2

I have a question about hole punching.

A-Client B-Client S-Rendezvous server

Both A and B connects to S. S learns the random NAT ports of clients. Then sends the IP/Port info to clients. Clients have each others IP/Port info from now on. Client A send a packet to B with a new port because NAT uses a new port if the destination is different. Than client B's NAT device receives the packet and drops it. So client B doesn't know the port of A which A uses to communicate with B, not the rendezvous server. Than B sends a packet to A's port that A used to communicate with server.

Won't A's NAT device drop the connection because A used this port for a different destination ?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 2:17
1

Client A sends a packet to B with a new port because NAT uses a new port if the destination is different.

Client A will use new port for different destination only if client A is using SYMMETRIC NAT which is the biggest problem in VOIP communication. Symmetric NAT not only translates your internal IP but also translates your port each time you connect to new destination. Rendezvous server S doesn't know that Client A has changed its port for contacting Client B.

Then B sends a packet to A's port that A used to communicate with server.

When client B sends a packet to A, that will be useless because B doesn't know that A has changed its port and the port which client B has taken from the Rendezvous server is obviously closed.

Won't A's NAT device drop the connection because A used this port for a different destination?

Exactly client A will block that traffic from B because client B has sent packet to that port of A which was meant to be opened for rendezvous server and that port is now closed. Even if that port is open it will still not accept the packets from B because that port is only open for rendezvous server. Anything from outside will be discarded. That's why symmetric NAT is always a problem.

If either of the client was not using symmetric NAT then simply client A sends a "UDP packet" to that IP:port of B which was taken by A from the Rendezvous server earlier. Ultimately this packet will be blocked too by B because B didn't request anything from A but A still thinks that its packet has reached to B because packet was sent over UDP. Then B will send a packet to A on that IP:Port on which A was listening to rendezvous server. But this time A has to accept the packet from B because A thinks that this a response of that request which A has sent to B earlier. Then A will send a packet to B again and B will accept it as a response. Connection is established. This is called UDP hole punching.

But how the communication will be established in the case of symmetric NAT? The standard solution is using the TURN server which stands for traversal utility over relay NAT. Turn server will act as a middle-men between both the clients and it won't be affected even If either or both the clients are behind symmetric NAT.

enter image description here

Instead of TURN server clients can also use DMZ and Port forwarding. Using either of them will redirect every request and response directly to the host behind NAT.

Why can't you use STUN server? Unfortunately, even STUN server fails to initialize session if one or both clients are behind Symmetric NAT.

  • Development in WebRTC and PJSIP libraries one day will completely overcome the problem of voip with NAT. Symmetric NAT may provide good security but it does cause problems even when hosting online games. – defalt Sep 6 '16 at 6:49
  • "Symmetric NAT may provide good security..." Not at all. NAT has nothing to do with security. Firewalls secure networks. NAT is a kludge to extend the life of IPv4 until IPv6 can become ubiquitous. Unfortunately, firewalls are a very convenient place to do NAT, and many people associate NAT with security, but it really has nothing to do with security. – Ron Maupin Jan 4 '17 at 14:58
  • @Ron Maupin By writing that I meant that it increases firewall effectiveness. Open ports are vulnerable to botnet attacks. Symmetric NAT makes sure that a particular port can't be used for communicating other host on internet and it should be kept open for that host to which a user is communicating with. It somehow contributes to firewall due to its strictness. – defalt Jan 4 '17 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.