[SAFE] an idea on nested nats with overlapping addresses

[Jonathan Rosenberg <[e-mail]>]

One of the limitations of stun control is it doesn't work when there are 
nested NAT with overlapping address space. There isn't an easy solution 
for this case, but here is one idea.

The client includes its own source IP in the Binding Request that gets 
sent to the outermost NAT. If an intervening NAT notices that this 
address matches its own outside IP address, a conflict is detected. 
Oftentimes, the nat obtained its outside IP from DHCP to the next NAT. 
So, the NAT that detected the conflict redoes DHCP to obtain a new IP 
address. If any stun-control compliant NAT does the following two things:

1. when providing DHCP responses, provide a random IP address from 
within the address pool

2. when receiving a packet from the inside, whose destination IP matches 
the netmask of the internal network, but does NOT correspond to an 
existing host, forward towards the outside

This would cause the address space to self-organize into non-overlapping 
segments. There are clearly issues with this appraoch:

1. other sessions in progress would be killed when nat bindings change 
(though maybe the nat can obtain an additional IP via DHCP rather than 
replacing its existing one)

2. might cause packets targeted for a private IP to hit a network with 
public addresses (via the second rule). If we modify the rule so that 
forwarding only occurs across interfaces with private IPs, this fixes it 
but only allows nesting where all intermediate address spaces are private.


Just a thought...

-Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                   499 Thornall St.
Cisco Fellow                                   Edison, NJ 08837
Cisco, Voice Technology Group
[e-mail]
http://www.jdrosen.net                         PHONE: [phone]
http://www.cisco.com


_______________________________________________
SAFE mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/safe