I'm in the progress of implementing my own Signaling server with UDP hole punching, everything have been smooth up until both hosts were behind Restricted Cone NAT, then the ports for P2P communication CHANGES compared to the ones used to communicate with the server ( symmetric NAT behavior ). This only manifests when both hosts are behind Restricted Cone Nat, if one host is behind a Full Cone (or open) NAT, the other's public port for P2P doesn't change. Searching around for this exact problem, i've found this day brightening tidbit:

If both hosts have Restricted cone NATs or Symmetric NATs, the external NAT ports will differ from those used with S. On some routers, the external ports are picked sequentially, making it possible to establish a conversation through guessing nearby ports.

Could anyone confirm this is TRUE across the board, if yes, then WHY??? Is the reason(s) stated in an RFC somewhere? I thought the purpose of keeping the NAT restricted instead of Symmetric is to not change the external port when communicating with different host(s)...

  • Do RFCs 3489 and 4787 help?
    – Zac67
    Commented May 13, 2022 at 7:00

1 Answer 1


Restricted cone NAT means that an inbound (public-to-private) packet is only accepted and translated when there's been previous outgoing traffic from the private host to the same public IP address - see RFC 3489.

If this limitation is only present on one side, you can use the other side to satisfy that restriction. If it's present on both sides, there's no way you can establish mutual translation.

Note that all these mechanisms are moot when it comes to IPv6. You will need proper firewall ruling there.

  • Well, i have established outgoing traffic from the private host to the SAME public IP address by sending a simple UDP message from the private host to the public IP, so in theory, there should be a hole "punched" through NAT so that external traffic could come in, regardless if the UDP message from the private host reached its Destination, right?
    – Blip
    Commented May 13, 2022 at 9:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.