Let's say we have a STUN server at address
stun_addr and a server at address
srv_addr. Using STUN typically goes something like this:
- Client connects to the STUN server at
stun_addr through NAT device. The NAT device translates the source address to
- STUN server tells client the address from which it received the connection, which is
- Client contacts the server at
srv_addr through the NAT device, and tells the external system to use
natted_addr_1 if it wants to reach the client
- External system sends something to the client using
This will only work if the NAT device uses
natted_addr_1 for both the communication to the STUN server and the other external system. More specifically, it only works if the NAT device will deliver the packets which arrive in step 4 to the client.
A symmetrical NAT device will use a different translation in steps 1 and 3 because the destination address of the traffic is different. In step 3, the source address in the packets to the server is translated to some other address
The NAT device only knows about these combinations of source and destination addresses and will only allow these back in:
Unfortunately, the server has been told to use
natted_addr_1 but packets from
srv_addr destined to
natted_addr_1 will be rejected by the NAT device because of the NAT Address:Port restriction in-place.
To be more correct, 'address' should be replaced by 'address/port' in this answer, because NAT devices will work with the combination of IP address and port numbers.