How can I connect client tcp ports behind router or firewall without NAT

Question

The client can connect the server via proxy but also I need to connect client TCP/UDP ports from server to client:
[vm ---> proxy ---> router or firewall ---> client:3000]

I don't want to open the client's port to the internet via NAT rule. I'm looking a way to do that. Is it possible?

Edit: I guess I have to add more information about my goal.

I have an app on the Linux Client (diagram) and it's have 2 job:
1- Create websocket beetween Client and VM for communication
2- USB/IP : I use the Usb/ip protocol to redirect local USB devices. Thats Why I need this solution.

Let me tell you how USB/IP works:

Architecture
The USB/IP protocol follows a server/client architecture. The server exports the USB devices and the clients import them. The device driver for the exported USB device runs on the client machine.

First the client opens a TCP/IP connection to the server and sends an OP_REQ_IMPORT packet. (I) The server replies with OP_REP_IMPORT. If the import was successful the TCP/IP connection remains open and will be used to transfer the URB traffic between the client and the server. The client may send two types of packets: the USBIP_CMD_SUBMIT to submit an URB, and USBIP_CMD_UNLINK to unlink a previously submitted URB. The answers of the server may be USBIP_RET_SUBMIT and USBIP_RET_UNLINK respectively.

virtual host controller                                 usb host
     "client"                                           "server"
 (imports USB devices)                             (exports USB devices)
         |                                                 |
         |                  OP_REQ_IMPORT                  |
         | ----------------------------------------------> |
         |                                                 |
         |                  OP_REP_IMPORT                  |
         | <---------------------------------------------- |
         |                                                 |
         |                                                 |
         |            USBIP_CMD_SUBMIT(seqnum = n)         |
         | ----------------------------------------------> |
         |                                                 |
         |            USBIP_RET_SUBMIT(seqnum = n)         |
         | <---------------------------------------------- |
         |                        .                        |
         |                        :                        |
         |                                                 |
         |            USBIP_CMD_SUBMIT(seqnum = m)         |
         | ----------------------------------------------> |
         |                                                 |
         |            USBIP_CMD_SUBMIT(seqnum = m+1)       |
         | ----------------------------------------------> |
         |                                                 |
         |            USBIP_CMD_SUBMIT(seqnum = m+2)       |
         | ----------------------------------------------> |
         |                                                 |
         |            USBIP_RET_SUBMIT(seqnum = m)         |
         | <---------------------------------------------- |
         |                                                 |
         |            USBIP_CMD_SUBMIT(seqnum = m+3)       |
         | ----------------------------------------------> |
         |                                                 |
         |            USBIP_RET_SUBMIT(seqnum = m+1)       |
         | <---------------------------------------------- |
         |                                                 |
         |            USBIP_CMD_SUBMIT(seqnum = m+4)       |
         | ----------------------------------------------> |
         |                                                 |
         |            USBIP_RET_SUBMIT(seqnum = m+2)       |
         | <---------------------------------------------- |
         |                        .                        |
         |                        :                        |

user_5747944 · Answer

What you're looking for is NAT traversal. But usually the client has to do something to help establish this connection.

From the techniques section:

The following NAT traversal techniques are available:

Socket Secure (SOCKS) is a technology created in the early 1990s that uses proxy servers to relay traffic between networks or systems.

Traversal Using Relays around NAT (TURN) is a relay protocol designed specifically for NAT traversal.

NAT hole punching is a general technique that exploits how NATs handle some protocols (for example, UDP, TCP, or ICMP) to allow previously blocked packets through the NAT.

UDP hole punching

TCP hole punching

ICMP hole punching

Session Traversal Utilities for NAT (STUN) is a standardized set of methods and a network protocol for NAT hole punching. It was designed for UDP but was also extended to TCP.

Interactive Connectivity Establishment (ICE) is a complete protocol for using STUN and/or TURN to do NAT traversal while picking the best network route available. It fills in some of the missing pieces and deficiencies that were not mentioned by STUN specification.

UPnP Internet Gateway Device Protocol (IGDP) is supported by many small NAT gateways in home or small office settings. It allows a device on a network to ask the router to open a port.

NAT-PMP is a protocol introduced by Apple as an alternative to IGDP.

PCP is a successor of NAT-PMP.

Application-level gateway (ALG) is a component of a firewall or NAT that allows for configuring NAT traversal filters. It is claimed by numerous people that this technique creates more problems than it solves.

Among these techniques, I've seen use of STUN servers most commonly, particularly in web/online technologies. For example, see the use of STUN servers (and other techniques) applied in WebRTC for peer-to-peer connections.

ngrok is another tool commonly used to tunnel connections through the internet to traverse through the NAT. Often used for development purposes. May not be suitable depending on exactly the nature/volume of traffic you have.

user_17341411 · Answer

The only way I think to do it, is with ngrok (package of Node.js) and it's temporary, the url changes over the time.

Is possible to make a callback from there, to change the endpoint, reflecting the new address.

user_9993205 · Answer

Seems your problem is reincarnation of FTP active client-server communication mode, where server has to callback the client.

If this is the case, your question is both answered AND not, as this problem is both very old AND unsolvable (kind of ;P).

You NEED to open that port. There is no way around it. Choose one:

either in some way on Internet (e.g. protected)
OR - NOT on Internet

Information on FTP to understand if this is your case:

If it is, your search for solution just became clearer.

You do not provide specifics of YOUR solution, but following ideas may be of help. Each of them is the variant of 2 above options:

VPN. Client installs VPN, VPN server is installed at the server, thus client appears to be in same LAN, and callback is possible. OpenVPN, wireguard are examples, as other mentioned.
IPsec. Install IPsec VPN between client and server, effectively joining both LANs to some degree. Openswan (or other *swan) are examples of such software.
ALG. https://en.wikipedia.org/wiki/Application-level_gateway page mentions possibility to create a third-party plugins. More or less automagical protocol-specific proxy.
NAT rule with protection - allow connections from server IP only.
Reverse proxy - on top of above. You may add authentication, TLS encryption, etc. E.g. Nginx can do both TCP and UDP. SaaS are available, like Ngrok mentioned above
Rewrite your app's client-server communication. Similar to how FTP Passive mode appeared back in 1994(!)

How can I connect client tcp ports behind router or firewall without NAT

3 Answers