Scalable NAT traversal
A system and method for traversing a firewall for a voice-over-IP session or other communication session uses four main components: a relay agent, and NAT 30 Agent, a SIP proxy and a application server. The SIP proxy is located in the public network and SIP signaling messages are routed through the SIP proxy. The sever opens ports in the firewall for signaling between the SIP proxy and the relay agent behind the firewall. The application server also opens ports in the firewall for media traffic. The NAT 30 Agent disposed in the path from the firewall to the Internet filters media packets and changes the public source address of the media packets to a predetermined address associated with the open media port.
1. A method of opening a port in a firewall, the method comprising:
intercepting a firewall punching packet transmitted over a firewall port to a target address in a public network, the firewall punching packet including a public source address indicating the firewall port over which the packet was transmitted;
sending, in response to the firewall punching packet, a reply message to the public source address specified in the firewall punching packet, the reply message comprising a payload that contains the public source address of the firewall punching packet;
if the target address of the firewall punching packet contains a predetermined port number, creating an entry in a mapping table associating a target IP address of the firewall punching packet with the public source address of the firewall punching packet;
intercepting a packet sent to the firewall;
if the source IP address and destination address of the intercepted packet matches an entry in the mapping table, modifying the source address of the intercepted packet to match the target address of the firewall punching packet; and
forwarding the modified packet to the firewall.
2. A device for opening a port in a firewall, the device comprising:
a network interface for connecting said device with a private network protected by said firewall; and
a processor connected to said network interface and configured to:
intercept a firewall punching packet transmitted over a firewall port to a target address in a public network, the firewall punching packet including a public source address indicating the firewall port over which the packet was transmitted;
send, in response to the firewall punching packet, a reply message to the public source address specified in the firewall punching packet, the reply message comprising a payload that contains the public source address of the firewall punching packet;
if the target address of the firewall punching packet contains a predetermined port number, create an entry in a mapping table associating a target IP address of the firewall punching packet with the public source address of the firewall punching packet;
intercept a packet sent to the firewall;
if the source IP address and destination address of the intercepted packet matches an entry in the mapping table, modify the source address of the intercepted packet to match the target address of the firewall punching packet; and
forward the modified packet to the firewall.