UDP NAT Punching

Question

I have the following two problems. Please help me to solve them:

1. In symmetric NAT, as I know, the local hidden node (behind the NAT) must initiate connection in order to create a window in the NAT to allow the packets of the remote host back into the local network. Can somebody give me some idea how i can do this?

2. How can an application learn that there are NATs in the path between the source and the destination?

Answer 1

I can give you a place to start for (2): Michal Zalewski's p0f passive monitoring tool. It seems to support some way of guessing that the source of a TCP "SYN" is behind a NAT.

Answer 2

Since UDP is connection-less, NAT implementation cannot know where UDP communication actually ends, so it just creates translation table entry on first passed packet. For example, hidden host with IP 10.0.0.2 send packet to host 2.2.2.2 via NAT router with address 1.1.1.1, source port is 10000, destination - 20000. On packet arrival NAT creates entry such as this:

10.0.0.2 10000 - 1.1.1.1 10000 - 2.2.2.2 20000

Port number in second field may be different if it is already used by other translation entry. After this entry created, all UDP packets from 2.2.2.2:20000 to 1.1.1.1:10000 will be redirected to 10.0.0.2:10000.

On second question: if there is a NAT between source and destination, remote addresses reported by getpeername(2) and reported directly by remote end (in UDP payload) will be different.

There are more info and links about NAT hole punching on wikipedia.