2

Whenever I host a server, I'm required to forward the listening ports of the server on my NAT device.

However, if I connect to a remote server, I won't be required to forward the port used for incoming data from the remote server.

Why is that so?

2
  • Not a programming question. Apr 2, 2011 at 17:09
  • You're right, my question belongs to Super User.
    – user54676
    Apr 2, 2011 at 19:40

3 Answers 3

1

When you make a connection outbound, the target address can be seen in the packet, the source address of your internal host is in the packet, so the NAT box "just" replaces the source address with its own, and sets up an entry in an internal table, so that for packets matching "this connection's characteristics" it knows to replace the destination address with the original source address, so the packets make it back to you.

For a server, the packet comes into the NAT from the outside and there's nothing to say which internal host it's meant for. There's no current table of connections. So instead, you need to define a rule saying "new connection requests for port 22 should be passed to this box over here".

On top of this, software running on your computers can choose to talk to any local NAT boxes with either NAT-PMP (Apple) or UPnP (Microsoft's protocol) to set up these associations automatically. But that only really helps when you don't care about which externally-facing port number you get.

1
  • Your explanation is as clear and complete as it could be! Thank you very much!
    – user54676
    Apr 3, 2011 at 1:29
0

The outgoing connection is assumed to be what you intend and want, so it allows the connection by default. The reverse is not true; you wouldn't want any rouge internet client to connect to any server on your computer, so you have to explicitly open this up. Otherwise it'd be the same as just putting your server right on the internet with no firewall.

7
  • But, for example, whenever I play an online game, the game receive connections from the internet, even though no port forwarding is required for these incoming connections.
    – user54676
    Apr 2, 2011 at 17:20
  • 2
    It doesn't just randomly receive connections. You initiate first contact with those servers, so the NAT knows to accept return connections back.
    – Andy
    Apr 2, 2011 at 19:32
  • -1 Re your last comment, you wrote "It doesn't just randomly receive connections. You initiate first contact with those servers, so the NAT knows to accept return connections back." <------ There is no such thing as a "return connection". And you're referring to the same connection, yet you talk like it's a different one
    – barlop
    Nov 26, 2016 at 20:06
  • @barlop First off, I believe you're supposed to vote based on the answer, not based on comments attached to it. Second, what happens very much depends on the games' networking code. Normal FTP functions they way I describe; the client would open a command connection to the server, and the server would attempt a direct data connection back to the client (a second channel). Its not inconceivable a game could operate like that.
    – Andy
    Nov 28, 2016 at 23:24
  • @Andy well, a)I consider your comment on your answer to be an elaboration of your answer, to be read with it, and thus part of it. And b)even if it wasn't part of it, or to be read with it, then the fact is your answr isn't that well worded n the fact that you could even make such a wrong comment without explicitly contradicting your answer, demonstrates that your answer can't have been very well worded. Now as for your comment..Even in the FTP case (which is a very specific case), and you're describing active ftp(the one that was developed first). (a specific case of a specific case)..(cont)
    – barlop
    Nov 29, 2016 at 0:48
-1

NAT blocks incoming connections, and lets outgoing connections out. Once the connection is made, then packets can go either way.

If you set up a server, you have to deal with NAT at your end if you use NAT. If you connect to a server, they have to deal with NAT at their end, if they use NAT.

If NAT blocked outgoing connections(it doesn't, but supposing it did), then you wouldn't be able to access the Internet.

You must log in to answer this question.