Full cone/Port Restricted/Restricted NAT

N2Z2 — Thu, 21 Apr 2022 15:05:06 GMT

Hi all,

I need to make work a voip server behind my pa-3020. The server is using stun protocol and requires that nat is not symmetric.

I've tested a public stun server (for example stun.telbo.com on port 3478) using pystun3 (a python tool to retrieve nat type).

That's what I got (A.B.C.D is my public ip)

~# pystun3 -H stun.telbo.com -d
DEBUG:pystun3:Do Test1
DEBUG:pystun3:sendto: ('stun.telbo.com', 3478)
DEBUG:pystun3:recvfrom: ('77.72.169.210', 3478)
DEBUG:pystun3:Result: {'Resp': True, 'ExternalIP': 'A.B.C.D', 'ExternalPort': 45548, 'SourceIP': '77.72.169.210', 'SourcePort': 3478, 'ChangedIP': '77.72.169.211', 'ChangedPort': 3479}
DEBUG:pystun3:Do Test2
DEBUG:pystun3:sendto: ('stun.telbo.com', 3478)
DEBUG:pystun3:sendto: ('stun.telbo.com', 3478)
DEBUG:pystun3:sendto: ('stun.telbo.com', 3478)
DEBUG:pystun3:sendto: ('stun.telbo.com', 3478)
DEBUG:pystun3:Result: {'Resp': False, 'ExternalIP': None, 'ExternalPort': None, 'SourceIP': None, 'SourcePort': None, 'ChangedIP': None, 'ChangedPort': None}
DEBUG:pystun3:Do Test1
DEBUG:pystun3:sendto: ('77.72.169.211', 3479)
DEBUG:pystun3:recvfrom: ('77.72.169.211', 3479)
DEBUG:pystun3:Result: {'Resp': True, 'ExternalIP': 'A.B.C.D', 'ExternalPort': 11317, 'SourceIP': '77.72.169.211', 'SourcePort': 3479, 'ChangedIP': '77.72.169.210', 'ChangedPort': 3478}
NAT Type: Symmetric NAT
External IP: A.B.C.D
External Port: 11317

What we can see is that

- my internal server try to call stun.telbo.com on port 3478

- 77.72.169.210 replies with the alternate ip address and alternate port (as stun works for retrieving nat type), 77.72.169.211 port 3479

- pan drops the connection because it come back from a different ip and port (that's symmetric nat)

How could I configure pan to make nat port restricted (at least for my private ip and for a couple of address of my stun server provider)?

Thanks

Re: Full cone/Port Restricted/Restricted NAT

reaper — Fri, 22 Apr 2022 12:38:41 GMT

is the application being identified properly as stun?

have you tried disabling ALG on the app-id ?

Re: Full cone/Port Restricted/Restricted NAT

N2Z2 — Fri, 22 Apr 2022 12:56:32 GMT

The application is identified as stun. In addition, I've done an application override to customize udp timeout but with no results

I've disabled alg in sip but there's no sip traffic, just stun

Thanks

Re: Full cone/Port Restricted/Restricted NAT

N2Z2 — Fri, 22 Apr 2022 14:24:25 GMT

There was a session that needs to be cleared before retrying, now it's working.

Thanks

topic Full cone/Port Restricted/Restricted NAT in General Topics

Full cone/Port Restricted/Restricted NAT

Re: Full cone/Port Restricted/Restricted NAT

Re: Full cone/Port Restricted/Restricted NAT

Re: Full cone/Port Restricted/Restricted NAT