NAT traversal is one of those problems that seems solved until you actually try to punch a hole through a symmetric NAT sitting in front of a mobile carrier or a corporate firewall. The standard toolbox — STUN, TURN, ICE, UDP hole punching — works most of the time, but the failure modes are ugly enough that TURN relays remain a permanent tax on every serious P2P system, from WebRTC video to game netcode to Tailscale.

This project takes an unusually clever angle: it abuses ICMP Destination Unreachable packets as a signaling and traversal primitive. The trick is subtle but elegant. When a router generates an ICMP error, it embeds the original triggering IP header and the first several bytes of the offending transport payload inside the ICMP body. That embedded copy is treated as legitimate by NAT state machines along the return path — meaning you can smuggle a packet through a mapping that wouldn't otherwise accept unsolicited inbound traffic.

Why this matters for a technical audience:

• It sidesteps assumptions baked into every NAT box. Most middleboxes are aggressively permissive about ICMP because breaking Path MTU Discovery breaks the internet. That permissiveness is exactly what the technique exploits.
• It's a live demonstration of a protocol edge case. RFC 792's rule that ICMP errors carry the original IP header plus 8 bytes of payload was designed for diagnostics, not covert channels — but the boundary between the two has always been thin.
• It has real implications for firewall vendors and P2P designers. If this works reliably against common CGNAT deployments, it's a cheaper alternative to TURN. If it works against enterprise firewalls, it's a finding worth writing up.

The repo is small enough to read in one sitting, which is exactly the right size for a proof of concept like this. Expect Go or C, raw sockets, and a lot of hand-crafted packet construction. Even if the technique turns out to be fragile in the wild (many stateful firewalls now validate the embedded 5-tuple against active connections), the exercise of reading through the implementation is a masterclass in how NAT state actually works — knowledge that's increasingly rare as developers hide behind higher-level libraries.

This is the kind of Show HN that used to routinely hit the front page a decade ago: one person, one weird trick, one repo. It deserves a look before it disappears into the new-page abyss.