes, accessing trusted data and private indexes without exposing themselves to unwanted surveillance. Instead of relying on intermediaries, a possible solution is to initially connect via privacy-preserving networks such as Tor or I2P, authenticate the connection, and subsequently switch to a direct TCP connection using holepunching to enhance performance. This hybrid method balances security and efficiency while retaining user privacy.