Network Address Translation Router Research Articles

A Novel Solution based on NAT Traversal for High-speed Accessing the Campus Network from the Public Network

Chinese universities use the multi-outgoing exports to solve the problem of the traffic of bandwidth to the Internet for the campus network, but the world wide web servers in the campus network might still be accessed very slowly by some users outside the campus network (from the public network). We discuss and analyze the reasons for slowly accessing to the campus network form the public networks and a novel solution for high-speed accessing to the campus network for the local client in public network is put forward. We first introduce an NAT (Network Address Translation) traversal approach based on reverse TCP (Transmission Control Protocol) connection, which has the advantage of not requiring any intermediary server. We test our NAT traversal approach in real network environment and the results show that it is effective. Meanwhile, we also test the network performance between the campus network and the local public network after the NAT Router between them has been traversed by our approach and the results show that the network performance by the second export accessing to the campus network is much better than by the campus network export.

A Malicious Bot Capturing System using a Beneficial Bot and Wiki

Locating malicious bots in a large network is problematic because the internal firewalls and network ad- dress translation (NAT) routers of the network unintentionally contribute to hiding the bots' host address and malicious packets. However, eliminating firewalls and NAT routers merely for locating bots is generally not acceptable. In the present paper, we propose an easy to deploy, easy to manage network security control system for locating a malicious host behind internal secure gateways. The proposed network security control system consists of a remote security device and a command server. The remote security device is installed as a transparent link (implemented as an L2 switch), between the subnet and its gateway in order to detect a host that has been compromised by a malicious bot in a target subnet, while minimizing the impact of deployment. The security device is controlled remotely by 'polling' the command server in order to eliminate the NAT traversal problem and to be firewall friendly. Since the remote security device exists in transparent, remotely controlled, robust security gateways, we regard this device as a beneficial bot. We adopt a web server with wiki software as the command server in order to take advantage of its power of customization, ease of use, and ease of deployment of the server.

A scalable NAT‐based solution to Internet access denial by higher‐tier ISPs

ABSTRACTThe Internet is an interconnection of autonomous systems (ASes) that are mostly controlled by Internet service providers (ISPs). ASes use Border Gateway Protocol (BGP) to communicate routing information in the form of reachability paths. However, BGP does not guarantee that the advertised reachability paths will be exactly followed. As a result, traffic belonging to a specific network can be intentionally dropped as it is routed by BGP through a malicious ISP; a behavior we define as Internet access denial. The impact of Internet access denial, especially when performed by higher‐tier ISPs, is significant. In this work, network address translation (NAT) is used as a solution to overcome the Internet access denial problem by hiding the traffic identity. The proposed solution is scalable to fit large networks, by using pools of IP addresses across several NAT routers. Moreover, the proposed solution addresses the server reachability problem that is associated with NAT routers by introducing a novel approach. The performance degradation of introducing NAT is significantly small as shown by our experiments' results. Copyright © 2012 John Wiley & Sons, Ltd.

A New Scheme for a Mobile Node Seamless Mobility in Mixed Networks IPv4 and IPv6 Traversing NAT Routers

In the mobility environment, the interoperability between IPv4 and IPv6 networks is required due to the incompatibility that occurred in the headers of both IPv4 and IPv6 protocols. It is probable that a Mobile Node (MN) moves out of its home agent's domain towards a different IP domain IPv4/IPv6. This paper proposes a new scheme for mobile nodes that are connected with the home agent which is basically located behind Network Address Translation (NAT) to allow roaming of the MN throughout the IPv6 domains. MN would be able to communicate with its home agent despite its roaming throughout the IPv6 domain. Therefore, the proposed scheme is based on Teredo tunnel that allows clients behind NAT to utilize and get IPv6 services.