NAT traversal

Source: Wikipedia, the free encyclopedia.

Network address translation traversal is a computer networking technique of establishing and maintaining Internet Protocol connections across gateways that implement network address translation (NAT).

NAT traversal techniques are required for many network applications, such as peer-to-peer file sharing and voice over IP.[1]

Network address translation

private IP addresses on private networks with a single public IP address for the router facing the Internet
. The network address translator changes the source address in network protocols for outgoing requests from that of an internal device to its external address, so that internal devices can communicate with hosts on the external network, while relaying replies back to the originating device.

This leaves the internal network ill-suited for hosting services, as the NAT device has no automatic method for determining the internal host for which incoming packets from the external network are destined. This is not a problem for general web access and email. However, applications such as

VoIP services, and video game consoles require clients to be servers as well. Incoming requests cannot be easily correlated to the proper internal host. Furthermore, many of these types of services carry IP address and port number information in the application data, potentially requiring substitution with deep packet inspection
.

Network address translation technologies are not standardized. As a result, the methods used for NAT traversal are often proprietary and poorly documented. Many traversal techniques require assistance from servers outside of the masqueraded network. Some methods use the server only when establishing the connection, while others are based on relaying all data through it, which increases the bandwidth requirements and latency, detrimental to real-time voice and video communications.

NAT traversal techniques usually bypass enterprise security policies. Enterprise security experts prefer techniques that explicitly cooperate with NAT and firewalls, allowing NAT traversal while still enabling marshalling at the NAT to enforce enterprise security policies.

IETF standards based on this security model are Realm-Specific IP (RSIP) and middlebox
communications (MIDCOM).

Techniques

Various NAT traversal techniques have been developed:

Symmetric NAT

The recent proliferation of

4G LTE
networks and therefore port prediction is largely ineffective on those mobile broadband networks.

IPsec

Encapsulating Security Payload packets traverse NAT. IPsec
uses several protocols in its operation which must be enabled to traverse firewalls and network address translators:

Many routers provide explicit features, often called IPsec Passthrough.[citation needed]

In Windows XP, NAT traversal is enabled by default, but in Windows XP with Service Pack 2 it has been disabled by default for the case when the VPN server is also behind a NAT device, because of a rare and controversial security issue.[6] IPsec NAT-T patches are also available for Windows 2000, Windows NT and Windows 98.[citation needed]

NAT traversal and IPsec may be used to enable opportunistic encryption of traffic between systems. NAT traversal allows systems behind NATs to request and establish secure connections on demand.

Hosted NAT traversal

Hosted NAT traversal (HNT) is a set of mechanisms, including media relaying and latching, that is widely used by communications providers for historical and practical reasons.

IETF advises against using latching over the Internet and recommends ICE for security reasons.[8]

IETF standards documents

See also

References

  1. ^ "Firewall and NAT Traversal Explained". Eyeball Networks Inc. 2013-07-05. Archived from the original on 2013-10-19. Retrieved 2013-10-10.
  2. CiteSeerX 10.1.1.103.1659. {{cite journal}}: Cite journal requires |journal= (help
    )
  3. ^ "Introduction to NAT". PJNATH Library. Retrieved 2016-05-30.
  4. ^ "Symmetric NAT Traversal using STUN".
  5. ^ "A New Method for Symmetric NAT Traversial in UDP and TCP" (PDF). Archived from the original (PDF) on 2017-02-02. Retrieved 2016-05-14.
  6. ^ "IPSec NAT Traversal is not recommended for Windows Server 2003 computers that are behind network address translators". Microsoft knowledge base #885348.[dead link]
  7. ^ Latching: Hosted NAT Traversal (HNT) for Media in Real-Time Communication, RFC 7362 2014-09-01
  8. ^ Interactive Connectivity Establishment (ICE): A Protocol for Network Address Translator (NAT) Traversal, RFC 8445 2018-07-01

External links

Retrieved from "https://en.wikipedia.org/w/index.php?title=NAT_traversal&oldid=1209150519"