Beware: NAT Traversal is a Simple and Efficient Approach to Open Firewall Holes

João G.G. Borges,Micael O.M.C. de Mello,Elias P. Duarte Jr.,Kleber V. Cardoso

doi:10.5752/p.2316-9451.2020v8n2p29-41

Abstract

NAT traversal techniques allow processes with private, non-routable IP addresses to communicate with other processes outside the network secured limits. Techniques such as UDP Hole Punching have been standardized by the IETF, and using tunnels based on those techniques it is easy to allow application processes on top of any transport protocol, including TCP, to both start and receive packets from the Internet across NAT devices. However, as a side effect those techniques also freely proceed through firewalls. In this work we describe how it is possible to configure any server running on any port (no firewall configuration required) to establish connections initiated at arbitrary Internet clients, making unauthorized services easily available. We also show that the process is lightweight, in particular after the initial setup is concluded, thus virtually supporting any type of unauthorized applications.

Highlights

Transparency and end-to-end connectivity are two of the basic design principles of the original Internet (GARRETT et al, 2018; SALTZER et al, 1984)
We describe a simple NAT traversal approach to allow application processes using any transport protocol to communicate seamlessly accross NAT devices and firewalls using IP-overUDP tunnels
We first evaluate the overhead of using NAT traversal on the communication

Summary

Introduction

Transparency and end-to-end connectivity are two of the basic design principles of the original Internet (GARRETT et al, 2018; SALTZER et al, 1984). In this work we discuss the fact that, as a side effect, the communication with NAT traversal techniques causes security breaches by freely opening holes on firewalls. By using NAT traversal any internal host can independently open holes on any port without any firewall configuration to provide unauthorized services that can be accessed from the rest of the Internet.

Results

Conclusion