Re: netsync with port forwarding

>On Sun, Jun 06, 2021 at 10:51:21AM +0200, Michael Raskin wrote:
>> >Or is here some other way of achieving the same result -- letting=20
>> >netsync work when I'm not at home?
>>=20
>> As an =C2=ABadapt to the modem=C2=BB approach, I would consider forwarding SSH an=
d
>> either port forwarding netsync in SSH connection or directly using SSH
>> repository address (which means netsync through standard input/output
>> through SSH).
>
>Two approaches here.
>
>(1) persuade modem to do the right thing with port 4691.
>I've already done that, but it didn't help.  Presumably because port
>forwarding is more complicated that just rewriting packets.  It is also=20
>necessary to do some kind of connexion tracking so that replies to=20
>incoming conexions are properly treated.
>
>It's entirely possible that the incomming netsync connection is properly=20=

>routed to usher, but that ushers' reply is not getting out through the=20
>modem.
>
>Netsync relies on some underlying conventions on the use of TCP for a=20
>two-way connexion.  Is there some other protocol that shares these=20
>conventions?  If so I could tell the modem that this other protocol is=20
>now being used on port 4691.

I would frankly start with tcpdump on both sides while trying to connect
from outside. Routers can break so many things it is not even funny=E2=80=A6

>(2) use ssh.
>
>I guess that would involve the ssh: URI's instead of mtn" URI's
>
>But this is a solution that works for me only.
>
>I'd like these some of these repositories to be readable=20
>by the public.  Monotone itself has enough safeguards on a netsync=20
>connexion for this.  But even if I use a separate account for montone=20
>repositories, someone that can use ssh to access monotone can also=20
>use ssh directly and attack the repositories (by tricks like rm).
>
>Or is some kind of limiter possible with ssh usage?

On the one hand it is, on the other one needs to be quite careful=20
setting it up to not leave a hole.