| 词条 | NAT traversal |
| 释义 |
Network address translator traversal is a computer networking technique of establishing and maintaining Internet protocol connections across gateways that implement network address translation (NAT). NAT traversal techniques are required for many network applications, such as peer-to-peer file sharing and Voice over IP.[1] Network address translationNAT devices allow the use of private IP addresses on private networks behind routers with a single public IP address facing the Internet. The internal network devices communicate with hosts on the external network by changing the source address of outgoing requests to that of the NAT device and relaying replies back to the originating device. This leaves the internal network ill-suited for hosting servers, as the NAT device has no automatic method of determining the internal host for which incoming packets are destined. This is not a problem for general web access and email. However, applications such as peer-to-peer file sharing, VoIP services, and video game consoles require clients to be servers as well. Incoming requests cannot be easily correlated to the proper internal host. Furthermore, many of these types of services carry IP address and port number information in the application data, potentially requiring substitution with deep packet inspection. Network address translation technologies are not standardized. As a result, the methods used for NAT traversal are often proprietary and poorly documented. Many traversal techniques require assistance from servers outside of the masqueraded network. Some methods use the server only when establishing the connection, while others are based on relaying all data through it, which increases the bandwidth requirements and latency, detrimental to real-time voice and video communications. NAT traversal techniques usually bypass enterprise security policies. Enterprise security experts prefer techniques that explicitly cooperate with NAT and firewalls, allowing NAT traversal while still enabling marshalling at the NAT to enforce enterprise security policies. IETF standards based on this security model are Realm-Specific IP (RSIP) and middlebox communications (MIDCOM). TechniquesThe following NAT traversal techniques are available:
Symmetric NATThe recent proliferation of symmetric NATs has reduced NAT traversal success rates in many practical situations, such as for mobile and public WiFi connections. Hole punching techniques, such as STUN and ICE, fail in traversing symmetric NATs without the help of a relay server, as is practiced in TURN. Techniques that traverse symmetric NATs by attempting to predict the next port to be opened by each NAT device were discovered in 2003 by Yutaka Takeda at Panasonic Communications Research Laboratory[4] and in 2008 by researchers at Waseda University.[5] Port prediction techniques are only effective with NAT devices that use known deterministic algorithms for port selection. This predictable yet non-static port allocation scheme is uncommon in large scale NATs such as those used in 4G LTE networks and therefore port prediction is largely ineffective on those mobile broadband networks. IPsecIPsec virtual private network clients use NAT traversal in order to have Encapsulating Security Payload packets traverse NAT. IPsec uses several protocols in its operation which must be enabled to traverse firewalls and network address translators:
Many routers provide explicit features, often called IPsec Passthrough. In Windows XP, NAT traversal is enabled by default, but in Windows XP with Service Pack 2 it has been disabled by default for the case when the VPN server is also behind a NAT device, because of a rare and controversial security issue.[6] IPsec NAT-T patches are also available for Windows 2000, Windows NT and Windows 98. NAT traversal and IPsec may be used to enable opportunistic encryption of traffic between systems. NAT traversal allows systems behind NATs to request and establish secure connections on demand. Hosted NAT traversalHosted NAT traversal (HNT) is a set of mechanisms, including media relaying and latching, used by intermediaries.{{citation needed|date=June 2015}} The IETF advises against using latching over the Internet and recommends ICE for security reasons.[7] IETF standards documents
See also{{Div col|colwidth=25em}}
References1. ^{{cite web|title=Firewall and NAT Traversal Explained |url=http://www.nattraversal.com/ |date=2013-07-05 |accessdate=2013-10-10 |publisher=Eyeball Networks Inc.}} 2. ^{{cite journal|title=NAT Traversal Techniques and Peer-to-Peer Applications|citeseerx = 10.1.1.103.1659 | publisher=Helsinki University of Technology}} 3. ^{{cite web|title=Introduction to NAT|url=http://www.pjsip.org/pjnath/docs/html/group__nat__intro.htm|website=PJNATH Library|accessdate=2016-05-30}} 4. ^{{cite web|title=Symmetric NAT Traversal using STUN|url=http://tools.ietf.org/id/draft-takeda-symmetric-nat-traversal-00.txt}} 5. ^{{cite web|title=A New Method for Symmetric NAT Traversial in UDP and TCP|url=https://www.goto.info.waseda.ac.jp/~wei/file/wei-apan-v10.pdf}} 6. ^{{cite web|url=http://support.microsoft.com/kb/885348/en-us|title=IPSec NAT Traversal is not recommended for Windows Server 2003 computers that are behind network address translators|publisher=Microsoft knowledge base #885348}} 7. ^Latching: Hosted NAT Traversal (HNT) for Media in Real-Time Communication draft-ietf-mmusic-latching-04 2013-10-08 External links
3 : Computer network security|Network protocols|Network address translation |
| 随便看 |
|
开放百科全书收录14589846条英语、德语、日语等多语种百科知识，基本涵盖了大多数领域的百科知识，是一部内容自由、开放的电子版国际百科全书。