What is NAT traversal? The technology behind remote monitoring systems and web conferencing

Today, PCs at companies and in homes are connected to the internet and exchange all kinds of data, such as text, images, and audio. Not just PCs, but many other things, such as surveillance cameras, factory equipment, and various devices around town, are now connected to networks and managed and controlled over them.
When data is exchanged between a private network, such as a company or home network, and an outside network over the internet, NAT (network address translation) is mainly used. NAT lets individual devices on a private network (PCs, internet-connected home appliances, IP cameras, and so on) communicate with the outside without having their own identification number on the outside network (a global IP address). However, because of NAT, outside devices cannot connect directly to devices inside. NAT traversal is the technology that solves this. This article explains NAT traversal and its technologies in plain terms.

IP addresses and NAT

Each device connected to the internet has an IP address, a unique identification number. Data is sent and received by identifying each device by its IP address.

IPv4, the IP address format used for many years, manages addresses as 32-bit numerical data. The number of IP addresses expressed in 32 bits is 2 to the 32nd power, so about 4.3 billion IP addresses can be assigned. This was enough when the internet first spread, but as it spread further, IP address exhaustion became a concern. The move to IPv6, which extends the data to 128 bits, therefore began in the 2000s. IPv6 can increase the number of IP addresses to about 340 undecillion (3.4 × 10^38), which avoids IP address exhaustion.

IPv4, the IP address format used for many years, manages addresses as 32-bit numerical data. The number of IP addresses expressed in 32 bits is 2 to the 32nd power, so about 4.3 billion IP addresses can be assigned. This was enough when the internet first spread, but as it spread further, IP address exhaustion became a concern. The move to IPv6, which extends the data to 128 bits, therefore began in the 2000s. IPv6 can increase the number of IP addresses to about 340 undecillion (3.4 × 10^38), which avoids IP address exhaustion. For example, suppose a PC in a company is assigned private IP address a. This PC communicates with server B on the internet. Server B is assigned global IP address X, and the router that connects the company to the internet is assigned global IP address A. The PC sends data with the source address a and the destination address X to the router. The router remembers a, converts it to global IP address A, and sends the data to server X. The server replies to router A, and the router converts A back to a and sends the reply to the PC with address a. In this way, multiple devices on a private network can connect to the internet with a single global IP address.

Besides converting private and global IP addresses one-to-one, there is also NAPT (network address port translation), which converts port numbers as well to map one global IP address to many private IP addresses. NAPT is also widely used today.

What is NAT traversal?

NAT was designed for cases where devices on a private network connect to outside servers, such as for web browsing or accessing data servers. Outside devices do not know the private IP addresses or port numbers, so they normally cannot connect directly to devices inside. As a result, applications that connect devices to exchange data with each other cannot pass through NAT to directly link devices on separate private networks.

The algorithms designed to solve this problem are called NAT traversal.

With NAT traversal, devices that have only private IP addresses can communicate with each other over the internet.

NAT traversal technologies

There are various technologies (methods) for NAT traversal. The key points of each are briefly explained below.

STUN

With STUN (Session Traversal Utilities for NAT), a STUN server outside the NAT returns the global IP address and port number assigned by the NAT. Passing this information to the destination device enables two-way communication. It is a technology for P2P (peer-to-peer) communication between devices. It is widely used for UDP (User Datagram Protocol) communication such as IP phones and online meetings, which have increased with the spread of remote work.

TURN

With TURN (Traversal Using Relays around NAT), a TURN server outside the NAT relays the data. By going through a secure, stable TURN server, devices on separate private networks can exchange data as if they were communicating directly. It is used with NATs where STUN cannot communicate. The devices do not communicate directly but through the relay server.

ICE

ICE (Interactive Connectivity Establishment) combines STUN and TURN for NAT traversal. Combining the two enables NAT traversal for many kinds of applications.

UPnP

With UPnP (Universal Plug and Play), UPnP-compatible devices exchange information over HTTP and exchange the data needed for this in XML. This lets them communicate with each other automatically without checking each other’s IP address or device type.

B2BUA

B2BUA (back-to-back user agent) is part of SIP (Session Initiation Protocol), a communication standard. The B2BUA mediates communication between private networks. It handles security management and conversion between private and global IP addresses, enabling two-way communication.

Summary

In remote monitoring systems, remote control of industrial equipment, and voice calls such as Skype, NAT traversal is an essential technology for flexible working styles and for companies that operate across many locations. Using it usually requires specialized network knowledge, but many products, services, and tools lower that barrier of knowledge and technology. With them, you can build systems that are both highly secure and convenient. Gather useful information and make active use of it.

Supplement: NAT traversal with the remote.it cloud service

Here we introduce remote.it (Japanese), a cloud service from remot3.it, Inc. that uses NAT traversal to connect from the internet to IP addresses behind NAT. remote.it (Japanese) is designed on zero trust principles. It is a new remote access service that uses a P2P network to provide an SDP (software-defined perimeter: a technology that protects software, hardware, and information from various threats over networks). With this service, devices without specific global IP addresses can establish one-to-one communication with each other. As a result, when a PC is connected over Ethernet to control industrial equipment, the service lets you control that equipment remotely with the same application and the same protocol, without any new development. This has drawn attention. amnimo provides its IoT Router (Japanese), released in 2021, with the remote.it (Japanese) client application preinstalled, and also sells licenses for the service as an authorized reseller of remot3.it, Inc.

The remote.it service is also explained clearly on the amnimo website below.

remote.it overview (Japanese)

You can download a document explaining remote.it below.