NAT Traversal on Bitsy Wiki

NAT Mapping and Filtering

Mon, 01 Jan 0001 00:00:00 +0000

A network address translation (NAT) device handles a flow of UDP packets according to two separate rules. The mapping rule decides which public address and port the NAT assigns when an inside host sends a packet out. The filtering rule decides which packets arriving at that public port are forwarded back in. RFC 4787 names three variants of each, and the variant a NAT implements decides which NAT traversal techniques can get through it.

STUN

Mon, 01 Jan 0001 00:00:00 +0000

Session Traversal Utilities for NAT (STUN) is a request/response protocol whose central job is to tell a host what its own address looks like from the far side of a network address translation (NAT) device. The host sends a small UDP packet, a Binding request, to a STUN server on the public internet. The server copies the source address and port the packet arrived from into its response. That address is the host’s server-reflexive address: the public mapping that the outermost NAT created for the socket that sent the request.

Hole Punching

Mon, 01 Jan 0001 00:00:00 +0000

Hole punching is a technique for opening a direct path between two hosts that are each behind a network address translation (NAT) device. Each host sends packets to the other’s public address at about the same time. A filtering NAT forwards an inbound packet only if the host behind it has already sent to that sender, so each host’s outbound packet “punches a hole” in its own NAT’s filter. The other side’s packets then arrive through that hole. Nothing on the path is reconfigured. The hosts create, with ordinary outbound traffic, the NAT state that a reply would have found.

TURN

Mon, 01 Jan 0001 00:00:00 +0000

Traversal Using Relays around NAT (TURN) is a protocol in which a client asks a server on the public internet for a relayed transport address, an IP address and port on the server itself, and the server forwards packets between that address and the client. A peer sends to the relayed address as if it were the client. The server wraps each packet and passes it down the client’s own connection to the server, and passes the client’s packets back out the same way. Both hosts only ever send to the server, so the path works through any network address translation (NAT) device and any firewall that allows the client to reach the server at all.

ICE

Mon, 01 Jan 0001 00:00:00 +0000

Interactive Connectivity Establishment (ICE) is the procedure two hosts use to find a working network path between them when either may be behind a network address translation (NAT) device. Each host, called an agent, gathers every address at which it might be reachable, called its candidates. The two agents exchange their candidate lists through a signalling channel, a path both can already reach, usually the application’s own server. Each then pairs its own candidates with the other’s and tests every pair by sending STUN requests directly to the peer. STUN is a small request/response protocol whose reply reports the address the request arrived from. The highest-priority pair that succeeds in both directions carries the traffic.

Running Without TURN

Mon, 01 Jan 0001 00:00:00 +0000

An application runs without TURN when it gives its ICE agent STUN servers but no TURN server, the relay that forwards packets between peers that cannot reach each other. ICE is the procedure that gathers each peer’s candidate addresses and tests every pairing. Without TURN it tests only direct paths, between three of its four kinds of candidate: host candidates, the machine’s own addresses; server-reflexive (srflx) candidates, the public address a STUN server reports; and peer-reflexive (prflx) candidates, addresses discovered during the tests themselves. The fourth kind, relayed (relay), exists only when a TURN server is configured. For any pair of peers with no direct path between them, every test fails and the two never exchange a packet. There is no degraded mode, no slower path and no partial connection: the pair does not connect at all.

Port Mapping Protocols

Mon, 01 Jan 0001 00:00:00 +0000

A port mapping protocol lets a host ask the network address translation (NAT) device in front of it to create a mapping on request. The host names its own address and port, the NAT forwards a public port to it for a stated lifetime, and packets arriving at that public port are admitted whoever sends them. The request is a port forward that software makes, rather than one a person types into a router’s admin page. Three such protocols are deployed: Universal Plug and Play Internet Gateway Device (UPnP IGD), NAT Port Mapping Protocol (NAT-PMP), and Port Control Protocol (PCP). Stripped of detail, all three do the same exchange. The host says “forward a public port to this private address and port,” and the NAT answers with the public address and port it allocated.