NAT – Managing Simultaneous TCP Connections in NAT

dnatnat;routingtcp

I am trying to understand how the NAT behaves when two peers behind two NATs with two different public ip Addresses try to establish a TCP connection using simultaneous open. I did some research and found that both peers will get their public mapping through an ICE server and then will exchange their mappings through a rendezvous server before trying to establish the simultaneous TCP open.

What I am trying to understand how is the Peer guaranteed to get the same port Mapping as the one it shared with the other peer?

For Example:

enter image description here

In the diagram host A asks the rendezvous server for the Nat Mapping of Host B gets it and Host B does the same thing. Afterward they try to do a simultaneous TCP open (Assuming they are behind a Full cone Map). The Steps for the simultaneous Mapping
1) Host A sends a SYN packet to IP Y port 100
2) At the same time B will send a SYN packet to IP X port 55

My question is: How is host A guaranteed to get the same External Port mapping, i.e: Port 55 that it shared with Host B through the rendezvous server and How is Host B guaranteed to get the same External Port mapping, i.e: Port 100. In other words, will the NAT always assign the same port mapping to the same (IP, port) unique tuple ?

Assuming of course the NAT supports simultaneous TCP opens and I am talking about dynamic NATs, not NATs with static mappings.

EDIT:

I need to clarify that I am only interested in the behavior of the NAT when this type of simultaneous TCP opens occurs. How would the the "NAT" make it is best effort to make sure that the HOST behind it gets the same mapping it is expecting to get.

Additional Note:
The TCP simultaneous open is described in RFC 5382 https://tools.ietf.org/rfc/rfc5382.txt

Best Answer

Your rendezvous server requires some kind of coordination protocol (ICE?) - this could use a token, user name, or something similar to connect both sockets coming from different directions into a virtual session. Their originating port doesn't matter.

However, this is no function of NAT and higher level protocols are off-topic here.

Related Topic