A shared secure server for multiple closed networks

This document describes the framework, messages, and procedures for the Diameter Network address and port translation Control Application. This Diameter application allows per-endpoint control of Network Address Translators and Network Address and Port Translators, which are added to networks to cope with IPv4 address space depletion. This Diameter application allows external devices to configure and manage a Network Address Translator device -- expanding the existing Diameter- based Authentication, Authorization, and Accounting (AAA) and policy control capabilities with a Network Address Translator and Network Address and Port Translator control component. These external devices can be network elements in the data plane such as a Network Access Server, or can be more centralized control plane devices such as AAA- servers. This Diameter application establishes a context to commonly identify and manage endpoints on a gateway or server and a Network Address Translator and Network Address and Port Translator device. This includes, for example, the control of the total number of Network Address Translator bindings allowed or the allocation of a specific Network Address Translator binding for a particular endpoint. In addition, it allows Network Address Translator devices to provide information relevant to accounting purposes. [STANDARDS-TRACK]

Nowadays, Network Address Translation (NAT) is widely used to allow multiple devices within a private network to make use of a less number of public IP addresses. NAT Overloading or Port Address Translation (PAT) is an extension of NAT that can translate both the IP address and the port number of a packet in order to identify which inside local address each packet belongs to. PAT is often used in a virtual environment, where multiple virtual machines are connected to the Internet by using the host machine's IP address. However, an apparent downside of PAT is the fact that when all of the ports are used, no more new outbound connection could be made from the local addresses. In this paper, we present Slow-port-exhaustion DoS Attack on a virtual network, a new type of DoS Attack that exploits some flaws of the TCP protocol. In this attack, a compromised internal virtual machine with a low amount of attack bandwidth can occupy host machine's ports for a long time and therefore makes other machines on the same virtual network could not connect to the external network. We created a virtual network with PAT implemented gateway and perform the experimental attack. In the analysis, we explore a gateway's behavior that could benefit this kind of attack. We also introduce some countermeasures against this kind of attack.

Network Address Translation (NAT) is a technique commonly employed in today's computer networks. NAT allows multiple devices to hide behind a single IP address. From a network management and security point of view, NAT may not be desirable or permitted as it allows rogue and unattended network access. In order to detect rogue NAT devices, we propose a novel passive remote source NAT detection approach based on behavior statistics derived from NetFlow. Our approach utilizes 9 distinct features that can directly be derived from NetFlow records. Furthermore, our approach does not require IP address information, but is capable of operating on anonymous identifiers. Hence, our approach is very privacy friendly. Our approach requires only a 120 seconds sample of NetFlow records to detect NAT traffic within the sample with a lower-bound accuracy of 89.35%. Furthermore, our approach is capable of operating in real-time.

Many research activities have been provided to allow Session Initiation Protocol (SIP) based communication in Peer-to-Peer (P2P). We have contributed to these activities by proposing a scalable proxy topology building and routing in P2P SIP network where SIP location service is integrated in proxies that run over peer entities. Therefore as SIP cannot work efficiently through a NAT (Network Address Translation) device without using a specific NAT traversal mechanism, our proposed architecture needs an efficient NAT traversal technique which can work easily and make end-to-end communication effective in our framework by meeting our previously defining requirements. This paper provides a suitable technique to our P2P SIP framework for SIP signaling and media flow. Our NAT traversal solution proposes an implementation of a smart SIP registrar server which stores the client end device's public contact information (IP address and port) instead of its private address and maintains this public address in the NAT device table. This approach allows the proxy node to always send the SIP signaling message to the correct address by checking the Registrar server before each transmission. To enable media flow to be exchanged between the two SIP clients, we use a media relay located in the public network. The proxy server of the originator of the signaling message is allowed to replace suitably the private addresses in the message body by the public addresses of the media relay. We provide some relevant experimental results to show that the approach is feasible.

Chapter 2 - Microsoft TCP/IP 2000

To build a network interconnect Local Area Network (LAN) that will be needed in the form of Virtual groups Local Area Network (LAN). DHCP IP address given by the router to the PC located in the network. NAT (Network Address Translation) is one method that is used as an IP translation to gain entrance into a different network. NAT (Network Address Translation) can allow a host to go into different networks without allowing the host intended to tap into their networks using VLAN With the two different networks into a single switch can be connected. Giving DHCP IP will allow the network administrator to provide the IP address to a PC for IP assigned automatically by the router. An IP host is forwarded in a network with NAT.

NAT provides a function to translate private IP addresses into a public IP address. With NAT functions, hosts with private IP addresses can be connected to the Internet, but they are hidden on the Internet. When malicious hosts behind a NAT device attack service providers on the Internet, firewalls attached on the services may detect the attack. After the attacks are detected, they may block all the traffic including the malicious hosts and other normal ones from the NAT, since all the traffic from the NAT have a same source IP address and the hosts behind the NAT cannot be identified individually by them. In this paper, we propose an effective method to identify hosts behind a NAT device by utilizing multiple fields of IP and TCP such as IPID, TTL, SYN flag, and timestamp. The proposed method can identify the number of hosts behind a NAT device, and their OSs with very high accuracy compared to existing works utilizing only one field.

Security of Computer Networks

With the increase in mobile devices there is also an increase in demand for IP mobility across networks. Although not created for that purpose, the LISP protocol offers a clean solution for mobility, via an end-to-end map/encap scheme. The solution offered by LISP allows a mobile device to keep its IP address even when changing networks. LISP’s mobility method, however, breaks when the mobile device does not have access to a publicly routable IP address, which is to be expected in today’s NAT dominated world. The LISP proposed NAT traversal solution suffers from suboptimal routing and unnecessary provider dependance. This has two major effects: increased latency, which is especially worrisome on short lived connections, and worse performance due to extended reconfiguration time during mobility events. In this paper we propose an alternative NAT traversal mechanism for LISP, by adding LISP functionality to the NAT device. The evaluations performed, by simulation and over a proof of concept prototype, show that both hindrances may be suppressed. Additionally, our experience shows that, at least for a mobile device, the LISP control plane is uselessly overburdening. Keywords: LISP – locator identifier separation protocol, LISP mobile node, Locator / identifier split, Map-Encap, Mobile IP, NAT- network address translation, NAT traversal routing.

Network address translator (NAT) is the well-known, transitional method to mitigate the problem of IPv4 address depletion in today's Internet. However, the assignment, translation, and export of address/port in a NAT at run time affect application functions. Accordingly, application servers behind the NAT cannot accept requests directly from public networks. Sensitive applications cannot hold their end-to-end security mechanisms. Applications lose connections after the NAT reboots or changes the binding address/port. However, current proposals for NAT traversal hardly solve the problems. Against the problems, we propose Smart Tunnel Union for NAT Traversal (STUNT) in the paper. STUNT permits applications behind the NAT to be actively contacted by Internet clients, keeps end-to-end security mechanisms, and avoids the risk of exporting binding information of the NAT to connection endpoints. Meanwhile, it permits applications to traverse the NAT and keeps the NAT intact

Middleboxes are an essential part of today's networks since they allow to introduce additional functionality without having to change end-hosts. Network Address Translation (NAT) has been the number one choice for coping with the address depletion problem of IPv4. Although NAT introduces many problems for existing applications it can be found in almost every consumer and mobile network.Large Scale NAT (LSN) is the latest trend in middlebox deployment and plays an important role for the transition from IPv4 to IPv6. LSN may consist of a distributed NAT at the provider or it may include multiple layers of NAT. LSN introduces additional problems for customers since many existing NAT traversal techniques cannot be applied.This paper presents an approach for discovering and measuring stateful cascaded NATs on the path between two arbitrary peers in the Internet. An algorithm combining multiple UDP packets, individual timeouts and traceroute measurements is presented and evaluated in a public field test. Finally, we show how NAT traversal for LSN can be improved by parameterizing existing algorithms according to the detected topology.

Configuring and maintaining a firewall configuration is notoriously hard. Policies are written in low-level, platform-specific languages where firewall rules are inspected and enforced along non trivial control flow paths. Further difficulties arise from Network Address Translation (NAT), since filters must be implemented with addresses translations in mind. In this work, we study the problem of decompiling a real firewall configuration into an abstract specification. This abstract version throws the low-level details away by exposing the meaning of the configuration, i.e., the allowed connections with possible address translations. The generated specification makes it easier for system administrators to check if: (i) the intended security policy is actually implemented; (ii) two configurations are equivalent; (iii) updates have the desired effect on the firewall behavior. The peculiarity of our approach is that is independent of the specific target firewall system and language. This independence is obtained through a generic intermediate language that provides the typical features of real configuration languages and that separates the specification of the rulesets, determining the destiny of packets, from the specification of the platform-dependent steps needed to elaborate packets. We present a tool that decompiles real firewall configurations from different systems into this intermediate language and uses the Z3 solver to synthesize the abstract specification that succinctly represents the firewall behavior and the NAT. Tests on real configurations show that the tool is effective: it synthesizes complex policies in a matter of minutes and, and it answers to specific queries in just a few seconds. The tool can also point out policy differences before and after configuration updates in a simple, tabular form.

Session Initiation Protocol (SIP) has been proposed for multimedia services and wide-area connectivity in smart home environments (SHEs). An important issue for SIP deployment in SHEs is network address translator (NAT) traversing. SIP and Real-time Transport Protocol (RTP) packets are delivered between an SHE (i.e., private IP network) and Internet (i.e., a public IP network) through an NAT function of a home gateway, and the NAT translates the IP/transport layer address and port number but leaves the application layer content unchanged. This results in inconsistency between the IP addresses/port numbers in the IP/transport layers and those in the SIP layer. To resolve this issue, we describe six solutions including static route, UPnP, STUN, ICE, ALG, and SBC. Then we compare these solutions in terms of smart home appliance (SHA) modification, scope of NATs supported, multilayer NAT traversal, ease of configuration, security issue, and time complexities.

We propose an expanded network address translation (NAT) that is allowed to connect from an external network to an internal specific server (telnet, Web, mail, etc.) only by using a modification of the NAT table. Thus, a connection from an external network is prohibited except that connection while only one NAT IP is required. We propose the capacity of the VPN (virtual private network) using NAT as we offer an inter-private network connection ability. The proposed expanded NAT can be used valuably in the surroundings of SOHO and applied to real environments instantly.

Chapter 13 - Skype Firewall and Network Setup