Intro. of NAT and NAT Traversal

1. From NAT to NAT Traversal
2014/12/25
Qlync Inc.
YAO, LI-WEI
1

2. How to access network resource
anytime and anywhere?
2

3. How to access network resource
anytime and anywhere?
• Locate Resource
• Signal —> Not Today
• Access Resource
• P2P Communication —> Today
3

4. Agenda
• Network Resource or Service
• Public and Private IP Address
• What is NAT?
• How to access Network Resource behind NAT?
• Port Forwarding
• NAT Traversal
• ICE Protocol
• ICE related projects - WebRTC
4

5. Network Resource/Service
• Web Page
•
• File Download
•
• Video/Audio Streaming
•
5

6. Network Resource/Service
• Web Page —> HTTP/HTTPS
•
• File Download —> FTP/SAMBA
•
• Video/Audio Streaming —> RTSP/RTP
•
6

7. Network Resource/Service
• Web Page —> HTTP/HTTPS
• —> TCP:80/TCP:443
• File Download —> FTP/SAMBA
• —> TCP:21/TCP:445
• Video/Audio Streaming —> RTSP/RTP
• —> TCP:554/UDP:554/UDP:16384-32767
7

8. Network Resource/Service
• Web Page —> HTTP/HTTPS
• —> TCP:80/TCP:443
• File Download —> FTP/SAMBA
• —> TCP:21/TCP:445
• Video/Audio Streaming —> RTSP/RTP
• —> TCP:554/UDP:554/UDP:16384-32767
+ Server IP Address
8

9. Public and Private IP Address
http://developer.eyeball.com/faq.php
9

10. Public and Private IP Address
http://www.ic.ims.hr
10

11. Public and Private IP Address
http://www.highteck.net/EN/Network/Addressing_the_Network-IPv4.html
11

12. What is NAT?
• Remapping one IP address
space into another
• Private IP/port mapping to
Public IP/port
• Rewrite the source and/or
destination addresses of IP
packets as they pass the
router or firewall
• Server: IP address
• Resource: Protocol:Port
12

13. http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_7-3/anatomy.html
13

14. SNAT - Private to Public
http://linux.vbird.org/linux_server/0250simple_firewall.php
14

15. SNAT - Private to Public
http://linux.vbird.org/linux_server/0250simple_firewall.php
15

16. How to access Network
Resource behind NAT?
=
Public to Private?
16

17. DNAT - Public to Private
http://linux.vbird.org/linux_server/0250simple_firewall.php
17

18. Port Forwarding
http://panasonic.net/pcc/support/netwkcam/technic/port_fwrd.html
18

19. Router Setting
http://community.linksys.com/t5/Cameras/port-forwarding-questions/td-p/318824
19

20. With Router or Gateway Control
Port Forwarding
+
Static Public IP/
Dynamic Public IP + DDNS*
*http://www.tp-link.tw/article/?faqid=297
20

21. With Router or Gateway Control
http://www.quickmeme.com/IM-KING-OF-THE-WORLD
21

22. Without Router or Gateway
Control
22

23. Without Router or Gateway Control
https://www.flickr.com/photos/39561139@N05/4488876837/galleries/
23

24. Nothing is
Impossible!
R&D CAN DO ANYTHING!
http://www.englishbaby.com/findfriends/view_photo/251578
24

25. Without Router or Gateway
Control
How to access Network
Resource behind NAT?
=
NAT Traversal Solutions
25

26. NAT Traversal Solutions
• Universal Plug and Play -
Internet Gateway Device:
UPnP-IGD
• SOCKS Proxy
• Application Layer Gateway:
ALG
• Interactive Connection
Establishment: ICE = STUN +
TURN
26

27. UPnP-IGD
http://blog.chinaaet.com/detail/28455
27

28. UPnP-IGD
http://blog.chinaaet.com/detail/28455
28

29. SOCKS Proxy
29
http://stackoverflow.com/questions/18428498/sending-udp-packets-through-socks-proxy

30. SOCKS Proxy
http://stackoverflow.com/questions/18428498/sending-udp-packets-through-socks-proxy
30

31. ALG
http://www.h3c.com/portal/Technical_Support___Documents/Technical_Documents/Routers/
H3C_SR6600_Series_Routers/Configuration/Operation_Manual/H3C_SR6600_OM-Release_2315(V1.09)/
07/201212/765251_1285_0.htm
31

32. ICE
STUN + TURN
UDP Hole
Punching
+
Relay
http://thesalesblog.com/blog/2013/09/01/some-thoughts-on-pricing-power/32

33. ICE = STUN + TURN
http://blog.schertz.name/2012/10/lync-edge-stun-turn/
33

34. NAT Types
• Full Cone NAT
• Address Restricted NAT
• Port Restricted NAT
• Symmetric NAT
34

35. Full Cone
Mapping: 192.168.2.2:4445 <-> 1.1.1.4:10100
Policy: ALLOW ALL TO 1.1.1.4:10100
Full Cone 只是單純的做位址轉換，並未對進出的封包設限。︒
http://www.slideshare.net/dadaista/nat-traversal
35

36. Address Restricted
Mapping: 192.168.2.2:4445 <-> 1.1.1.4:10100
Policy: ALLOW 1.1.1.5 TO 1.1.1.4:10100
ALLOW 1.1.1.6 TO 1.1.1.4:10100
只有收過NAT 內部送來的封包的地址才能將封包送入 Restrict Cone NAT 內
http://www.slideshare.net/dadaista/nat-traversal
36

37. Port Restricted
只有收過NAT 內部送來的封包的地址及 Port Number 才能將封包送入 Restrict Cone NAT 內。︒
Mapping: 192.168.2.2:4445 <-> 1.1.1.4:10100
Policy: ALLOW 1.1.1.5:7777 TO 1.1.1.4:10100
*ALLOW 1.1.1.6:7777 TO 1.1.1.4:10100
http://www.slideshare.net/dadaista/nat-traversal
37

38. Symmetric
Symmetric NAT只允許先由私有網域內的使⽤用者發送封包到網際網路中的使⽤用者 可以回傳封包
Mapping: 192.168.2.2:4445 <-> 1.1.1.4:10100
192.168.2.2:4445 <-> 1.1.1.4:10179
Policy: ALLOW 1.1.1.5:7777 TO 1.1.1.4:10100
ALLOW 1.1.1.6:7777 TO 1.1.1.4:10179
http://www.slideshare.net/dadaista/nat-traversal
38

39. UDP Hole Punching
Different NAT Type, Different Approach
http://www.drdobbs.com/jvm/punching-holes-with-java-rmi/217400127
39

40. http://www.brynosaurus.com/pub/net/p2pnat/40

41. STUN (RFC 5389/3489)
Abstract
Session Traversal Utilities for NAT (STUN) is a protocol that serves as a
tool for other protocols in dealing with Network Address Translator (NAT)
traversal. It can be used by an endpoint to determine the IP address and port
allocated to it by a NAT. It can also be used to check connectivity between
two endpoints, and as a keep-alive protocol to maintain NAT bindings. STUN
works with many existing NATs, and does not require any special behavior
from them.
STUN is not a NAT traversal solution by itself. Rather, it is a tool to be used
in the context of a NAT traversal solution. This is an important change from
the previous version of this specification (RFC 3489), which presented STUN
as a complete solution.
This document obsoletes RFC 3489.
41

42. http://www.cs.nccu.edu.tw/%7Elien/Writing/NGN/firewall.htm42

43. http://www.cs.nccu.edu.tw/%7Elien/Writing/NGN/firewall.htm
43

44. http://speed.cis.nctu.edu.tw/~ydlin/pdf/NAT-Compatibility-Testbed.pdf
44

46. TURN (RFC 5766/6062)
Abstract
If a host is located behind a NAT, then in certain situations it can be
impossible for that host to communicate directly with other hosts (peers).
In these situations, it is necessary for the host to use the services of an
intermediate node that acts as a communication relay. This specification
defines a protocol, called TURN (Traversal Using Relays around NAT),
that allows the host to control the operation of the relay and to exchange
packets with its peers using the relay. TURN differs from some other relay
control protocols in that it allows a client to communicate with multiple
peers using a single relay address.
The TURN protocol was designed to be used as part of the ICE
(Interactive Connectivity Establishment) approach to NAT traversal,
though it also can be used without ICE.
46

47. ICE = STUN + TURN
http://blog.schertz.name/2012/10/lync-edge-stun-turn/
47

48. ICE (5245/5768)
Abstract
This document describes a protocol for Network Address
Translator (NAT) traversal for UDP-based multimedia sessions
established with the offer/answer model. This protocol is called
Interactive Connectivity Establishment (ICE). ICE makes use of
the Session Traversal Utilities for NAT (STUN) protocol and its
extension, Traversal Using Relay NAT (TURN). ICE can be used
by any protocol utilizing the offer/answer model, such as the
Session Initiation Protocol (SIP).
48

49. ICE Candidate…
SDP…
…

50. WebRTC is a free, open
project that provides
browsers and mobile
applications with Real-Time
Communications (RTC)
capabilities via simple APIs.
50

51. On-demand Live Video and Audio
https://fr.jocly.com/node/339
51

52. WebRTC Architecture
http://www.html5rocks.com/en/tutorials/webrtc/basics/
52

53. WebRTC Find Connection Candidates
http://www.html5rocks.com/en/tutorials/webrtc/basics/
53

54. WebRTC Data Pathways
http://www.html5rocks.com/en/tutorials/webrtc/basics/
54