22

Sanity check please.

If I send UDP packets from Machine A behind a NAT to Machine B's port N, where Machine B is outside the NAT (elsewhere on the Internet), can I reasonably expect that NAT to pass UDP packets received from Machine B on port N back to port N on Machine A, without requiring manual port forwarding on the NAT?

3 Answers 3

24

Only if the source port of the original outgoing datagram was also port N, and if the NAT didn't choose to float the source port.

That is, the first UDP datagram from Machine A looks like this on your LAN:

       Source IP: MachineAPrivate  
     Source Port: PortA     <-- note this is typically different than the destination port  
  Destination IP: MachineBPublic  
Destination Port: PortN  

Then, after it is translated by the NAT in the outbound direction, it looks like this:

       Source IP: NATPublic  
     Source Port: PortC   <-- note this may or may not be the same as "PortA" above  
  Destination IP: MachineBPublic  
Destination Port: PortN  

Now, when Machine B replies, the reply typically looks like this:

       Source IP: MachineBPublic  
     Source Port: PortN  
  Destination IP: NATPublic  
Destination Port: PortC  

Then, after it goes through the inbound NAT translation process:

       Source IP: MachineBPublic  
     Source Port: PortN  
  Destination IP: MachineAPrivate  
Destination Port: PortA  

So, IF Machine A sends the frame from the same source port as the destination port ("Port N"), and IF the NAT is able to preserve that source port (i.e. it's configured to preserve source ports when possible, and that source port is not in use), THEN you can expect a reply to "Port N" to get back to Machine A.

Here's the authoritative reference on proper NAT UDP behavior:
RFC 4787 / BCP 127: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP

3

Close, but Machine B needs to look at the source address and port number that it actually receives, which might be different than N.

The NAT at Machine A might not use the same port N that Machine A sent on. (Imagine machine C behind that same NAT also sending on port N: they can't both use it.) So Machine B might see a different source port, M. But if the NAT does that, then it should accept traffic sent back to port M and automatically map it back to N at Machine B.

In other words, as long as Machine B sends back to the source address and source port given in the packet it received, that you can reasonably expect the return packet to find its way back to the original source. This assumes that the return packet is sent within a short amount of time, as automatic NAT rules tend to timeout after some number of minutes.

-1

I would not expect that.

You can have multiply IPs behind NAT, so You need to choose to which it should be forwarded. Outside of NAT only router IP is visible and internal NAT IPs are not visible.

UDP does not form connection, but its just a datagram traveling across network.

There is also difference between sending port and receiving port number.

1
  • You are correct that UDP does not "form connection" however the source and destination ports paired together does actually allow the NAT to uniquely identify which IP behind the NAT to send the packets to
    – benathon
    Oct 5, 2015 at 22:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .