About Opentopia
Opentopia Directory Encyclopedia Tools

NAT traversal

Encyclopedia : N : NA : NAT : NAT traversal

NAT Traversal refers to a solution to the common problem in TCP/IP networking of establishing connections between hosts in private TCP/IP networks which use NAT devices.

This problem is typically faced by developers of client-to-client networking applications especially in peer-to-peer and VoIP. NAT-T is commonly used by IPsec VPN clients in order to have ESP packets go through NAT.

Many techniques exist, but no technique works in every situation since NAT behavior is not standardized.

Many techniques require a public server on a well-known globally reachable IP address. Some methods use the server only when establishing the connection (such as STUN), while others are based on relaying all the data through it (such as TURN), which adds bandwidth costs and increases latency detrimental to conversational VoIP applications.

Most NAT behavior-based techniques fail to preserve enterprise security policies and break end-to-end transparency.

Enterprise security experts prefer techniques that explicitly cooperate with NAT and firewalls allowing NAT traversal while still enabling marshalling at the NAT to enforce enterprise security policies. To that extent, the most promissing IETF standards are Realm-Specific IP (RSIP) and Middlebox Communications (MIDCOM). SOCKS as the oldest NAT control protocol remains valid and is widely available while Universal Plug and Play (UPnP) is attractive for home/SOHO use because it might be widely supported by small gateways vendors.

Contents

The NAT Traversal Problem

NAT devices allow internal networks to communicate with external networks using a limited number of external IP Addresses by changing the source address of outgoing requests and listening for replies. This leaves the internal network ill suited to act as a server as the NAT device has no way of determining which internal host the incoming packets are destined for. On the Internet this problem was not generally relevant to home users behind NAT devices as they either do not need to act as servers or can use static NAT mappings to correlate incoming requests to internal hosts. Applications such as P2P file sharing (like BitTorrent) or VoIP networks (like Skype) require clients to act like servers and pose a problem to users behind NAT devices as incoming requests can not be correlated to the proper interal host.

NAT Traversal and IPsec

In order for IPsec to work through a NAT the following need to be allowed on the firewall:

often this is accomplished on home routers by enabling "IPsec Passthrough".

The default behaviour of Windows XP SP2 was changed to no longer have NAT-T enabled by default because of a rare and controversial security issue. This prevents most home users from using IPsec without making adjustments to their settings. To enable NAT-T for systems behind NATs to communicate with systems behind NATs the following registry key needs to be added and set to a value of 2: [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesIPsecAssumeUDPEncapsulationContextOnSendRule]

IPsec NAT-T patches are also available for Windows 2000, Windows NT and Windows 98.

One usage of NAT-T and IPsec is to enable opportunistic encryption between systems. NAT-T allows systems behind NATs to request and establish secure connections on demand.

NAT Traversal Security Issues

This article or section is in need of attention from an expert on the subject.
Please help recruit one, or improve this page yourself}} if you can. See [discussion page] for details.

Internal Links to NAT Traversal Techniques

NAT Traversal Protocols and Techniques based on NAT behavior

NAT Traversal based on NAT Control

NAT Traversal Combining Several Techniques

External Links

Other NAT Traversal IETF References

Universities

Checking NAT Behavior

Organizations, Portals

Other Research Papers (might requires registration, fees)

Open Source NAT traversal implementations

Some Vendor Links and White Papers (might be biased)

 

From Wikipedia, the Free Encyclopedia. Original article here. Support Wikipedia by contributing or donating.
All text is available under the terms of the GNU Free Documentation License See Wikipedia Copyrights for details.

Search Titles
0123456789
ABCDEFGHIJ
KLMNOPQRST
UVWXYZ?

E-mail this article to:

Personal Message: