mapping and filtering to work. However, this is only useful if the media flow is bidirectional and if at least one side can get through initially. Symmetric RTP effectively means ignoring address and port information in the SDP, since it will be different from the mapped addresses and ports.

10.12.2 RTCP Attribute

The normal assumption that the RTCP port is one higher than the RTP port only works through NATs that support port contiguity. For most NATs, the RTCP will not work even when RTP does work. A solution to this is to explicitly signal the RTCP port and address using the a=rtcp attribute defined in RFC 3605 [15]. If the mapped RTCP port can be discovered, using STUN, for example, then this approach can work.

10.12.3 Self-Fixing Approach

This approach uses NAT mapping information discovered using STUN, which is then put into the SDP offer or answer to fix the addresses. This works with some NAT such as endpoint independent mapping NATs, but will fail to work for address or port dependent mapping NATs.

The best solution for media NAT traversal is to use hole punching (and a protocol such as ICE) with a backup such as a media relay like TURN as described in the following sections.

10.13 Hole Punching

Hole punching is a probing approach used to discover and actually create NAT mappings and filtering rules. Hole punching will work in many situations that other approaches will fail, although it will not work in every situation—some combinations of NAT properties just will not permit direct exchange of packets between some hosts. Hole punching uses two clients and a rendezvous server. In SIP, the clients are UAs and a proxy server can be the rendezvous server.

In hole punching, two clients simultaneously probe using at least two sets of address, the private address and a discovered public address. The public address could be discovered using a STUN server or with the help of a rendezvous server. The rendezvous server has a public IP address and is reachable by both clients. The rendezvous server helps the two clients exchange address candidate lists. The clients repeatedly try both addresses until one or more work. At that point, they utilize this working address.

Figure 10.11 shows hole punching when the clients are behind different NATs. The private addresses fail since they are not behind the same NAT. The initial test of the public address fails; however, it creates a filtering rule, which

Figure 10.12 Hole punching example.

a packet to 2.73.3.2:3122. Since NAT A is endpoint independent mapping, the existing mapping is used, so this packet is forwarded to NAT B with a source address of 23.3.2.9:4219. This creates a filter rule in NAT A that allows packets to be received from 2.73.3.2:31212 to be forwarded to 23.3.2.9:4219. This packet arrives at NAT B but is dropped by NAT B since there is no filter rule allowing packets from 23.3.2.8:4219 to be received by 2.73.3.2:31212. Host B then sends a packet from 10.0.1.13:5678 to 23.3.2.9:4219. This reuses the mapping of 10.0.1.13:5678 to 2.73.3.2:31212 and creates a filter rule that allows packets from 23.3.2.9:4219 to be forwarded to 2.73.3.2:31212. The packet is forwarded to NAT A. At NAT A, there is an active mapping for 23.73.3.2:31212 and also a filter rule that allows packets to be received from 2.73.3.2:31212. As a result, the packet is forwarded to host A and the hole punching has succeeded. Note that without the failed packet sent by host A, which created this filter rule, this packet would have been blocked. Now host A can send to host B at 2.73.3.2:31212 using the two mappings and two filter rules in place. Note that hole punching also works if Host B sends a packet first, which fails, then Host A sends a packet, which then succeeds.

Figure 10.13 shows another example of hole punching. In this example, NAT A is endpoint independent mapping NAT with endpoint independent filtering, while NAT B is address and port dependent mapping with address and port dependent filtering. A packet sent from host A 192.168.0.1:1234 creates a

mapping of 23.3.2.9:4219.

Figure 10.13 Hole punching example.

A packet sent from host B 10.0.1.13:5678 creates a mapping of 2.73.3.2:31212. A packet sent from host A 192.168.0.1:1234 to 2.73.3.2:31212 creates a filtering rule in NAT A. The packet reaches NAT B but is dropped due to filtering. A packet sent from host B 10.0.1.13:5678 to 23.3.2.9:4219 creates a new mapping to 2.73.4.1:5732 and creates a new filtering rule in NAT B. The packet reaches NAT A. Since NAT A has endpoint independent filtering, the packet is forwarded and host A receives packet. Host A then sends a packet to 2.73.4.1:5732, which reaches host B due to the two mapping and filtering rules. Hole punching works in this case despite the address and port dependent mapping and filtering in NAT B since NAT A has endpoint independent filtering.

Figure 10.14 shows an example where hole punching fails. NAT A is address and port dependent mapping with address dependent filtering while NAT B is address and port dependent mapping with address dependent filtering. A packet sent from host A 192.168.0.1:1234 creates a mapping of 23.3.2.9:4219. A packet sent from host B 10.0.1.13:5678 creates a mapping of 2.73.3.2:31212. A packet sent from A 192.168.0.1:1234 to 2.73.3.2:31212 creates a new mapping of 23.3.3.2:7876 and creates a new filtering rule in NAT A. The packet reaches NAT B but is dropped due to filtering. A packet sent from host B 10.0.1.13:5678 to 23.3.2.9:4219 creates a new mapping of 2.73.4.1:5732 and creates a new filtering rule in NAT B. The packet reaches NAT A but is dropped due to filtering.

Additional packets sent will also fail due to filtering, and hole punching fails for this configuration.