NAT Traversal

Note: work in progress

Overview

NAT (Network Address Translation) is widely used to connect private networks to the internet. The main idea is to map several private IP addresses to only one public IP address. Having in mind that P2P network clients should be able to communicate with each other, one basic question comes into mind: how can internet hosts communicate with a host in a private network? We will first have a look at NAT itself and problems it brings. Then, we show how to traverse NATs by either changing router's configuration or by using other tricks.

Network Address Translation

A network address is simply the IP ( + Port number for UDP/TCP). A NAT router receives an incoming IP packet, saves the address in its NAT table, rewrites sender address to one of its public addresses and sends the packet to the destination address. Now, the NAT router accepts incoming packets on this public address (NAT endpoint). These packets are forwarded to the private host. The most important facts are:

• The mapping depends on the sender's port number. If the private host uses two different outgoing port numbers, the NAT endpoints will differ.
• The private host has to send first. Otherwise no incoming packets will be forwarded to the private host.

The behavior of the NAT router is not standardized. The only thing that works with every NAT router is simple request and answer. That means the remote host answers a request using the port number the client used for its request. Some NATs allow replies from other ports or even hosts, some use different endpoint mappings for every session.

According to their behavior, NATs can be classified into four types:

• Full Cone
• Restricted Cone
• Port Restricted Cone
• Symmetric

Full Cone NAT A private host sends an initial request to A. As a result, the NAT router opens a public endpoint. Every connection to any remote host from PH's port A will be mapped to the same port A' at the NAT router. Now NAT's endpoint is availiable to all remote hosts. Every host may send a message from any source port to NAT's endpoint.

Figure 1: Full Cone NAT

Restricted Cone NAT A private host sends an initial request to A. As a result, the NAT router opens a public endpoint. Every connection to any remote host from PH's port A will be mapped to the same port A' at the NAT router. Now NAT's endpoint is availiable to all remote hosts. Every host may send a message from any source port to NAT's endpoint.

Figure 2: Restricted Cone NAT

Port Restricted Cone NAT A private host sends an initial request to A. As a result, the NAT router opens a public endpoint. Every connection to any remote host from PH's port A will be mapped to the same port A' at the NAT router. Now NAT's endpoint is availiable to all remote hosts. Every host may send a message from any source port to NAT's endpoint.

Figure 3: Port Restricted Cone NAT

Symmetric NAT Blub

Figure 4: Symmetric NAT

Hole punching

Text