From 786ccc16d44af3bc4c6f4031da2225e93e6228d3 Mon Sep 17 00:00:00 2001
From: HardenedSteel <19209715+HardenedSteel@users.noreply.github.com>
Date: Sat, 13 Dec 2025 06:22:31 +0300
Subject: [PATCH 1/3] remove logprint for incorrect port number

---
 libi2pd/SSU2Session.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libi2pd/SSU2Session.cpp b/libi2pd/SSU2Session.cpp
index 8f58ec90..9244681a 100644
--- a/libi2pd/SSU2Session.cpp
+++ b/libi2pd/SSU2Session.cpp
@@ -1831,7 +1831,8 @@ namespace transport
 				bool isV4 = ep.address ().is_v4 ();
 				if (ep.port () != m_Server.GetPort (isV4))
 				{
-					LogPrint (eLogInfo, "SSU2: Our port ", ep.port (), " received from ", m_RemoteEndpoint, " is different from ", m_Server.GetPort (isV4));
+					// TODO: External port detected incorrectly.
+					// LogPrint (eLogInfo, "SSU2: Our port ", ep.port (), " received from ", m_RemoteEndpoint, " is different from ", m_Server.GetPort (isV4));
 					if (isV4)
 					{
 						if (i2p::context.GetTesting ())

From 76a481a759dc9632519fc0e0c4d359d69128e818 Mon Sep 17 00:00:00 2001
From: HardenedSteel <19209715+HardenedSteel@users.noreply.github.com>
Date: Sat, 13 Dec 2025 05:22:24 +0300
Subject: [PATCH 2/3] feat: change published port if full-cone

If we're behind full-cone NAT; update our published port number while
keeping our listening port number, so other peers can connect us even
we're behind NAT.
---
 libi2pd/SSU2Session.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libi2pd/SSU2Session.cpp b/libi2pd/SSU2Session.cpp
index 9244681a..c8086270 100644
--- a/libi2pd/SSU2Session.cpp
+++ b/libi2pd/SSU2Session.cpp
@@ -1838,14 +1838,20 @@ namespace transport
 						if (i2p::context.GetTesting ())
 							i2p::context.SetError (eRouterErrorSymmetricNAT);
 						else if (m_State == eSSU2SessionStatePeerTest)
+						{
 							i2p::context.SetError (eRouterErrorFullConeNAT);
+							i2p::context.UpdatePort((int)ep.port ());
+						}
 					}
 					else
 					{
 						if (i2p::context.GetTestingV6 ())
 							i2p::context.SetErrorV6 (eRouterErrorSymmetricNAT);
 						else if (m_State == eSSU2SessionStatePeerTest)
+						{
 							i2p::context.SetErrorV6 (eRouterErrorFullConeNAT);
+							i2p::context.UpdatePort((int)ep.port ());
+						}
 					}
 				}
 				else

From 5a00252a73304de399cacbebcd03bb756cbd6c05 Mon Sep 17 00:00:00 2001
From: HardenedSteel <19209715+HardenedSteel@users.noreply.github.com>
Date: Sat, 13 Dec 2025 07:22:00 +0300
Subject: [PATCH 3/3] fix: dont set as firewalled if full-cone

full-cone NATs can function normally if we map the ports
---
 libi2pd/SSU2Session.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libi2pd/SSU2Session.cpp b/libi2pd/SSU2Session.cpp
index c8086270..5edf8bea 100644
--- a/libi2pd/SSU2Session.cpp
+++ b/libi2pd/SSU2Session.cpp
@@ -2444,7 +2444,9 @@ namespace transport
 												session->SendPeerTest (6, buf + offset, len - offset, addr, true);
 											}	
 											SetTestingState (false);
-											if (GetRouterStatus () != eRouterStatusFirewalled && addr->IsPeerTesting ())
+											if (i2p::context.GetError () == eRouterErrorFullConeNAT)
+												SetRouterStatus (eRouterStatusOK);
+											else if (GetRouterStatus () != eRouterStatusFirewalled && addr->IsPeerTesting ())
 											{
 												SetRouterStatus (eRouterStatusFirewalled);
 												session->SetStatusChanged ();