系统与基础设施tailscale.com
NAT 穿透是如何工作的（2020）
How NAT Traversal Works (2020)
2020 — 2025，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
Tailscale 的这篇长文系统讲解了 NAT 穿透的原理：从 NAT 的工作方式、打洞技术，到 STUN、TURN、ICE 等协议如何配合，让两台处于内网中的设备建立直连。文章兼顾技术细节与可读性，被广泛认为是 NAT 穿透主题最好的入门总结之一。
为什么经久不衰：它把一个晦涩但无处不在的网络难题讲得清晰透彻，多年后仍是理解 IPv4 时代点对点连接困境的最佳读物。
HN 评论精选
认为这是 NAT 主题最好的技术总结。
我提交这篇文章是因为它是我读过的关于 NAT 最好的总结，还深入讲解了不少技术细节。为 Tailscale 点赞。
robocat查看英文原文
I submitted this because it is the best summary of NAT I have read, and it goes into some of the technical details. Kudos to tailscale for writing this.
赞赏文章质量，同时提出 NAT 穿透过程中的中间人攻击安全隐患。
写得非常好，是我读过的最好的 NAT 穿透总结之一。读到一半我笑出了声——为了在 IPv4 地址空间下建立通信，我们要费这么大的劲，既好笑又有点悲哀。我也学到了 ICE，之前没想过它的安全问题：这一整套混乱机制让无特权的攻击者很容易诱骗端点把流量中继到自己的网关。比如 NAT 后面的另一个用户似乎可以通过同时发送探测包，让 NAT 设备把流量中继给自己。不知道这能否防御，有没有关于 NAT 穿透中间人攻击的好资料？有没有能把这些细节抽象掉的好用的软件库？
alduin32查看英文原文
This is a really well written article, one of the best summaries of NAT traversal I have ever read. I started to laugh mid-way, because it's amusing (and a bit sad) the lengths we have to go to establish communications using the IPv4 addressing space. It's good to learn about ICE too. I had'nt thought about the security implications : indeed this whole mess makes it very easy for an unprivileged attacker to trick the endpoints into relaying the traffic to their own gateway. For example, if I understand things well, another user behind the NAT can easily make the NAT device relay the traffic to them by sending probes at the same time. I'm not sure how can this be defended against, and if it's even possible. Is anyone aware of any interesting reading on the subject of MITM of NAT traversal ? Are there any good software libraries that abstract away all these details
借 NAT 之例感叹现代计算背离端到端原则，一切都被 Web 平台和客户端-服务器架构吞没。
现代计算的故事似乎是「差即是好」的平方。Unix 和 C 至少还是设计出来的，但如今我们连这些设计都嫌太重，把一切都建在 Web 平台上——一个从未为运行程序而设计的、不连贯的大杂烩。所有网络都变成了客户端-服务器，或者说只剩 HTTP 请求：再见端到端原则（你好 NAT！）。我们用 WebRTC 替代 TCP、用 WebAssembly 替代汇编，牺牲大量性能、只有 95% 的时候能工作。换来的是安全性和安装的便利。如果操作系统能采用基于能力的安全模型，Web 平台也许能成为历史遗产。
e-dt查看英文原文
Modern computing seems to be a story of "worse is better", and not just the classical "worse is better" of Gabriel's paper but something that amounts to "worse is better squared". Gabriel bemoaned the adoption of Unix and C over more "well-thought-out" designs, but Unix and C were at least designed. ("Say what you will, at least it's an ethos.") The same could go for TCP/IP's lean design as opposed to the heavyweight OSI model. But it seems like even these designs are too onerous for the modern day, and instead we build what would normally go on top of Unix or TCP/IP on the Web. All platforms are now the Web platform, which was never designed to run programs and hence is a non-cohesive mess. All networking is now client-server, or indeed is now just HTTP requests: goodbye end-to-end principle (hello NAT!), goodbye protocols other than TCP or UDP. We can build the same things on this platform as we did with native platforms, but we have to do it using kludgy methods which sacrifice a lot of performance and only work 95% of the time: so instead of TCP, we get WebRTC, and instead of assembly we have WebAssembly. And what do we gain? We gain security, and we gain ease of installation (just go to www.zombo.com vs go to zombo.com, click on "Downloads", click on "Windows x64", wait 4 minutes for it to download... and so on). Can we do better? I think we can: if operating systems caught on to capability-based security, then the Web platform could become a legacy platform. (We see that phone OSes, which use capability based security, still direct us to "the app" rather than "the site".) And adoption of IPv6 could void all the kludgy workaround of NAT that we've had to develop. But we live in the world we inherit, rather than the one we imagine, so currently all we can do is traverse NATs and write webapps.
称赞 Tailscale 产品与内容输出的整体质量。
Tailscale 不断给人惊喜。喜欢他们产品的简洁，他们做的每件事似乎都很出色。
dramm查看英文原文
Tailscale just keeps impressing. Love how simple their product is and how everything they touch just seems so well done.
历次讨论
同类还值得读
TTY 揭秘（2008）
The TTY demystified (2008)
经典文章深入剖析了 Unix/Linux 中 TTY 子系统的工作原理，包括线路规程、终端驱动、信号与控制字符等机制。
系统与基础设施上首页 11 次 · 2009–2025linusakesson.net编辑精选为什么 GNU grep 这么快
Why GNU grep is Fast
FreeBSD 邮件列表上一篇广为流传的帖子，解释 GNU grep 为什么快：核心在于 Boyer-Moore 字符串搜索算法配合精心优化的内部循环和 I/O，让程序在搜索时“…
系统与基础设施上首页 9 次 · 2010–2022lists.freebsd.orgXplain：为普通人讲解 X11
Xplain – Explaining X11 for the rest of us
《Xplain》是作者（HN 用户 Jasper_）写的一系列 X11 长文，用他在浏览器中重建的 X11 绘图模型做交互演示，讲解 X11 的绘图模型与窗口系统设计。
系统与基础设施上首页 6 次 · 2013–2020magcius.github.io编辑精选旋风教程：为 Linux 创建极小 ELF 可执行文件（1999）
A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux (1999)
breadbox 写于 1999 年的经典教程，主题是如何为 Linux 手工构造并裁剪出体积极小的 ELF 可执行文件。
系统与基础设施上首页 6 次 · 2007–2025muppetlabs.comPostgreSQL 内部原理
The internals of PostgreSQL
《The Internals of PostgreSQL》是一本免费在线书籍，系统讲解 PostgreSQL 的内部实现，包括查询处理、并发控制、WAL、缓冲区管理等核心机制。
系统与基础设施上首页 5 次 · 2017–2025interdb.jp编辑精选