AutoNAT: "refusing to dial peer with blocked observed address"

[Wiezzel]

I am starting a node, connecting to another one, and reading logs from libp2p_autonat. There I see this message appearing and I would like to understand what it means. Why is my address 'blocked'?

2023-09-20T15:49:23Z DEBUG libp2p_autonat::behaviour::as_client] Outbound dial-back request returned DialResponse { status_text: Some("refusing to dial peer with blocked observed address"), result: Err(DialRefused) }.

[thomaseizinger]

It is either because you are connecting from a relayed address or one that is not in the global IP range like 192.168.x.x.

See

rust-libp2p/protocols/autonat/src/behaviour.rs

Line 200 in 854a6ae

// If the endpoint of a connection is relayed or not global (in case of Config::only_global_ips),

.

[Wiezzel]

@thomaseizinger OK, so I have a follow-up question. The node that is sending the dial-back request is listening on /ip4/95.216.112.42/tcp/12347. That's the only listen addr that it uses. How is it possible that the remote peer recognizes it as connecting from a relayed or non-global address?

This is the identify protocol event logged on the remote peer.

Received { peer_id: PeerId("12D3KooWSyqmbHd1SYNnCNkJzanF37YnYD7zwG8WbqUSpuM15MQ5"), info: Info { public_key: PublicKey { publickey: Ed25519(PublicKey(compressed): ff41d62c6ff82ca262aeee78fca548caffe2436a442877425795a8abceceaa) }, protocol_version: "/subsquid/0.0.1", agent_version: "rust-libp2p/0.43.0", listen_addrs: ["/ip4/95.216.112.42/tcp/12347"], protocols: [StreamProtocol { inner: Right("/subsquid-worker/0.0.1") }, StreamProtocol { inner: Right("/ipfs/id/push/1.0.0") }, StreamProtocol { inner: Right("/meshsub/1.0.0") }, StreamProtocol { inner: Right("/meshsub/1.1.0") }, StreamProtocol { inner: Right("/libp2p/autonat/1.0.0") }, StreamProtocol { inner: Right("/ipfs/id/1.0.0") }, StreamProtocol { inner: Right("/libp2p/circuit/relay/0.2.0/stop") }], observed_addr: "/dns4/testnet-stage.subsquid.io/tcp/42346/p2p/12D3KooWQER7HEpwsvqSzqzaiV36d3Bn6DZrnwEunnzS76pgZkMU" } }

As you see, listen_addrs contains only a single public address.

[thomaseizinger]

It doesn't matter what the node is listening on but which address the AutoNAT server sees as the origin for the connection, i.e. it reads the IP address from the local TCP socket for example.

If the connection was established through a relay, then we track that internally and report that accordingly.

[Wiezzel]

@thomaseizinger

1. Is it possible to see the observed address in the logs? Would libp2p_autonat=debug do it?
2. Is there a way to to force AutoNAT to probe the listen addr instead of the incoming connection addr?

[thomaseizinger]

Is there a way to to force AutoNAT to probe the listen addr instead of the incoming connection addr?

That would turn all nodes into a bot-net that you can use to make DoS attacks :D

There is a V2 specification in the works that allows the remote to specify testing of an arbitrary testing in exchange for "paying" with some bandwidth: libp2p/specs#538

[thomaseizinger]

Is it possible to see the observed address in the logs? Would libp2p_autonat=debug do it?

I don't recall all exact logs but I am pretty sure some part of the stack will log inbound and outbound connections. You can always implement your own NetworkBehaviour and add logging for the specific callbacks:

rust-libp2p/swarm/src/behaviour.rs

Lines 133 to 191 in 484fc56

	fn handle_pending_inbound_connection(
	&mut self,
	_connection_id: ConnectionId,
	_local_addr: &Multiaddr,
	_remote_addr: &Multiaddr,
	) -> Result<(), ConnectionDenied> {
	Ok(())
	}
	/// Callback that is invoked for every established inbound connection.
	///
	/// This is invoked once another peer has successfully dialed us.
	///
	/// At this point, we have verified their [`PeerId`] and we know, which particular [`Multiaddr`] succeeded in the dial.
	/// In order to actually use this connection, this function must return a [`ConnectionHandler`](crate::ConnectionHandler).
	/// Returning an error will immediately close the connection.
	fn handle_established_inbound_connection(
	&mut self,
	_connection_id: ConnectionId,
	peer: PeerId,
	local_addr: &Multiaddr,
	remote_addr: &Multiaddr,
	) -> Result<THandler<Self>, ConnectionDenied>;
	/// Callback that is invoked for every outbound connection attempt.
	///
	/// We have access to:
	///
	/// - The [`PeerId`], if known. Remember that we can dial without a [`PeerId`].
	/// - All addresses passed to [`DialOpts`] are passed in here too.
	/// - The effective [`Role`](Endpoint) of this peer in the dial attempt. Typically, this is set to [`Endpoint::Dialer`] except if we are attempting a hole-punch.
	/// - The [`ConnectionId`] identifying the future connection resulting from this dial, if successful.
	///
	/// Note that the addresses returned from this function are only used for dialing if [`WithPeerIdWithAddresses::extend_addresses_through_behaviour`](crate::dial_opts::WithPeerIdWithAddresses::extend_addresses_through_behaviour) is set.
	///
	/// Any error returned from this function will immediately abort the dial attempt.
	fn handle_pending_outbound_connection(
	&mut self,
	_connection_id: ConnectionId,
	_maybe_peer: Option<PeerId>,
	_addresses: &[Multiaddr],
	_effective_role: Endpoint,
	) -> Result<Vec<Multiaddr>, ConnectionDenied> {
	Ok(vec![])
	}
	/// Callback that is invoked for every established outbound connection.
	///
	/// This is invoked once we have successfully dialed a peer.
	/// At this point, we have verified their [`PeerId`] and we know, which particular [`Multiaddr`] succeeded in the dial.
	/// In order to actually use this connection, this function must return a [`ConnectionHandler`](crate::ConnectionHandler).
	/// Returning an error will immediately close the connection.
	fn handle_established_outbound_connection(
	&mut self,
	_connection_id: ConnectionId,
	peer: PeerId,
	addr: &Multiaddr,
	role_override: Endpoint,
	) -> Result<THandler<Self>, ConnectionDenied>;

[Wiezzel]

@thomaseizinger Thank you, sir! That was very helpful. 🙏🏻 ❤️