Arnaud a5d6569876
feat: nat traversal relay (#1417)
Signed-off-by: Arnaud <arno.deville@gmail.com>
Signed-off-by: Giuliano Mega <giuliano.mega@gmail.com>
Co-authored-by: Giuliano Mega <giuliano.mega@gmail.com>
2026-07-23 13:10:36 +00:00
..
2026-07-23 13:10:36 +00:00
2026-07-23 13:10:36 +00:00

NAT not-downloadable scenario

Scenario

A node behind a NAT with no relay is NotReachable and announces no dialable address. A remote peer can never dial it, so a download from it fails.

Topology

node B ──── lan ──── router (NAT) ──── wan ──── bootstrap A
                                         └────── node C (reachable)
  • bootstrap A — public node on the wan, autonat server, started with --nat=extip. Unlike not-reachable, it runs without --relay-server, so B has no relay to fall back to.
  • routerlan -> wan masquerade and no inbound forward, so B can dial out but nothing can dial back in.
  • node Bnat=auto, on the lan. It joins via A, AutoNAT finds it unreachable, and with no relay it ends up announcing nothing dialable.
  • node Cnat=auto, directly on the wan, so AutoNAT finds it Reachable. It is the peer that tries (and fails) to download from B.

Run

make testNatIntegration \
  STORAGE_INTEGRATION_TEST_INCLUDES=tests/integration/nat/not-downloadable/testnotdownloadable.nim

Builds the shared image and brings the compose topology up and down. Rootless, but needs the host netfilter modules — if the router fails on iptables: sudo modprobe iptable_nat nf_conntrack.

Expected result

B is NotReachable and announces no address, while C is Reachable. B uploads a file, then C tries to fetch its manifest over the network and fails.

Per-run container logs (router, bootstrap, client, node) are written before teardown to tests/integration/logs/<timestamp>__NAT_not_downloadable/<test>/<service>.log.