[NEED-HELP] Connecting two CGNated machines/hosts.

[YSpoof]

Both hosts are using dynamic IP addresses with different ISPs, and you can't port forward due to CGNat so the machine never gets traffic originated from the internet.

I've read a few tutorials, read the 'begginers guide' but it didn't work.

What I did on the hosts :

On host 1:

vpncloud -l 31333 --beacon-store /tmp/beacon.txt --password d8fae52d-8e62-467e-8e13-9512ec436936 --ip 192.168.103.1/24

Manually copied the beacon.txt

On host 2:

Manually pasted the beacon.txt

vpncloud -l 31334 --beacon-load /tmp/beacon.txt --password d8fae52d-8e62-467e-8e13-9512ec436936 --ip 192.168.103.2/24

Logs after 5 minutes:

Host 1:

INFO - Opened device vpncloud0
INFO - Setting MTU 1427 on device vpncloud0
INFO - Configuring device with ip 192.168.103.1, netmask 255.255.255.0
WARN - Your networking configuration might be affected by a vulnerability (https://vpncloud.ddswd.de/docs/security/cve-2019-14899/),    please change your rp_filter setting to 1 (currently 0).
INFO - Port-forwarding: no router found
INFO - Auto-claiming 192.168.103.1/32 due to interface address
INFO - Trusted keys not set, trusting only own public key
INFO - Crypto speeds: AES_128_GCM: 1742.3 MiB/s, AES_256_GCM: 1554.2 MiB/s, CHACHA20_POLY1305: 989.1 MiB/s

Host 2:

INFO - Opened device vpncloud0
INFO - Setting MTU 1427 on device vpncloud0
INFO - Configuring device with ip 192.168.103.2, netmask 255.255.255.0
WARN - Your networking configuration might be affected by a vulnerability (https://vpncloud.ddswd.de/docs/security/cve-2019-14899/), please change your rp_filter setting to 1 (currently 0).
INFO - Port-forwarding: no router found
INFO - Auto-claiming 192.168.103.2/32 due to interface address
INFO - Trusted keys not set, trusting only own public key
INFO - Crypto speeds: AES_128_GCM: 230.5 MiB/s, AES_256_GCM: 197.4 MiB/s, CHACHA20_POLY1305: 607.1 MiB/s

Additional details:

VPN version: 2.3.0

Ping don't work

Both hosts are Debian 12 fully updated

I've configured the router on both sides to forward the port to the respective machines as a last resort even knowing the CGNat

Before trying the beacon version, i've tried that:

Host 1:

vpncloud -c host2_public_ip:31334 --ip 192.168.103.1/24 --password d8fae52d-8e62-467e-8e13-9512ec436936

Host 2:

vpncloud -c host1_public_ip:31333 --ip 192.168.103.2/24 --password d8fae52d-8e62-467e-8e13-9512ec436936

Still, the same, VPN doesn't connect

[Lyamc]

What you're asking for is essentially a STUN/TURN server/connection which is something that vpncloud essentially does, but the key thing is that there needs to be a public accessible server that is not in this CGNat in order to work.

Here's the problem. You don't actually know what port is being used at the CGNat side. It's going to be dynamic and always changing and you have no control over that. There needs to be a publicly accessible server that can inform the other clients where those connections are.

You need this:

Client1 --> Server
Client2 --> Server
Server --> Client2 (here's Client1's ip:port)
Client2 --> Client1 via ip:port

[dumblob]

@Lyamc yes, vpncloud is essentially what STUN/TURN etc. do. Yet as far as I understood (without reading the source code etc.), the beacon.txt should be equivalent to the information sent by the STUN/TURN/... servers (but transferred manually by a human instead of automatically by the STUN/TURN/... server - of course, it has to be within some timout limits of TCP and other timeouts, but it should work).

So I still do not understand why would we need a separate server when we alredy have the beacon.txt.

[Lyamc]

1. How are you able to determine what your public port is? Each TCP/UDP connection will be a unique port. That's what I brought up STUN/TURN
2. Does the CGNat use SPI?
3. If you had a third server somewhere that allows for standard port forwarding, are the two CGNat clients able to communicate to each other directly?