Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to simulate different NAT behaviours

Tags:

I am working on Holepunching using UDP and UDT. For the final testing I need to test the application on different NAT types (Symmetric,full cone,restricted cone, port restricted NATs).

Is there any method I can simulate these? What I expect here is some kind of virtual-Box setup. Can I use PC as a router so that I can configure according to my needs?

In general how do we test applications for different network conditions?

like image 887
user739711 Avatar asked Jul 30 '12 10:07

user739711


People also ask

What does it mean when your NAT type is symmetric?

Symmetric NAT This means that two consecutive transmissions from the same local port to two different remote hosts will have two different external source ports, even if the internal source transport address is the same for both of them.

What is cone NAT?

A full cone NAT (also known as a one to one NAT) is the only type of NAT where the port is permanently open and allows inbound connections from any external host. A full cone NAT maps a public IP address and port to a LAN IP and port. Any external host can send data to the LAN IP through the mapped NAT IP and port.

How do I overcome NAT?

If you've been assigned a private IP address, you'll need to contact your ISP to request a public IP address to eliminate a NAT issue on your console. If your ISP can't give you a public IP address, you'll have to change ISPs to resolve the NAT issue.

What is NAT traversal in Webrtc?

Traversal Using Relays around NAT (TURN) is meant to bypass the Symmetric NAT restriction by opening a connection with a TURN server and relaying all information through that server. You would create a connection with a TURN server and tell all peers to send packets to the server which will then be forwarded to you.


1 Answers

Just in case someone else is looking to do this, this website explains how to set up the different NAT environments using IPTables.

Update

It has been a few years since I did this, given that the link was placed behind a login, and the rewind was also placed behind a login, I went through my notes from back than and found the following. Please note these are untested.

Full Cone NAT;

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source "public IP"
iptables -t nat -A PREROUTING -i eth1 -j DNAT --to-destination "private IP"

Restricted Cone NAT;

iptables -t nat -A POSTROUTING -o eth1 -p udp -j SNAT --to-source "public IP"
iptables -t nat -A PREROUTING -i eth1 -p udp -j DNAT --to-destination "private IP"
iptables -A INPUT -i eth1 -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -p udp -m state --state NEW -j DROP

Port Restricted Cone NAT;

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source "public IP"

Symmetric NAT;

echo "1" >/proc/sys/net/ipv4/ip_forward
iptables --flush
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE --random
iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
like image 76
Oliver Ciappara Avatar answered Oct 07 '22 21:10

Oliver Ciappara