STUN Date: Speaker: Hui-Hsiung Chung 1

OUTLINE Introduction NAT VoIP and NAT Demo Reference 2

INTRODUCTION STUN Simple Traversal of UDP through Network Address Translators(RFC 3489) Session Traversal Utilities for NAT(RFC 5389) UDP only A mechanism for a User Agent(UA) behind NAT(s) to get its mapped(IP, Port) on Internet Check whether UA is behind NAT(s) or not UA gets the mapped(IP, Port) from STUN Server UA Replaces the IP and Port of SIP Header 3

NAT 4 IP addr: IP addr: IP addr: IP addr: IP addr: Internet

NAT TYPES Full Cone Only IP address translation. Any external host can send a packet to the internal host. Restricted Cone An external host can send a packet to the internal host only if the internal host had previously sent a packet to the external host. 5

NAT TYPES CONT. Port Restricted Cone A Port Restricted Cone NAT is like a Restricted Cone NAT, but the restriction includes port numbers. Symmetric Each request from the same internal IP address and port to a specific destination IP address and port is mapped to a unique external source IP address and port. 6

FULL CONE 7 Mapping Table :21  (for A) :21  12345(for B) Client IP Address: Port:21 NAT Host A IP Address: Port:10110 Host B IP Address: Port:20220 IP Add: Port:12345

RESTRICTED CONE 8 Mapping Table :21  (for A) Client IP Address: Port:21 NAT Host A IP Address: Port:10110 Port:10111 Host B IP Address: Port:20220 IP Add: Port:12345

PORT RESTRICTED CONE 9 Mapping Table :21  (for A:10110) :21  12345(for A:10111) Client IP Address: Port:21 NAT Host A IP Address: Port:10110 Port:10111 IP Add: Port:12345

SYMMETRIC 10 Mapping Table :21  1357 (for A:10110) :21  2468 (for B:20220) Client IP Address: Port:21 NAT Host A IP Address: Port:10110 Host B IP Address: Port:20220 IP Add: Port:2468 IP Add: Port:1357

FLOWCHART OF CHECKING NAT TYPES 11 Source from wiki

OUTPUT OF STUN CLIENT "Open" means Open Internet "Independent Mapping, Independent Filter" means Full Cone NAT "Independent Mapping, Address Dependent Filter" means Restricted Cone NAT "Independent Mapping, Port Dependent Filter" means Port Restricted Cone NAT "Dependent Mapping" means Symmetric NAT 12

VOIP AND NAT NAT convert IP addresses in IP layer Problem 1: SIP, is a application layer protocol but contain IP address/port information in messages, which is not translated by NAT. Problem 2: Private client must send a outgoing packet first (to create a mapping on NAT) to receive incoming packet. 13

SOLUTION WITH STUN 14 SIP UA with STUN Supports IP addr: Port:3468 Binding request from :63999 STUN Server Binding reply to SIP UA. Tell him his public Address is :63999 NAT IP addr:

SOLUTION WITH STUN CONT. 15 SIP UA with STUN Supports IP addr: Port:3468 Register from :63541 SIP Server IP addr: Port:5060 Sending 200 OK to :63541 NAT IP addr:

SIP UA WITHOUT STUN SUPPORTS 16

SIP UA WITH STUN SUPPORTS 17

DEMO Experimental environment STUN Server: FreeBSD 8.2 STUN Client: Windows 7 18

REFERENCE RFC 3489, IETF, Mar RFC 5389, IETF, Oct Wiki STUN “ VoIP pass through NAT ” Yao-Nan Lien STUN Client and Server library Free STUN Servers 19