NAT/Firewall Requirements for Peer-to-Peer Media

Network Address Translators (NAT) and firewalls are well known to cause very significant problems with applications that carry IP addresses in the payload . Applications that suffer from this problem include Voice Over IP and Multimedia Over IP (e.g., SIP and H.323 ), as well as on-line gaming. Many techniques are used to attempt to make peer-to-peer media applications work across NATs and firewalls. Application Level Gateways are one such mechanism. STUN describes a UNilateral Self-Address Translation (UNSAF) mechanism. Media Relays have also been used to enable peer-to-peer media across NATs and firewalls, but it is generally seen as a solution of last resort. ICE describes a methodology for using many of these techniques and avoiding a Media Relay unless the type of NAT/firewall is such that it forces the use of such a Media Relay. This specification defines requirements for NATs and firewalls aimed at ensuring that a NAT or firewall that satisfies these requirements will avoid forcing the use of a Media Relay for supporting peer-to-peer media applications. "Peer-to-Peer (P2P) communication across middle boxes" made several recommendations regarding NAT and firewalls for Peer-to-Peer media: this specification derives a lot of its requirements from that draft. As pointed out in UNSAF, "From observations of deployed networks, it is clear that different NAT boxes implementation vary widely in terms of how they handle different traffic and addressing cases." This wide degree of variability is one part of what contributes to the overall brittleness introduced by NATs and makes it extremely difficult to predict how any given protocol will behave on a network traversing NATs. Discussions with many of the major NAT vendors have made it clear that they would prefer to deploy NATs that were deterministic and caused the least harm to applications while still meeting the requirements that caused their customers to deploy NATs in the first place. The problem the NAT vendors face is they are not sure how best to do that or how to document how their NATs behave. The situation is not as problematic for firewalls but still exists: there is no good common terminology even to describe the behavior of firewalls. The goal of this document is to define a set of common terminology for describing the behavior of NATs and firewalls, and produce a set of requirements on a specific set of behaviors for "P2P Enabled" NATs/firewalls. The requirements represent what many vendors are already doing, and it is not expected that it should be any more difficult to build a NAT that meets these requirements or that these requirements should affect performance. The authors strongly believe that if there were a common set of requirements that were simple and useful for voice, video, and games, the bulk of the NAT vendors would choose to meet those requirements. This document will simplify the analysis of protocols for deciding whether or not they work in this environment and will allow providers of services that have NAT traversal issues to make statements about where their applications will work and where they will not, as well as to specify requirements for NATs. This specification only covers Traditional NATs . Bi-directional, Twice NAT, and Multihomed NAT are outside the scope of this document. Approaches using directly signaled control off the middle boxes such as midcom, UPNP or in-path signaling are also out of scope. Media Relays are out of the scope of this document as well. This document only covers the UDP aspects of NAT/firewall traversal and does not cover TCP, ICMP, IPSEC, or other protocols.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. It is assumed that the reader is familiar with the terminology described in RFC 2663 and RFC 3022. This specification attempts to preserve the terminology used in those RFCs. This document uses the term "session" as defined in RFC 2663: "TCP/UDP sessions are uniquely identified by the tuple of (source IP address, source TCP/UDP ports, target IP address, target TCP/UDP Port)." This document uses the term "address binding" as defined in RFC 2663 and RFC 3022: "Address binding is the phase in which a local IP address is associated with an external address, or vice versa, for purpose of translation." The term NAT is used to refer to both traditional address translation and address port translation. The authors understand that there was a time when these were considered different, but terminology has changed over time, and the term NAT has subsumed port translation as part of it. RFC 3489 defines a terminology for different NAT variations. In particular, it uses the terms "Full Cone", "Restricted Cone", "Port Restricted Cone" and "Symmetric" to refer to different variations of NATs/firewalls. Unfortunately, this terminology has been the source of much confusion. This terminology does not distinguish between the NAT and the firewalling behavior of NAT/firewall devices. It was found that many devices' behaviors do not exactly fit into the described variations. For example, a device could be symmetric from a firewall point of view and Cone from a NAT point of view. Other aspects of NAT/firewall are not covered by this terminology: for example, many NATs will switch over from basic NAT (preserving ports) to NAPT (mapping ports) in order to preserve ports when possible. This specification will therefore not use the Cone/Symmetric terminology. Furthermore, many other important behaviors are not fully described by the Cone/Symmetric terminology. This specification refers to specific individual NAT/Firewall behaviors instead of using the Cone/Symmetric terminology. Note: RFC 3489 defines a "Symmetric NAT" in effectively two parts: All requests from the same internal IP address and port to a specific destination IP address and port are mapped to the same external IP address and port. If the same host sends a packet with the same source address and port but to a different destination, a different mapping is used. Furthermore, only the external host that receives a packet can send a UDP packet back to the internal host. Condition 1 is the NAT behavior and condition 2 is the firewall behavior. However, they are not necessarily dependent: we have observed NATs that will conform to condition (1) but not to (2). Using RFC 3489, this type of NAT would be detected as a "Cone NAT" since it uses condition (2). Using a different algorithm such as the one described in NATCECK which uses condition (1), it would be detected as a "Symmetric NAT". If the endpoint receiving the media has a permissive policy on accepting media, condition (2) is more appropriate, but if it has a restrictive policy, condition (1) is more appropriate.

This section describes the various NAT behaviors applicable to dynamic NAT; static NAT is outside the scope of this document.

When an internal endpoint opens an outgoing UDP session through a NAT, the NAT assigns the session an external IP address and port number so that subsequent response packets from the external endpoint can be received by the NAT, translated and forwarded to the internal endpoint. This is a binding between an internal IP address and port (IP:port) and external IP:port tuple. It establishes the translation that will be performed by the NAT for the duration of the session. For peer-to-peer applications, it is important to distinguish the behavior of the NAT when there are multiple simultaneous sessions established to different external endpoints. The key behavior to describe is the criteria for re-use of a binding for new sessions to external endpoints, after establishing a first binding between an internal X:x address and port and an external Y1:y1 tuple. Let's assume that internal IP address and port X:x is mapped to X1':x1' for this first session. The endpoint then sends from X:x to an external address Y2:y2 and gets a mapping X2':x2' on the NAT. The relationship between X1':x1' to X2':x2' for various combinations of the relationship between Y1:y1 to Y2:y2 is critical to describing the NAT behavior. This arrangement is illustrated in the following diagram:

The following address and port binding behavior are defined: The NAT re-uses the port binding for subsequent sessions initiated from the same internal IP address and port (X:x) to any external IP address and port. Specifically, X1':x1' equals X2':x2' for all values of Y2:y2. (From a RFC 3489 NAT perspective, this is a "Cone NAT" where the sub-type is really based on the firewall behavior.) The NAT re-uses the port binding for subsequent sessions initiated from the same internal IP address and port (X:x) only for sessions to the same external IP address, regardless of the external port. Specifically, X1':x1' equals X2':x2' if, and only if, Y2 equals Y1. (From an RFC 3489 NAT perspective, but not necessarily a firewall perspective, this is a "Symmetric NAT".) The NAT re-uses the port binding for subsequent sessions initiated from the same internal IP address and port (X:x) only for sessions to the same external and port. Specifically, X1':x1' equals X2':x2' if, and only if, Y2:y2 equals Y1:y1. (From an RFC 3489 NAT perspective, but not necessarily a firewall perspective, this is a "Symmetric NAT".) The three possibilities are abbreviated as NB=I, NB=AD, and NB=APD, respectively. NB stands for Nat Binding, I for independent, AD for Address Dependent, and APD for Address Port Dependent. It is important to note that these three possible choices make no difference to the security properties of the NAT. The security properties are fully determined by which packets the NAT allows in and which it does not. This is determined by the firewall behavior in the firewall portions of the NAT/FW.

Some NATs attempt to preserve the port number used internally when assigning a binding to an external IP address and port (e.g., X:x to X':x). A basic NAT, for example, will preserve the same port and will assign a different IP address from a pool of external IP addresses in case of port collision (e.g. X1:x to X1':x and X2:x to X2':x). This is only possible as long as the NAT has enough external IP addresses. If the port x is already in use on all available external IP addresses, then the NAT needs to switch from Basic NAT to a Network Address and Port Translator (NAPT) mode. (i.e., X1:x to X':x and X2:x to X':x'). This is referred-to as "port preservation". It does not guarantee that the external port x' will always be the same as the internal port x but only that the NAT will preserve the port if it is possible. A NAT that does not attempt to make the external port numbers match the internal port numbers in any case (i.e., X1:x to X':x1', X2:x to X':x2') is referred-to as "no port preservation". One of the benefits of port preservation is that tools such as network sniffers that try to identify and parse traffic based on the port number keep working. Another benefit is that it may enable P2P applications that are not capable of using UNSAF techniques. Some particularly nasty NATs use Port overloading: i.e., they always use port preservation even in case of collision (i.e., X1:x to X':x, and X2:x to X':x). These NATs rely on the source of the response from the external endpoint (Y:y, Z:z) to forward a packet to the proper internal endpoint (X1 or X2). Port overloading fails if the two internal endpoints are establishing sessions to the same external destination. This is referred-to as "Port overloaded". Most applications fail in some cases with "Port overloaded". It is clear that "Port overloaded" behavior will result in many problems. Furthermore, RTP/RTCP are typically used on UDP to transport real-time media. The convention is that RTP streams use an even port number, and the associated RTCP stream is supposed to use the following port number. Most applications should not have any problems using an odd port for an RTP stream or an even port for an RTCP stream: however, it is more prudent to respect the convention. The sequencing convention of RTCP=RTP+1, however, is a little more problematic. In theory, some protocols do allow indicating that the normal rule does not apply so that the RTCP port may be explicitly specified. Since some protocols rely on "extensions" to the baseline protocol to indicate the non-conformance to the convention, it is very likely that a NAT will result in a failure to establish the RTCP stream.

NAT UDP binding timeouts implementations vary but include the timer's value and the way the binding timer is refreshed to keep the binding alive. The binding timer is defined as the time a binding will stay active without packets traversing the NAT. There is great variation in the values used by different NATs. Some NATs keep the binding active (i.e., refresh the timer value) when a packet goes from the internal side of the NAT to the external side of the NAT, but do not take into account packets from the external side of the NAT to the internal side of the NAT. This is referred-to as having a NAT refresh direction behavior of "Outbound". Furthermore, if the binding is refreshed for all sessions on that bind by any outbound traffic, the NAT is said to have a NAT refresh method behavior of "Per binding". If the binding is refreshed only on a specific session on that particular bind by any outbound traffic, the NAT is said to have a "Per session". Other less secure NATs keep the binding active when packets go in any direction. This is referred-to as a NAT refresh direction behavior of "Bidirectional". The NAT refresh method behavior can also be "Per session" or "Per bind". Yet other NATs keep the binding active when a packet goes from the external side of the NAT to the internal side of the NAT, but do not take into account packets from the internal side of the NAT to the external side of the NAT. This is referred-to as a NAT refresh direction behavior of "Inbound". The NAT refresh method behavior can be "Per session" or "Per bind". In a single combined NAT/FW device, in theory the NAT binding timeout behavior could be independent from the firewall binding timeout behavior. In practice, it is more likely that the NAT binding timeout and the firewall binding timeout behavior will be one and the same. However, when the NAT and firewall are deployed in two different devices that are serially chained, the behaviors may be different.

This section describes various firewall behaviors.

When an internal endpoint opens an outgoing UDP session through a firewall, the firewall assigns a filtering rule for the binding between an internal IP:port (X:x) and external IP:port (Y:y) tuple. The key behavior to describe is what criteria are used by the firewall to filter packets originating from specific external endpoints. The firewall does not filter any packets. The firewall filters out only packets not destined to the internal address and port X:x, regardless of the external IP address and port source (Z:z). The firewall forwards any packets destined to X:x. In other words, sending packets from the internal side of the firewall to any external IP address is sufficient to allow any packets back to the internal endpoint.(From a RFC 3489 Firewall perspective, this is a "Full Cone Firewall"). The firewall filters out packets not destined to the internal address X:x. Additionally, the firewall will filter out packets from Y:y destined to the internal endpoint X:x if X:x has not sent packets to Y previously (independently of the port used by Y). In other words, for receiving packets from a specific external endpoint, it is necessary for the internal endpoint to send packets first to that specific external endpoint's IP address.(From a RFC 3489 Firewall perspective, this is a "Restricted Cone Firewall".) This is similar to the previous behavior, except that the external port is also relevant. The firewall filters out packets not destined to the internal address X:x. Additionally, the firewall will filter out packets from Y:y destined to the internal endpoint X:x if X:x has not sent packets to Y:y previously. In other words, for receiving packets from a specific external endpoint, it is necessary for the internal endpoint to send packets first to that external endpoint's IP address and port. (From an RFC 3489 Firewall perspective, this is both a "Port Restricted Cone Firewall" and a "Symmetric Firewall" as they have the same Firewall behavior). These are abbreviated at EF=O, EF=I, EF=AD, EF=APD respectively.

See section on NAT.

If two hosts (called X1 and X2) are behind the same NAT and exchanging traffic, the NAT may allocate an address on the outside of the NAT for X2, called X2':x2'. If X1 sends traffic to X2':x2', it goes to the NAT, which must relay the traffic from X1 to X2. This is referred to as hairpinning and is illustrated below.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>--+--- +----+ | v | | v | | v | | v | +----+ from X2':x2' to X1:x1 | v | X2':x2' | X2 |<<<<<<<<<<<<<<<<<<<<<<<<<<<<<--+--- +----+ +-----+ ]]> Hairpinning allows two endpoints on the internal side of the NAT to communicate even if they only use each other's external IP addresses and ports. More formally, A NAT/Firewall that supports hairpinning forwards packets originating from an internal address, X1:x1, destined to an external address X2':x2' that has an active binding to an internal address X2:x2, back to that internal address X2:x2. (Note that typically, X1'=X2'). Furthermore, the NAT may present the hairpinned packet with either an internal or an external source IP address and port. The Hairpinning NAT behavior can therefore be either "External source IP address and port" or "Internal source IP address and port". "Internal source IP address and port" may cause problems by confusing an implementation that is expecting an external IP address and port.

Application Level Gateways have been used to support specific protocols for Peer-to-peer media through a NAT or Firewall. However, if an ALG is "on" on a NAT, it could conflict with other techniques such as STUN or ICE.

The diagnosis is further complicated by the fact that under some conditions the same NAT exhibits different behaviors. This has been seen on NATs that preserve ports or have a specific algorithm for selecting a port other than selecting a free one. If the external port that the NAT wishes to use is already in use by another session, the NAT must select a different port. This results in different code paths for this conflict case, which results in different behavior. For example if three hosts X1, X2, and X3 all sent from the same port x, through a port preserving NAT with only one external IP address, called X1', the first one to send (i.e., X1) will get an external port of x but the next two will get x2' and x3' (where these are not equal to x). There are NATs where the External Nat Binding characteristics and the External Filter characteristics change between the X1:x and the X2:x binding. To make matters worse, there are NATs where the behavior may be the same on the X1:x and X2:x binds but changes on the third X3:x binding. Some NATs try to reuse external ports flow from two internal IP to two different external IP. For example X1:x is going to Y1:y1 and X2:x is going to Y2:y2 where Y1:y1 does not equal Y2:y2. Some NATs will map X1:x to X1':x and will also map X2:x to X1':x. This works in the case where the NAT Binding is address port dependant. However some NATs change their behavior when this type of port reuse is happening. The NAT may look like is has NAT Bindings that are Independent when this type of reuse is not happening but change to Address Port Dependent when this reuse happens. Any NAT that changes the NAT Binding or the External Filtering at any point in time or under any particular conditions is referred to as a "non-deterministic" NAT. NATs that don't are called "deterministic". Non-deterministic NATs generally change behavior when a conflict of some sort happens, when the port that would normally be used is already in use by another bind. The NAT binding and External Filtering when there is no conflict is referred to as the Primary behavior. The behavior after the first conflict is referred to as Secondary and after the second conflict is referred to as Tertiary. No NATs have been observed that change on further conflicts but additional testing may be required.

The requirements in this section are aimed at minimizing the damage caused by NATs and Firewalls on Peer-to-peer media applications (e.g., forcing the use of Media Relays, or failure to establish RTCP streams). However, it should be understood that Peer-to-peer media applications normally do not know in advance if the NAT or Firewall conforms to the recommendations defined in this section. Therefore, Peer-to-peer media applications still need to use normal procedures such as ICE or STUN to determine the course of action. REQ-1: A NAT MUST have an "External NAT Binding is endpoint independent" behavior (NB=I). REQ-2: It is RECOMMENDED that a NAT have a "Port preservation" behavior. REQ-2a: A NAT MAY use a "No port preservation" behavior. REQ-2b: A NAT MUST NOT have a "Port overloaded" behavior. REQ-3: A dynamic NAT UDP binding timer MUST NOT expire in less than 2 minutes. REQ-3a: The value of the NAT UDP binding timer MAY be configurable. REQ-3b: A default value of 5 minutes for the NAT UDP binding timer of 5 minutes is RECOMMENDED. REQ-4: The NAT UDP timeout binding MUST have a NAT refresh direction behavior of "Outbound" (i.e. based on outbound traffic only) REQ-4a: The NAT UDP timeout binding MUST have a NAT refresh method behavior of "Per binding". (i.e. refresh all sessions active on a particular bind). REQ-5: It is RECOMMENDED that a Firewall have an "External filtering is endpoint address dependent" behavior. (EF=AD) REQ-5a: A Firewall MAY have an "External filtering is endpoint independent" behavior. (EF=I) REQ-5b: A Firewall MAY have an "External filtering is endpoint address and port dependent" behavior. (EF=APD) REQ-6: The Firewall UDP timeout binding behavior MUST be the same as the NAT UDP timeout. REQ-7: A NAT/FW MUST support "Hairpinning" behavior. REQ-7a: A NAT/FW Hairpinning NAT behavior MUST be "External source IP address and port". REQ-8: A NAT MUST have the capability to turn off individually all ALGs it supports, except for DNS and IPsec. REQ-8a: Any NAT ALG for SIP MUST be turned off by default. REQ-9: In order to comply with the RTP even port and RTCP odd port rule, it is RECOMMENDED that a NAT keep the same parity (even or odd) for the external UDP port as the internal UDP port. REQ-9a: In order to comply with the RTCP=RTP+1 rule, it is RECOMMENDED that upon binding an even external port to an even internal port, the following odd external port be reserved on the same external IP address for a short period of time (5 seconds is RECOMMENDED). If a packet is received within that period of time from the same internal IP address as the one that caused the even port binding, but from the following odd port, it is RECOMMENDED that the bind be assigned the reserved external port. REQ-10: It is RECOMMENDED that a NAT/FW have a deterministic behavior. REQ-10a: If a NAT/FW is non-deterministic, all the different behaviors MUST meet the above requirements.

This section describes why each requirement was chosen, and the consequences of violating them: REQ-1: In order for UNSAF methods to work, REQ-1 needs to be met. Failure to meet REQ-1 will force the use of a Media Relay which is very often impractical. REQ-2: REQ-2 allows certain P2P applications that do not use UNSAF methods to work, under many restrictions. However. this is no guarantee that it will work, therefore it is just a recommendation REQ-2a: Since REQ-2 is no guarantee of success, REQ-2a is also acceptable. REQ-2b: REQ-2b must be met in order to enable 2 applications using the same port trying to communicate with the same destination. REQ-3: This requirement is to ensure that the timeout is long enough to avoid too frequent timer refresh packets. REQ-3a: Configuration is desirable for adapting to specific networks and troubleshooting. REQ-3b: This default is to avoid too frequent timer refresh packets. REQ-4: This requirement is a security concern: it is not secure to let inbound traffic refresh the timer as an outside party could use it to keep a port open on the NAT/Firewall. REQ-4a: Using the refresh on a per binding basis avoids the need for separate keep-alives for all the available sessions. REQ-5: Filtering based on the IP address is felt to have the maximum balance between security and usefulness. See below. REQ-5a: Filtering independently of the external IP address and port is not as secure as unauthorized packets could get at a specific port while the port is kept opened if it is lucky enough to discover that the port is opened. REQ-5b: In theory, filtering based on both the IP address and port is more secure than filtering only based on IP address (because the external endpoint could in reality be 2 endpoints behind another NAT, where one of the two endpoint is an attacker. However, such a restrictive policy could interfere with certain applications that use more than one port. REQ-6: This is to avoid overly complex applications. REQ-7: This requirement is to allow supporting P2P applications between 2 endpoints behind the same NAT/FW when they are trying each other's external IP address. REQ-7a: Using the external IP address is necessary for P2P applications who have a restrictive policy of not accepting packets from an IP address different from what it expected. This requirement is for enabling more secure P2P applications. REQ-8: NAT ALGs may interfere with UNSAF methods. REQ-8a: A SIP NAT ALG will interfere with UNSAF methods. REQ-9: Using the same parity as the convention for RTP/RTCP port may help some implementations. It may also facilitate network diagnostics. REQ-9a: This requirement is to maximize the chances that the RTCP flow will not be blocked. REQ-10: Non-deterministic NATs are very difficult to troubleshoot because they require more intensive testing. REQ-10a: This requirement is to ensure that even if it is non-deterministic, a NAT/FW doesn't break anything.

Firewalls and NATs are often deployed to achieve some security goals. Most of the recommendations and requirements in this document do not affect the security properties of these devices, but a few of them do have security implications and are discussed in this section. This work recommends that the timers for binding be refreshed only on outgoing packets and that inbound packets should not update the timers. If inbound packets update the timers, an external attacker can keep the binding alive forever and attack future devices that may end up with the same internal address. Some devices today do update the timers on inbound packets. This work recommends that the firewall filters be specific only to the external IP and not the external IP and port. It can be argued that this is less secure than using [CHECK] the IP and port. Devices that wish to filter on IP and port are still compliant with these requirements. Non-deterministic NATs and firewalls are risky from a security point of view. They are very difficult to test because they are, well, non-deterministic. Testing by a person configuring one may result in the person thinking it is behaving as desired, yet under different conditions that an attacker can create, it may behave differently. These requirements recommend that devices not be non-deterministic [CHECK THIS PARA, BE DETERMINISTIC?] . The work requires that NATs have an "external NAT binding is endpoint independent" behavior. This does not reduce the security of devices. Which packets are allowed to flow across the device is determined by the external filtering behavior, which is independent of the binding behavior.

There are no IANA considerations.

The IAB has studied the problem of "Unilateral Self Address Fixing", which is the general process by which a client attempts to determine its address in another realm on the other side of a NAT through a collaborative protocol reflection mechanism . This specification does not constitute in itself an UNSAF application. It consist of a series of requirements for NATs and firewalls aimed at minimizing the negative impact that those devices have on peer-to-peer media applications, especially when those applications are using UNSAF methods. Section 3 of UNSAF lists several practical issues with solutions to NAT problems. This document makes recommendations to reduce the uncertainty and problems introduced by these pratical issues with NATs. In addition, UNSAF lists five architectural considerations. Though this is not an UNSAF proposal, it is interesting to consider the impact of this work on these architectural considerations. Arch-1: The scope of this is limited to UDP packets in NATs like the ones widely deployed today. The "fix" helps constrain the variability of NATs for true UNSAF solutions such as STUN. Arch-2: This will exit at same rate that NATs exit. It does not imply any protocol machinery that would continue to live after NATs were gone or make it more difficult to remove them. Arch-3: This does not reduce the overall brittleness of NAT but will hopefully reduce some of the more outrageous NAT behavior and make it easer to discuss and predict NAT behavior in given situations. Arch-4: This work combined with the test results of various NATs represents the most comprehensive work at IETF on what the real issues are with NATs for applications like VoIP. This work and STUN have pointed out more than anything else the brittleness NATs introduce and the difficulty of solving these issues. Arch-5: This work and the test results provide a reference model to what any UNSAF proposal might encounter in deployed NATs.

Should we discuss requirements for dealing with fragmentation of UDP packets.

The editor would like to acknowledge Bryan Ford, Pyda Srisuresh and Dan Kegel for the NATP2P draft, from which a lot of the material in this specification is derived. Thanks to Rohan Mahy for many discussions on this.