The issue tracker is only for reporting bugs or submitting feature requests.
If you need technical assistance for running a node please consult the #fullnode channel on Discord (https://discord.gg/jrxApWC) or https://forum.helloiota.com/Technology/Help.
If you have general questions on IOTA you can go to https://iota.stackexchange.com/, https://helloiota.com/, or browse Discord channels (https://discord.gg/C88Wexg).

Bug description

When having a UDP neighbor, it seems that IRI will only allow a "session" to occur when the source port of the neighbor matches the port the neighbor was registered with.

Steps To Reproduce

Please see the two examples:

Example of a working UDP peering

Consider our address is udp://80.61.xxx.xxx:14600 and our neighbor's is:

udp://185.10.xxx.xxx:14600

After having added the neighbor (and the neighbor adds us) we can run tcpdump. We see the packets originating from the neighbor and the source port is 14600:

22:54:13.734570 IP 185.10.xxx.xxx.14600 > 80.61.xxx.xxx.14600: UDP, length 1650

In this situation IRI establishes a "session" and the neighbors are communicating.

Example of a non-working UDP peering

If our neighbor's packets traverse a router which performs PNAT (port address translation) we no longer see the source port of 14600, but some randomly assigned port:

22:54:13.734570 IP 185.10.xxx.xxx.30485 > 80.61.xxx.xxx.14600: UDP, length 1650

In this case, there's no "session" created and no communication between the neighbors.

The case with Docker

The problem described above is most problematic when running IRI in Docker (not on host network!).
When using the default docker network or a user-defined network -- masquerade is enabled by default. This means that the source IP of the container (normally on a 172.16.0.0/16 network) translates to the IP of the host. The problem is that the port also gets translated, hence the problem.

Disabling the masquerade from the network doesn't help because the source IP becomes that of the container rather than the host.

Spec

On what hardware is the node running on?

• Node can be baremetal or VPS.

OS:

• Ubuntu, Debian or CentOS, all the same.

IRI version:

• latest (1.5.3) and earlier.

Expected behaviour

Expect that when the UDP source port is translated, IRI can still allow the neighbors to communicate (that is the case with TCP).

Actual behaviour

When source port is translated, there is no communication between the neighbors.

Errors

No errors, just no communication.