Let's say we have a STUN server at address stun_addr
and a server at address srv_addr
. Using STUN typically goes something like this:
- Client connects to the STUN server at
stun_addr
through NAT device. The NAT device translates the source address to natted_addr_1
- STUN server tells client the address from which it received the connection, which is
natted_addr_1
- Client contacts the server at
srv_addr
through the NAT device, and tells the external system to use natted_addr_1
if it wants to reach the client
- External system sends something to the client using
natted_addr_1
This will only work if the NAT device uses natted_addr_1
for both the communication to the STUN server and the other external system. More specifically, it only works if the NAT device will deliver the packets which arrive in step 4 to the client.
A symmetrical NAT device will use a different translation in steps 1 and 3 because the destination address of the traffic is different. In step 3, the source address in the packets to the server is translated to some other address natted_addr_2
.
The NAT device only knows about these combinations of source and destination addresses and will only allow these back in:
- From
stun_addr
to natted_addr_1
- From
srv_addr
to natted_addr_2
Unfortunately, the server has been told to use natted_addr_1
but packets from srv_addr
destined to natted_addr_1
will be rejected by the NAT device because of the NAT Address:Port restriction in-place.
To be more correct, 'address' should be replaced by 'address/port' in this answer, because NAT devices will work with the combination of IP address and port numbers.