NAT Traversal

Overview

NAT traversal is a computer networking technique of establishing and maintaining IP connections across gateways that implement NAT.

Fixing refers to any method a host behind a NAT uses to learn and maintain its external addressing information.

Hole Punching

When a NAT mapping is established, traffic for a particular application is usually permitted to traverse the NAT in both directions. These so-called pinholes are intentionally narrow, usually applying only to a single application for its duration of execution.

Two peers, each behind a NAT, can use hole punching to establish a direct connection with one another. They do so by both connecting to a third-party rendezvous server which exchanges the peers' external IP addressing information between them.

STUN

The Session Traversal Utilities for NAT (STUN) protocol involves a client behind a NAT and a server on the other side of the NAT. The STUN server's primary responsibility is to echo STUN requests back to a client in a way that allows the client addressing information (i.e. the server-reflexive transport address) to be fixed.

Message Format

The following is a diagram of the STUN message format.

STUN Message Type. Gives both the method (e.g. "binding") as well as class (request, response, error, or success).
Message Length. Permits a length of up to $2^{16} - 1$ bytes, excluding the 20-byte header.
Transaction ID. A random $96$ -bit transaction ID used for matching requests with responses or for debugging.
Attributes. A TLV arranged list of additional attributes to associate with the message.

Methods

Methods are embedded in the message type field to indicate what the STUN request/response should do:

Binding
- Used to fix the client's address or keep NAT bindings up-to-date.
Allocate (TURN)
- Used to allocate a relayed transport address.
Send (TURN)
- Used to send data from client to relay.
Data (TURN)
- Used to send data from relay to client.
ChannelBind (TURN)
- Used to associate a peer with a certain number.

Attributes

Attributes are used to carry most information within a STUN message. The following list a few:

MAPPED-ADDRESS (0x0001)
- Contains an address family indicator (IPv4 or IPv6) and the server-reflexive transport address.
XOR-PEER-ADDRESS (0x0012)
- XORed version of the peer's relayed transport address.
XOR-RELAYED-ADDRESS (0x0016)
- XORed version of the relayed transport address.
XOR-MAPPED-ADDRESS (0x0020)
- XORed version of the server-reflexive transport address.
CHANNEL-NUMBER (0x000C)
- Indicates what channel associated data belongs to.

TURN

The Traversal Using Relays around NAT (TURN) protocol is an extension of STUN that introduces a relay for shuttling data between two clients behind NATs when direct connections fail.

Clients can reserve allocations on the TURN server to obtain a relayed transport address using the STUN Allocate method. This address serves as the accessible stand-in to communicate with the client behind the NAT. Peers connected to the same relay can then communicate with one another in two ways:

Using STUN method Send (client to relay) or Data (relay to client).
Using STUN method ChannelBind to associate a peer with a channel number for subsequent message passing.
1. Notice this is effectively a compression technique to avoid having to specify the peer address each time.

ICE

The Interactive Connectivity Establishment (ICE) protocol is a set of heuristics for establishing a list of candidate transport addresses between two peers. Each peer constructs a list of host transport, server-reflexive, or relayed addresses (potentially provided by STUN and/or TURN). These lists are ordered to favor addresses providing direct connectivity over those that require data relaying.

Both peers share their respective lists and perform an identical set of operations to form a prioritized list of candidate pairs. These pairs are ordered to favor addresses behind fewer NATs or relays. One of the peers, designated as the controller, ultimately determines which candidate pair should be used.