tests: Add tests for easy-hard NAT combinations

[flub]

Description

We should be able to traverse NATs with a combination of a "very easy"
and "hard" NAT. Adjust the SimpleFirewallRouting to allow emulating
that behaviour.

Verified by reverting c20a684 and
then test_hard_nat_server_opens_path fails.

Breaking Changes

none

Notes & open questions

Look how simple this was. #675 was a red herring.

Change checklist

• Self-review.
• Documentation updates following the style guide, if relevant.
• Tests if relevant.

[github-actions]

Documentation for this PR has been generated and is available at: https://n0-computer.github.io/noq/pr/685/docs/noq/

Last updated: 2026-06-03T10:36:05Z

[github-actions]

Performance Comparison Report

103d729bad3218d4748e39ae3691ce7719e991c4 - artifacts

Raw Benchmarks (localhost)

Scenario	noq	upstream	Delta	CPU (avg/max)
large-single	5406.0 Mbps	7876.7 Mbps	-31.4%	92.9% / 97.9%
medium-concurrent	5492.6 Mbps	7926.6 Mbps	-30.7%	94.5% / 100.0%
medium-single	3609.8 Mbps	4658.9 Mbps	-22.5%	93.5% / 101.0%
small-concurrent	3842.0 Mbps	5311.8 Mbps	-27.7%	97.5% / 154.0%
small-single	3495.3 Mbps	4746.6 Mbps	-26.4%	98.8% / 154.0%

Netsim Benchmarks (network simulation)

Condition	noq	upstream	Delta
ideal	3104.8 Mbps	3959.7 Mbps	-21.6%
lan	782.4 Mbps	812.9 Mbps	-3.8%
lossy	69.8 Mbps	55.9 Mbps	+25.0%
wan	83.8 Mbps	83.8 Mbps	~0%

Summary

noq is 26.9% slower on average

---

e65f1378b4212b795a030784b1c6abf41f499163 - artifacts

Raw Benchmarks (localhost)

Scenario	noq	upstream	Delta	CPU (avg/max)
large-single	5487.7 Mbps	7890.9 Mbps	-30.5%	94.4% / 99.0%
medium-concurrent	5445.2 Mbps	7871.2 Mbps	-30.8%	94.7% / 98.6%
medium-single	3587.6 Mbps	4746.4 Mbps	-24.4%	96.6% / 149.0%
small-concurrent	3779.1 Mbps	5269.9 Mbps	-28.3%	89.9% / 98.4%
small-single	3561.7 Mbps	4858.2 Mbps	-26.7%	92.3% / 102.0%

Netsim Benchmarks (network simulation)

Condition	noq	upstream	Delta
ideal	N/A	4065.7 Mbps	N/A
lan	N/A	810.3 Mbps	N/A
lossy	N/A	55.9 Mbps	N/A
wan	N/A	83.8 Mbps	N/A

Summary

noq is 28.6% slower on average

---

d4892df2e117e6d02d716c0ae49fee506175b431 - artifacts

Raw Benchmarks (localhost)

Scenario	noq	upstream	Delta	CPU (avg/max)
large-single	5368.4 Mbps	7989.1 Mbps	-32.8%	95.6% / 100.0%
medium-concurrent	5341.7 Mbps	7581.2 Mbps	-29.5%	97.0% / 148.0%
medium-single	3584.8 Mbps	4749.1 Mbps	-24.5%	88.8% / 97.0%
small-concurrent	3714.9 Mbps	5042.7 Mbps	-26.3%	95.2% / 103.0%
small-single	3489.7 Mbps	4875.6 Mbps	-28.4%	94.3% / 102.0%

Netsim Benchmarks (network simulation)

Condition	noq	upstream	Delta
ideal	3100.6 Mbps	4123.2 Mbps	-24.8%
lan	782.4 Mbps	810.3 Mbps	-3.4%
lossy	69.8 Mbps	69.8 Mbps	~0%
wan	83.8 Mbps	83.8 Mbps	~0%

Summary

noq is 27.7% slower on average

[divagant-martian]

minor docs request but looks good!

[matheus23]

Just the nits above, but apart from that, I can confirm this fails when I revert c20a684.