Subject: [MMUSIC] Question concerning NAT traversal for ICE media flows

From: Livio Torrero <[email-masked]>
Date: Mon, 3 Dec 2007 03:42:19 +0100

I have a question concerning NAT traversal in ICE. Suppose that you  
have two UAs wishing to establish a media session using ICE. Suppose  
that the first UA (called UA A) is placed behind a NAT (called NAT A)  
with an address and port dependent mapping behavior and the second UA  
(called UA B) is placed behind a NAT (called NAT B) implementing an  
endpoint independent mapping behavior. Both the NATs implement also an  
address dependent filtering behavior. When checking the candidate  
pairs, host A cannot send a STUN Binding Request to B since NAT B  
drops it (due to its filtering behavior). On the other side host B  
does not know a valid public binding for host A (because of the  
mapping behavior of NAT A) and cannot send a STUN Binding request (or  
fails when sending it to the transport address obtained from the SDP  
payload). In such a scenario the hosts cannot communicate without a  
TURN server, am I right? I've tried to check some wifi routers  
implementing NATs (the ones typically used at home by standard users)  
and I have found that the behavior of NAT B is quite common...

Thank you very much,
Livio Torrero

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Mon, 3 Dec 2007 07:00:08 +0200

Le Monday 03 December 2007 04:42:19 ext Livio Torrero, vous avez écrit :
> [symmetric NAT to restricted-port NAT]
> In such a scenario the hosts cannot communicate without a
> TURN server, am I right?

Basically yes. But abstracting away from the actual protocols, I cannot think 
of a *reliable* mechanism that would avoid triangle routing in such case.

> I've tried to check some wifi routers 

It is pretty much recommended anyway. That's fine. It's type A which you don't 
want to have.

-- 
Rémi Denis-Courmont

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 05 Dec 2007 13:35:50 -0500

Actually, you CAN get a direct connection in some cases. In particular, 
if NAT A has a single external IP address, it would work. The reason is 
that the connectivity check from B to A will be dropped at A's NAT but 
creates a permission on B's NAT for the IP address on the public side of 
A's NAT. So when A sends its connectivity check, a new port is allocated 
but the IP address is the same. When this arrives at B's NAT the 
permission is in place, so the check goes trough. B notices a new peer 
reflexive candidate and reports it back to A. Media now flows directly.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   499 Thornall St.
Cisco Fellow                                   Edison, NJ 08837
Cisco, Voice Technology Group
[email-masked]
http://www.jdrosen.net                         PHONE: (408) 902-3084
http://www.cisco.com