9

Apologies in advance for the relatively noob question and if this is off topic here ( I am not sure...)

The situation is that I have a UDP client and server bound to the same port.

My understanding of NAT is that UDP packets going out from the client to a specific endpoint will result in a temporary entry into the NAT table mapping the source port to the destination endpoint. (Is this right?)

Does this also mean that if an as-yet-unknown endpoint initiates a UDP communication with my server to that same port that the UDP packet will get through? Is there any reason why NAT would prevent this? Does NAT even figure in blocking/allowing these incoming packets?

Improve this question
5
  • 1
    Hi Sentinel, welcome to NESE. The answer will depend on which type of NAT is configured -- it sounds like what you are referring to is a Dynamic PAT (although different vendors call it different things). This answer on another Q&A provides more details about why Dynamic PAT is unidirectional, and wouldn't allow the "as-yet-unknown" endpoint to initiate a connection to your server (TCP or UDP). The third illustration in particular seems relevant to your question.
    – Eddie
    Sep 4, 2018 at 17:32
  • @Eddie Many thanks for your helpful info. I think for the benefit of those who may arrive here in future it would be a good idea to add this as an answer.
    – Sentinel
    Sep 4, 2018 at 21:20
  • If you feel it would be a more adequate answer than the ones posted, I can do another write up. Your choice =).
    – Eddie
    Sep 4, 2018 at 22:29
  • 1
    Eddie wrote The answer will depend on which type of NAT is configured: @Sentinel Some types of NATs are listed on Wikipedia: en.wikipedia.org/wiki/… It is obvious that a "Full-cone NAT" will react differently than a "Symmetric NAT" here.
    – Martin Rosenau
    Sep 5, 2018 at 5:21
  • 1
    @MartinRosenau Thank you. It looks like I am going to spend a lot of time studying NATs. I find it miraculous that programs like BitTorrent even function at all in this minefield of network trickery.
    – Sentinel
    Sep 5, 2018 at 8:25

2 Answers 2

Reset to default
7

The usual NAT works by creating mappings for each pair of communicating hosts as a 5-tuple of (protocol, inside address, inside port, outside address, outside port). Normally this entry is added to the table by the first outgoing packet.

If the as-yet-unknown outside host sends a UDP packet, there will be no entry in the table for it, and thus the NAT device will normally discard it, depending on its capabilities and configuration.

This kind of NAT is normally called "overload NAT" or "port address translation" to distinguish it from other varieties. A good description is http://www.ciscozine.com/nat-and-pat-a-complete-explanation/

If you want to accept incoming packets on your sever, you will need to set up a static entry on the NAT device for that server on that port. Effectively this says entries can be added to the NAT table by incoming packets.

The details are device and software dependent.

Improve this answer
1
  • OK I see thank you. I will leave this upvoted for a while before marking as accepted answer later, to allow for other opinions if there are any. I am surprised that so much P2P software relies on UDP discovery but do not seem to adopt NAT-related strategies, aside from UPnP
    – Sentinel
    Sep 4, 2018 at 9:34
4

As jonathanjo points out, a UDP NAPT table entry will consist of more than just a UDP port number (with NAPT, there are separate tables for UDP, TCP, and ICMP, and UDP port 12345 is different than TCP port 12345, while ICMP doesn't use ports but uses a Query ID instead of port number).

Without the specific outside IP address in a NAPT table entry, the NAPT device will assume the packet is destined for itself because it is the device that is actually addressed with the incoming IP address. If the NAPT device, itself, does not have the UDP port open, it should drop the packet, but that is really up to the OS of the NAPT device and how it is configured.

This is a big reason that NAPT is not security. You really need a firewall, too. The firewall will default to block all outside-originated connections, protecting the NAPT device itself. If the NAPT device is compromised, it has full access to the inside network, and an attacker then has full access to the inside network, even if it is a privately addressed network.

Improve this answer
2
  • Could you help with one thing? For typical home routers, why does 'port forwarding' (static pat, static napt?) not result in outbound initiating traffic following that rule? It seems they ignore the rule and go ahead with dynamic entries anyway. Is this the norm?
    – Sentinel
    Sep 6, 2018 at 7:32
  • 1
    Port forwarding is a rule for outside-initiated traffic to allow for outside hosts to initiate a connection to an inside host specified in the rule, not for inside-initiated traffic. It is basically a static entry in the NAPT table for one of the three protocols that can use NAPT (TCP, UDP, ICMP). See RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations.
    – Ron Maupin ♦
    Sep 6, 2018 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.