Peer to Peer connection problem

[Duna2004]

Even though I use full cone nat (at least according to the available tests). I cannot create p2p connectiom using libjuice.

https://tomchen.github.io/symmetric-nat-test/

You are behind a Normal NAT

https://github.com/delthas/punch-check

./punch-check 
Test complete.
Hole-punching is supported.
Filtering: address and port-dependent.
Mapping: endpoint-independent.
Assignment preserves parity.
Assignment preserves local port.

I would like to understand what is the cause of the problem based on what I have read when no symetric nat is in the way there should be no problem using UDP punch hole.

I run a libjuice test application that tries to connect one agent to another using only a STUN server.

I configure both agents to forward only candidates containing srflx. However, after sending a STUN message to the udp punched hole on public IP address, the packet never reaches the other agent (messages from the google stun server arrives because Binding Request to stun is successfull).

Local description 1:
a=ice-ufrag:/uEX
a=ice-pwd:W2GOu2oEORzYUI0xENaisu
a=ice-options:ice2,trickle

Candidate 1: a=candidate:2 1 UDP 1686109951 185.152.64.187 57320 typ srflx raddr 0.0.0.0 rport 0

Local description 2:
a=ice-ufrag:ciIK
a=ice-pwd:Zsb/r0Y04fPOrdj4SgIq/q
a=ice-options:ice2,trickle

Candidate 2: a=candidate:2 1 UDP 1686109951 185.152.64.187 46291 typ srflx raddr 0.0.0.0 rport 0

Here is the communication from wireshark (but like I said basically Agent1 never receives StunBinding message from Agent2 nad vice versa). I have tried 4 different ISP providers but same result (my own ISP, mobile phone ISP, my company ISP and one of my collegues ISP)

60	4.986326193		192.168.0.1	57320	74.125.128.127	19302	STUN	84	Binding Request
63	5.004813103		74.125.128.127	19302	192.168.0.1	57320	STUN	76	Binding Success Response XOR-MAPPED-ADDRESS: 185.152.64.187:57320
775	6.988247799		192.168.0.1	46291	185.152.64.187	57320	STUN	144	Binding Request user: /uEX:ciIK
776	6.988506982		192.168.0.1	46291	74.125.128.127	19302	STUN	84	Binding Request
779	7.008142502		74.125.128.127	19302	192.168.0.1	46291	STUN	76	Binding Success Response XOR-MAPPED-ADDRESS: 185.152.64.187:46291
780	7.010145664		192.168.0.1	57320	185.152.64.187	46291	STUN	144	Binding Request user: ciIK:/uEX
788	7.488627603		192.168.0.1	46291	185.152.64.187	57320	STUN	144	Binding Request user: /uEX:ciIK
789	7.510841780		192.168.0.1	57320	185.152.64.187	46291	STUN	144	Binding Request user: ciIK:/uEX
1168	8.488982896		192.168.0.1	46291	185.152.64.187	57320	STUN	144	Binding Request user: /uEX:ciIK
1169	8.510614030		192.168.0.1	57320	185.152.64.187	46291	STUN	144	Binding Request user: ciIK:/uEX
1208	10.493099731		192.168.0.1	46291	185.152.64.187	57320	STUN	144	Binding Request user: /uEX:ciIK
1209	10.516753043		192.168.0.1	57320	185.152.64.187	46291	STUN	144	Binding Request user: ciIK:/uEX
1229	14.496404292		192.168.0.1	46291	185.152.64.187	57320	STUN	144	Binding Request user: /uEX:ciIK
1230	14.511266542		192.168.0.1	57320	185.152.64.187	46291	STUN	144	Binding Request user: ciIK:/uEX
1280	20.011231495		192.168.0.1	57320	74.125.128.127	19302	STUN	84	Binding Request
1281	20.029522408		74.125.128.127	19302	192.168.0.1	57320	STUN	76	Binding Success Response XOR-MAPPED-ADDRESS: 185.152.64.187:57320
1290	22.010511774		192.168.0.1	46291	74.125.128.127	19302	STUN	84	Binding Request
1292	22.029122348		74.125.128.127	19302	192.168.0.1	46291	STUN	76	Binding Success Response XOR-MAPPED-ADDRESS: 185.152.64.187:46291
1296	22.497436994		192.168.0.1	46291	185.152.64.187	57320	STUN	144	Binding Request user: /uEX:ciIK
1297	22.512264255		192.168.0.1	57320	185.152.64.187	46291	STUN	144	Binding Request user: ciIK:/uEX
1404	35.042895384		192.168.0.1	57320	74.125.128.127	19302	STUN	84	Binding Request
1405	35.061985333		74.125.128.127	19302	192.168.0.1	57320	STUN	76	Binding Success Response XOR-MAPPED-ADDRESS: 185.152.64.187:57320
1423	37.031995088		192.168.0.1	46291	74.125.128.127	19302	STUN	84	Binding Request
1424	37.050153697		74.125.128.127	19302	192.168.0.1	46291	STUN	76	Binding Success Response XOR-MAPPED-ADDRESS: 185.152.64.187:46291
1431	38.498112315		192.168.0.1	46291	185.152.64.187	57320	STUN	144	Binding Request user: /uEX:ciIK
1432	38.512453616		192.168.0.1	57320	185.152.64.187	46291	STUN	144	Binding Request user: ciIK:/uEX

The only thing I can think of is that the ISP NAT checks the Source Address at the IPV4 layer. Maybe some kind of ip spoofing on ipv4 layer could help?
Thank you very much for your help.

[paullouisageneau]

I run a libjuice test application that tries to connect one agent to another using only a STUN server.
I configure both agents to forward only candidates containing srflx.

This is the problem: both peers are on the same host and you filtered out host candidates. It means you are trying to connect the two peers via their external addresses on the gateway whereas they are both on the local network. This is called NAT hairpinning, and the feature is often not supported by ISP routers. Yours does not seem to support it, otherwise punch-check would write "Hairpinning is supported" like on the example.

You need to either stop filtering out candidates, set up the agents on two different networks, or use a router which supports hairpinning.