<html>
<head>
<base href="https://wiki.asterisk.org/wiki">
<link rel="stylesheet" href="/wiki/s/2041/1/7/_/styles/combined.css?spaceKey=TOP&forWysiwyg=true" type="text/css">
</head>
<body style="background: white;" bgcolor="white" class="email-body">
<div id="pageContent">
<div id="notificationFormat">
<div class="wiki-content">
<div class="email">
<h2><a href="https://wiki.asterisk.org/wiki/display/TOP/NAT+Traversal+Testing">NAT Traversal Testing</a></h2>
<h4>Page <b>edited</b> by <a href="https://wiki.asterisk.org/wiki/display/~dsessions@digium.com">Darren Sessions</a>
</h4>
<br/>
<h4>Changes (1)</h4>
<div id="page-diffs">
<table class="diff" cellpadding="0" cellspacing="0">
<tr><td class="diff-added-lines" style="background-color: #dfd;">{gliffy:name=port restricted cone nat examp 1|align=left|size=L|version=1} <br></td></tr>
<tr><td class="diff-unchanged" >A NAT device translates a single IP address (i.e. something your broadband modem would assign) into a very large number of private addresses that can all be used to share that single IP address by modifying the network address information in IP packet headers while in transit. The problem with NAT is that it breaks many protocols that require incoming connections and protocols with IP addresses in them. <br> <br></td></tr>
<tr><td class="diff-snipped" >...<br></td></tr>
</table>
</div> <h4>Full Content</h4>
<div class="notificationGreySide">
<map name='GLIFFY_MAP_11338487_port_restricted_cone_nat_examp_1'></map>
<table width="100%">
<tr>
<td align="left">
<table>
<caption align="bottom">
</caption>
<tr>
<td>
<img style="border: none; width: 809px; height: 658px;"
usemap="#GLIFFY_MAP_11338487_port_restricted_cone_nat_examp_1"
src="/wiki/download/attachments/11338487/port+restricted+cone+nat+examp+1.png?version=1&modificationDate=1299163662819"
alt="A&#32;Gliffy&#32;Diagram&#32;named&#58;&#32;port&#32;restricted&#32;cone&#32;nat&#32;examp&#32;1"/>
</td>
</tr>
</table>
</td>
</tr>
</table>
<p>A NAT device translates a single IP address (i.e. something your broadband modem would assign) into a very large number of private addresses that can all be used to share that single IP address by modifying the network address information in IP packet headers while in transit. The problem with NAT is that it breaks many protocols that require incoming connections and protocols with IP addresses in them.</p>
<p>Several different kinds of NAT exist as defined in <a href="http://www.ietf.org/rfc/rfc3489.txt" class="external-link" rel="nofollow">rfc3489</a>.</p>
<ul>
<li><b>Full-cone</b><br/>
A full-cone NAT is one where all requests from the same internal IP address and port are mapped to the same external IP address and port. Any external host can send a packet to the internal host simply by sending a packet to the mapped external address.</li>
<li><b>Restricted cone</b><br/>
A restricted-cone NAT is one where all requests from the same internal IP address and port are mapped to the same external IP address and port. Unlike a full-cone NAT though, an external host can send a packet to the internal host only if the internal host had previously sent a packet to that external host.</li>
<li><b>Port-restricted cone</b><br/>
A port-restricted cone NAT is like a restricted-cone NAT, but the restriction also includes port numbers. An external host can send a packet to the internal host only if the internal host had previously sent a packet to that external host on the same port number.</li>
<li><b>Symmetric</b><br/>
A symmetric nat is a NAT where all requests from the same internal IP address and port to a specific destination IP address and port are mapped to the same external source IP address and port. If the same internal host sends a packet with the same source address and port to a different destination, a different mapping is used (these mappings are referred to as NAT translations). Only the external host that receives a packet can send a packet back to the internal host.</li>
</ul>
<p>With Asterisk SCF, there are several different methods that can be used in NAT transversal:</p>
<ul>
<li>STUN</li>
<li>TURN</li>
<li>ICE</li>
<li>Glacier2</li>
</ul>
<h4><a name="NATTraversalTesting-Components"></a>Components</h4>
<ul>
<li>Service Locator</li>
<li>Logger</li>
<li>Bridging</li>
<li>Routing</li>
<li>Media RTP pjmedia</li>
<li>SIP State Replicator</li>
<li>SIP Session Gateway</li>
</ul>
<h2><a name="NATTraversalTesting-Simulation"></a>Simulation</h2>
<p>Simulating the various kinds of NATs can be done using Linux iptables. In these examples, eth0 is the private network and eth1 is the public network.</p>
<ul>
<li>Full-cone
<div class="preformatted panel" style="border-width: 1px;"><div class="preformattedContent panelContent">
<pre>iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source <public ip goes here>
iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-destination <private ip goes here>
</pre>
</div></div></li>
<li>Restricted cone
<div class="preformatted panel" style="border-width: 1px;"><div class="preformattedContent panelContent">
<pre>iptables -t nat POSTROUTING -o eth1 -p tcp -j SNAT --to-source <public ip goes here>
iptables -t nat POSTROUTING -o eth1 -p udp -j SNAT --to-source <public ip goes here>
iptables -t nat PREROUTING -i eth1 -p tcp -j DNAT --to-destination <private ip goes here>
iptables -t nat PREROUTING -i eth1 -p udp -j DNAT --to-destination <private ip goes here>
iptables -A INPUT -i eth1 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -m state --state NEW -j DROP
iptables -A INPUT -i eth1 -p udp -m state --state NEW -j DROP
</pre>
</div></div></li>
<li>Port-restricted cone
<div class="preformatted panel" style="border-width: 1px;"><div class="preformattedContent panelContent">
<pre>iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source <public ip goes here>
</pre>
</div></div></li>
<li>Symmentric
<div class="preformatted panel" style="border-width: 1px;"><div class="preformattedContent panelContent">
<pre>echo "1" > /proc/sys/net/ipv4/ip_forward
iptables --flush
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE --random
iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
</pre>
</div></div></li>
</ul>
<h4><a name="NATTraversalTesting-Functional"></a>Functional</h4>
<p>These tests are used to make sure the various implemented methods work in several configurations.</p>
<p>These scenarios include:</p>
<ul>
<li>Full-cone</li>
<li>Restricted cone</li>
<li>Port-restricted cone</li>
<li>Symmetric</li>
</ul>
<h4><a name="NATTraversalTesting-Performance"></a>Performance</h4>
<p>These tests are used to make sure the various implemented methods work work under pressure.</p>
<p>These conditions include:</p>
<ul>
<li>High volume requests</li>
</ul>
<h2><a name="NATTraversalTesting-Diagrams"></a>Diagrams</h2>
<ul>
<li><h4><a name="NATTraversalTesting-FullconeNAT"></a><ins>Full-cone NAT</ins></h4>
<map name='GLIFFY_MAP_11338487_full_cone_nat_examp_1'></map>
<table width="100%">
<tr>
<td align="left">
<table>
<caption align="bottom">
</caption>
<tr>
<td>
<img style="border: none; width: 809px; height: 658px;"
usemap="#GLIFFY_MAP_11338487_full_cone_nat_examp_1"
src="/wiki/download/attachments/11338487/full+cone+nat+examp+1.png?version=2&modificationDate=1299161269509"
alt="A&#32;Gliffy&#32;Diagram&#32;named&#58;&#32;full&#32;cone&#32;nat&#32;examp&#32;1"/>
</td>
</tr>
</table>
</td>
</tr>
</table>
<map name='GLIFFY_MAP_11338487_full_cone_nat_examp_2'></map>
<table width="100%">
<tr>
<td align="left">
<table>
<caption align="bottom">
</caption>
<tr>
<td>
<img style="border: none; width: 809px; height: 658px;"
usemap="#GLIFFY_MAP_11338487_full_cone_nat_examp_2"
src="/wiki/download/attachments/11338487/full+cone+nat+examp+2.png?version=2&modificationDate=1299161296998"
alt="A&#32;Gliffy&#32;Diagram&#32;named&#58;&#32;full&#32;cone&#32;nat&#32;examp&#32;2"/>
</td>
</tr>
</table>
</td>
</tr>
</table>
</li>
<li><h4><a name="NATTraversalTesting-Restrictedcone"></a><ins>Restricted cone</ins></h4>
<map name='GLIFFY_MAP_11338487_restricted_cone_nat_examp_1'></map>
<table width="100%">
<tr>
<td align="left">
<table>
<caption align="bottom">
</caption>
<tr>
<td>
<img style="border: none; width: 808px; height: 658px;"
usemap="#GLIFFY_MAP_11338487_restricted_cone_nat_examp_1"
src="/wiki/download/attachments/11338487/restricted+cone+nat+examp+1.png?version=2&modificationDate=1299163232067"
alt="A&#32;Gliffy&#32;Diagram&#32;named&#58;&#32;restricted&#32;cone&#32;nat&#32;examp&#32;1"/>
</td>
</tr>
</table>
</td>
</tr>
</table>
</li>
<li><h4><a name="NATTraversalTesting-Portrestrictedcone"></a><ins>Port-restricted cone</ins></h4></li>
<li><h4><a name="NATTraversalTesting-Symmetric"></a><ins>Symmetric</ins></h4></li>
</ul>
</div>
<div id="commentsSection" class="wiki-content pageSection">
<div style="float: right;">
<a href="https://wiki.asterisk.org/wiki/users/viewnotifications.action" class="grey">Change Notification Preferences</a>
</div>
<a href="https://wiki.asterisk.org/wiki/display/TOP/NAT+Traversal+Testing">View Online</a>
|
<a href="https://wiki.asterisk.org/wiki/pages/diffpagesbyversion.action?pageId=11338487&revisedVersion=26&originalVersion=25">View Changes</a>
|
<a href="https://wiki.asterisk.org/wiki/display/TOP/NAT+Traversal+Testing?showComments=true&showCommentArea=true#addcomment">Add Comment</a>
</div>
</div>
</div>
</div>
</div>
</body>
</html>