NATtraversal

NAT traversal refers to methods that enable devices located behind a Network Address Translation (NAT) gateway to establish and maintain direct network connections with peers on the public Internet. NATs map private addresses to a single public address and can alter port numbers, which breaks the end-to-end connectivity that many applications require.

Key techniques include STUN, TURN, and ICE. STUN helps a client discover its public IP address and NAT type, enabling peers to attempt direct communication. TURN provides a relay server to route traffic when a direct path cannot be established. ICE coordinates the use of multiple candidate paths (local, reflexive, peer, and relayed) and performs connectivity checks to select the best route for media and data.

Hole punching is a common technique used with UDP to create a direct pathway through NATs by leveraging simultaneous binding and coordinated signaling via a server. NAT traversal also encompasses NAT-T, which encapsulates IPsec traffic to traverse NAT devices.

Routers and gateways may support automatic port mapping through UPnP or NAT-PMP/PCP, allowing devices to request opening ports dynamically. NAT types influence traversal success: full-cone NATs are the most permissive, while symmetric NATs often hinder direct connections and require relaying or more complex coordination.

Applications and limitations: NAT traversal is essential for VoIP, video conferencing, real-time gaming, and peer-to-peer file sharing. While techniques like ICE with STUN and TURN enable many connections, direct paths are not always possible, and relaying via TURN adds latency and bandwidth costs. Security and privacy considerations include exposure of public mappings, potential leakage through relays, and the need to validate peers to prevent abuse.