NAT check

For the more net-techy amongst you I came across this useful little app today written by Bryan Ford:-

http://midcom-p2p.sourceforge.net/

I tried this software and it reports that I have a port restricted NAT. I'm sure that this didn't used to be the case. How could this change? I've tried X-lite and that also reports the same. Most of the VOIP providers are working without STUN settings.

John.

Quote:

Most of the VOIP providers are working without STUN settings.

Most VoIP providers will proxy traffic where NAT traversal doesn't work.

We don't here, so a good test is whether or not you can get a VoIP User account to work with STUN and no port forwarding.

Dean

Most providers will try to work out what NAT you are using, and then try to fix the headers accordingly at their end (far end NAT traversal).

There are basically two types of NAT, Symmetric and Asymmetric.

Under Asymmetric you can have

a) Port restricted
b) restricted cone
c) full cone

Full cone - Each PC behind the NAT has an external IP:port mapping.

Restricted Cone - This is the same as full cone, except that it restricted, i.e external PC's can only send packets back to the IP:port pair if they have received a packet from there first, So the NAT has to send a packet to the IP first.

Port Restricted - Same as restricted except the NAT needs to send a packet to the IP:port first (not just the IP as before).

Symmetric

This has a different NAT'ed IP:port pair for each external IP that it sends to, and will only receive on that IP:port from the destination it sent to.

So in VoIP NAT can be a headache. Why? Because during the call setup all the SIP messages go out via one port (usually 5060), and the media stream is on another (or several others), this is the main reason for voice not being heard, or voice only being heard in one direction (they hear you, you don't hear them).

STUN servers help because they can sit outside and tell everyone what to do, BUT they are only good for asymmetic NAT, NOT symmetric.

Having said all this most providers deal fine with NAT, most don't even use STUN anymore (instead they proxy the entire SIP and media "stream"), because STUN clients are not reliable, hence you can have all sorts of problems if you assume your STUN client and server are sending reliable info.

Is there a secure way to find out wich kind of the four NAT types a router runs? can aney specify the natcheck from the first post here?