[Feature] Game Console Acceleration/Full cone NAT

[ghost]

Inspired by NetchX/Netch. May be a duplicate of #25.

Is it possible to proxy all UDP traffic from a game console and fix NAT type?

[Mygod]

This app already proxy all UDP traffic at its current state. NAT type depends on the VPN you are using.

[ghost]

Thanks for your reply. I have tested it with my Nintendo Switch console.

It turns out that:

• If I use WireGuard/AnyConnect/... with VPN Hotspot => NAT Type B
• If I use V2rayNG/SSR with UDP forward enabled and VPN Hotspot => NAT Type D
• If I use Kitsunebi/SSR with UDP forward disabled and VPN Hotspot => NAT Type F

According to a thread on Reddit, NAT Type A might be a full cone NAT, Type B might be an address-restricted cone NAT, Type C might be a port-restricted cone NAT and Type D might be a symmetric NAT. Type A or Type B is recommended for online games since they might use different ports while connecting.

Although WireGuard/AnyConnect/... has a Type B, it's still not stable to play online. V2ray/... might have a better experience, so is it possible to fix their NAT types? Thanks in advance.

By the way, I also tested a game accelerator and it did return NAT Type A. I'm just curious how it works...

[Mygod]

So from the sound of it, your NAT type is restricted by what VPN you are using, and VPN Hotspot in principle supports every NAT type. This seems like a good news to me.

NAT types on game consoles are outside of my expertise (and iirc they are documented very poorly). If there are improvements that can be made for this app, I am happy to learn about it; if it is more regarding the VPN app itself, there is nothing I can do over here.

[ghost]

According to the thread on Reddit, Nintendo use STUN to probe your NAT type. Here is the diagram:

So I guess:

• NAT Type F means all UDP connections to STUN servers have been blocked.
• NAT Type D means you have dynamic public IPs or ports while connecting to different STUN servers. It's probably caused by port randomization. Link
• NAT Type C means the STUN server you are connecting cannot send message to you via a different server port. NAT Type B means another STUN server can't send message to you before you connect to it. According to some pages, it can be fixed by assigning a static IP to game console and DMZ(ports forward) enabled on a router, though it may increase security risk.

Can static IP/port assignment and DMZ be implemented in VPN Hotspot?

[Update] It seems iptables can setup a full cone NAT: http://www.joewein.net/info/sw-iptables-full-cone-nat.htm

[Mygod]

Looks like Android only supports symmetric NAT. I guess I will keep this open for now but I personally have no plans for investigating further.

[KeyuanHuang]

Looks like Android only supports symmetric NAT. I guess I will keep this open for now but I personally have no plans for investigating further.

I think there should be some way to get fullcone NAT on Android because I've seen some game boosters can do it. But I don't know how it works. For example, I use Lingti (in Chinese is 灵缇) game booster on Android to proxy my Nintendo Switch and it could optimize the NAT type to A even without root. The game booster works by connecting the Android and Switch to the same WiFi and then setting the Android IP address as the gateway of Nintendo Switch.

[Mygod]

@KeyuanHuang At a quick glance, that app relies on using a proxy server. If you are okay with configuring a proxy server on all of your clients, you can achieve the same effect by using some proxy server app on your phone.

[KeyuanHuang]

@KeyuanHuang At a quick glance, that app relies on using a proxy server. If you are okay with configuring a proxy server on all of your clients, you can achieve the same effect by using some proxy server app on your phone.

But as mentioned above in this issue, there's always some NAT type problems with VPN Hotspot on Android. I have several remote proxy servers that support fullcone NAT and I can get fullcone NAT using other apps, such as the TUN mode of Clash for Windows. It works by generating a virtual network adapter and sharing it via Windows hotspot, which seems very similar to how VPN Hotspot works. But when I connect to the same proxy servers using Clash for Android and then share them using the repeater mode of VPN Hotspot, the NAT type is symmetric. In this case, it seems that the NAT problems are not caused by proxy servers.

Therefore, the problems should be caused by other factors. As I mentioned before, some game boosters on Android can achieve fullcone NAT while working as gateways. This suggests that it's possible to get fullcone NAT on Android. I'm wondering whether fullcone NAT is possible for VPN Hotspot. From the observations mentioned above, I believe it's possible, though I don't know how to (I don't know how to code Android apps). If you could exploit this possibility, I'll appreciate it a lot.

[Mygod]

I meant "proxy server" running on your Android device. Sorry for the confusion. It seems that Lingti requires you to configure proxy server on your clients (see their instructions).

[KeyuanHuang]

I meant "proxy server" running on your Android device. Sorry for the confusion. It seems that Lingti requires you to configure proxy server on your clients (see their instructions).

You're right. The proxy app will cause some difference. I test Clash for Magisk recently and the NAT type is B.
Do you know any Android proxy app supporting fullcone NAT?