Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sanity check please.

If I send UDP packets from Machine A behind a NAT to Machine B's port N, where Machine B is outside the NAT (elsewhere on the Internet), can I reasonably expect that NAT to pass UDP packets received from Machine B on port N back to port N on Machine A, without requiring manual port forwarding on the NAT?

share|improve this question
add comment

3 Answers

I would not expect that.

You can have multiply IPs behind NAT, so You need to choose to which it should be forwarded. Outside of NAT only router IP is visible and internal NAT IPs are not visible.

UDP does not form connection, but its just a datagram traveling across network.

There is also difference between sending port and receiving port number.

share|improve this answer
add comment

Only if the source port of the original outgoing datagram was also port N, and if the NAT didn't choose to float the source port.

That is, the first UDP datagram from Machine A looks like this on your LAN:

       Source IP: MachineAPrivate  
     Source Port: PortA     <-- note this is typically different than the destination port  
  Destination IP: MachineBPublic  
Destination Port: PortN  

Then, after it is translated by the NAT in the outbound direction, it looks like this:

       Source IP: NATPublic  
     Source Port: PortC   <-- note this may or may not be the same as "PortA" above  
  Destination IP: MachineBPublic  
Destination Port: PortN  

Now, when Machine B replies, the reply typically looks like this:

       Source IP: MachineBPublic  
     Source Port: PortN  
  Destination IP: NATPublic  
Destination Port: PortC  

Then, after it goes through the inbound NAT translation process:

       Source IP: MachineBPublic  
     Source Port: PortN  
  Destination IP: MachineAPrivate  
Destination Port: PortA  

So, IF Machine A sends the frame from the same source port as the destination port ("Port N"), and IF the NAT is able to preserve that source port (i.e. it's configured to preserve source ports when possible, and that source port is not in use), THEN you can expect a reply to "Port N" to get back to Machine A.

Here's the authoritative reference on proper NAT UDP behavior:
RFC 4787 / BCP 127: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP

share|improve this answer
add comment

Close, but Machine B needs to look at the source address and port number that it actually receives, which might be different than N.

The NAT at Machine A might not use the same port N that Machine A sent on. (Imagine machine C behind that same NAT also sending on port N: they can't both use it.) So Machine B might see a different source port, M. But if the NAT does that, then it should accept traffic sent back to port M and automatically map it back to N at Machine B.

In other words, as long as Machine B sends back to the source address and source port given in the packet it received, that you can reasonably expect the return packet to find its way back to the original source. This assumes that the return packet is sent within a short amount of time, as automatic NAT rules tend to timeout after some number of minutes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.