How to Use VoIP to traverse NAT and Firewall

I. NAT/ALG Mode

Normal Nat implements address translation by modifying the UDP or TCP packet header address information. However, for VoIP applications, address information must also be included in the TCP/UDP net load, ALG Mode means that the VoIP Terminal in the private network fills in the private network address in the Net Load. The address information is changed to the external address on the NAT when it passes through the nat.

Recognition of voice and video protocols (h323, sip, MGCP/h248) and control of NAT/firewall, at the same time, each new application will need to be upgraded to NAT/firewall.

There are still some trade-offs in terms of security requirements. Because ALG cannot identify the encrypted message content, it is necessary to ensure that the message is transmitted in plaintext, this poses a major security risk when packets are transmitted over the Internet.

NAT/ALG is the easiest way to support VoIP Nat penetration. However, because a large number of NAT/FW devices have been deployed on the network, in practice, it is difficult to use this method.

Ii. midcom Mode

Unlike NAT/ALG, the basic framework of midcom is to use a trusted third-party (midcom agent) to control Middlebox (NAT/FW). The identification of VoIP protocols is not completed by Middlebox, it is implemented by the external midcom agent, so the protocol used by VoIP is transparent to Middlebox.

Because the application protocol function is moved from Middlebox to the external midcom agent, based on the structure of the midcom, the basic features of the Middlebox do not need to be changed, by upgrading the midcom agent, you can support more new services, which is a great advantage of the NAT/ALG method.

In actual VoIP applications, the Middlebox function can reside in NAT/firewall, and IP voice and video protocols (h323, sip, MGCP/h248) are implemented through Softswitch devices (I .e., midcom agent) the identification and control of NAT/firewall to complete the VoIP Application traversing NAT/firewall. in terms of security, the midcom method supports control message encryption and media stream encryption, so the security is relatively high.

To identify the SIP/h323/MGCP/h248 protocol on a Softswitch device, you only need to add the midcom protocol to the softswitch and NAT/FW devices, in addition, new application business identification will be supported with the support of softswitch in the future. This solution is a promising solution, but the existing NAT/FW devices must be upgraded to support the midcom protocol, from this point of view, it is also very difficult for a large number of deployed NAT/FW devices, which have the same problems as NAT/ALG.

Iii. stun mode

Another way to solve the problem of NAT penetration is that the VoIP Terminal in the private network obtains the external address on the egress Nat through a certain mechanism, then, fill in the address information entered in the net load to the external address on the egress Nat, instead of the private IP address of the terminal in the private network, in this way, the content in the Net Load does not need to be modified when it passes through NAT. You only need to convert the IP address of the packet header according to the normal Nat process, the IP address information in the net load is consistent with the header address information. The STUN Protocol solves the address translation problem at the application layer based on this idea.

The full name of stun is simple traversal of UDP through network address translators, which is a simple NAT Traversal method of UDP. The application (Stun client) sends a request stun message to the stun server outside Nat through UDP. The stun server receives the request message, generates the response message, and carries the source port of the request message in the Response Message, that is, the external port corresponding to the stun client on the nat. Then the response message is sent to the stun client through NAT. The stun client learns the external address on the NAT through the content in the response body, and fills it in the UDP load of the Call Protocol in the future, inform the peer that the local RTP Receiving address and port number are external addresses and port numbers of Nat. The STUN Protocol has already created a NAT ing table for a media stream in advance, so the media stream can smoothly traverse the nat.

The biggest advantage of the STUN Protocol is that you do not need to make any changes to the existing NAT/FW device. In practice, a large number of NAT/FW instances exist, and these NAT/FW instances do not support VoIP applications. If you use midcom or NAT/ALG to solve this problem, it is not easy to replace the existing NAT/FW. The use of the stun method does not require the modification of NAT/FW, which is the biggest advantage. At the same time, the stun method can be used in multiple Nat connection network environments, however, the midcom method cannot effectively control multi-level NAT.

The limitations of stun are that the VoIP Terminal must support the stun client function, and stun is not suitable for TCP connection traversal. Therefore, h323. In addition, stun does not support firewall traversal, does not support symmetric NAT (Egress Nat is usually used in enterprise networks with high security requirements) traversal.

Iv. Turn Mode

Similar to stun, the turning method solves Nat problems. It is also used by VoIP terminals in the private network to obtain the service address on the public network in advance through a certain mechanism (the address obtained by stun is the external address on the egress Nat, in turn mode, the address is the public address on the Turn server), and then fill in the address information required in the packet net load. [Page]

The turn method is fully called traversal Using relay Nat, that is, the relay method is used to traverse NAT. the turn application model allocates the address and port of the turn server as the external accept address and port of the VoIP Terminal in the private network. That is, the packets sent by the terminal in the private network must be forwarded by the turn server for relay, in addition to the advantages of the stun method, this method also solves the defects that stun applications cannot penetrate symmetric NAT (NAT) and similar firewall devices. At the same time, it also supports TCP-based applications, for example, h323 protocol. In addition, the turn server controls the allocation address and port, and can allocate RTP/RTCP address pairs (the RTCP port number is the RTP Port Number plus 1) as the receiving address of the private network end user, this avoids the arbitrary allocation of the RTP/RTCP address and port number of the egress Nat in stun mode, so that the client cannot receive the RTCP packet sent from the peer (when the peer sends the RTCP packet, the destination port number is sent by the RTP Port Number plus 1 by default ).

The limitation of turn is that the VoIP Terminal must support the turn client, which is the same as that of stun for network terminals. In addition, all packets must be forwarded by the turn server, which increases the packet delay and the possibility of packet loss.