Hacker News Reader

Comment by tvb12 | Hacker News Reader

> The wormhole send file mode shares the IP addresses of each client with the other (inside the encrypted message), and both clients first attempt to connect directly. If this fails, they fall back to using the transit relay.

I know nothing about computers. If the clients successfully connect, the file goes from A -> B, but if the connection fails, it goes from A -> relay server -> B? What conditions might cause the connection to fail?

View on HN

Network attached devices are generally not directly addressable from outside their local network. There's a thing called "network address translation" on routers which hides the addresses used internally. The router substitutes it's own address for the internal ones on internet facing connections, acting on their behalf, and just remembers which connections belong to which local device. For new incoming connections, it won't know which device it's receiving the connection request on behalf of. That's unless that device announces to the router it's waiting for the connection using a thing called uPnP, or you manually configure the router to forward to a specific device for specific types of connections. When uPnP or manual forwarding aren't there, intermediaries on the internet allow both A and B to make outgoing connection requests to set up the link, which is no trouble for any router to do.

Ohh, excellent. Thank you, that was very helpful.

Yep, if both parties are behind NAT, or some sort of firewall that prevents inbound connections from the other, they'll fall back to using the pre-configured public relay server (or any other server you tell them to use).

I need to build some better stats dashboards, but at a glance it looks like maybe a third of the connections wind up using that relay. I'd like to add better hole-punching code (using WebRTC sounds like the right approach), but haven't had the time or found the right library yet.

I love this line from your docs on reasons for setting up own transit relay.

> You want to provide your users with a relay that fails at different times than the official one

What are your costs for running the official relay server? Do you have plans for if/when they significantly increase?

Maybe $20/mo. The bandwidth is growing but not too bad so far, every once in a while I see a really huge transfer that makes me wince (seriously, who sustains a gigabit/s for five hours?), but I've still got some margin before I run up against the monthly transfer allowance. When that happens, I'll probably move the server to a provider that has a slower but flat-rate bandwidth plan, maybe Scaleway. Transfers would be capped by their network limit (100Mbit?), but effectively free.

I might also change the transit relay to throttle the connection somewhat after some total number of bytes have been transferred (but that takes actual code, and switching providers would be easier). I'm really glad folks are using it, but I do sort of think that >10GB at a time is a bit much. But I don't have a way to notify a given user about any sort of soft limit like that (the transit relay has no idea how much you're going to send ahead of time, and doesn't have a notification channel other than throwing an error).

I've also been meaning to figure out NAT hole punching for years now, and the thought has always been that hole-punching will save a lot of the server bandwidth by making direct connections happen a larger percentage of the time.

I'm not familiar with Magic Wormhole specifically, but I think this may be to solve STUN: https://en.wikipedia.org/wiki/STUN.

Specifically if the clients are behind NATs, having a third party server coordinate can help.

Reply on news.ycombinator.com