pwnat

pwnat (pronounced 'poe-nat') enables connections between two hosts both behind separate NATs without requiring either side to configure port forwarding. It exploits a quirk in how NAT implementations handle ICMP time-exceeded messages to establish bidirectional communication channels. One side runs as a server and the other as a client; the tool handles NAT traversal automatically. This makes it useful for penetration testing scenarios where direct connectivity is blocked by network address translation, enabling reverse shells and tunnel establishment through otherwise impassable network boundaries.