Redirect a TCP connection

Question

Hi there, I have something like a proxy server (written in java) running between my clients and the actual video server (made in c++). Everything the clients send goes through this proxy and is then redirected to the server.

It is working fine, but I have some issues and think it would be better if I could make this proxy server only to listen to the clients requests and then somehow tell the server that a request has been made from the client side, and that it is supposed to create a connection with the client directly.

Basically in the TCP level what I want to happen is something like this:

1- whenever a client sends a SYN to my proxy, the proxy just sends a message to the real server telling the ip and port of the client.

2- The server would then send the corresponding SYN-ACK to the specified client creating a direct connection between client and server.

The proxy would then be just relaying the initial requests (but not the later data transfer) to the actual server. I just don't know if that is possible.

Thank you very much

Nelson R. Perez

Answer 1

That's very much the way some games (and Fog Creek CoPilot) do it, but it requires support on both the server and the client. Basically the proxy has to say to the client and server "try communicating with the directly on this ip and this port" and if they can't get through (because one or both is behind a NAT or firewall), they fall back to going through the proxy.

I found this good description of "peer to peer tcp hole punching" at http://www.brynosaurus.com/pub/net/p2pnat/

Answer 2

You don't have control of TCP handshake in userland like that. This is what firewalls/routers do but it all happens in the kernel. Take a look at the firewalling software for your platform - you might not even have to code anything.

Answer 3

Does the proxy and server lives on the same machine? If so, you can pass the connection to the server using Socket Transfer or File Descriptor Passing. You can find examples in C here,

http://www.wsinnovations.com/softeng/articles/uds.html

If they are on the different machines, there is no way to pass connection to the server. However, it's possible to proxy the IP packets to server using VIP (Virtual IP). This is below socket so you have to use Link layer interface, like DLPI.