Re: TFTP, NAT

From: Aditya Ivaturi (aivaturi_at_aijalon.net)
Date: 10/13/04 

Date: Wed, 13 Oct 2004 19:27:37 GMT

> Is it possible to get TFTPd working through NAT?
> If yes, how to do this?

With NAT yes, but behind a firewall, you have to have a very good reason.

> In other words, he claims that a NAT entry for UDP *by design* can only
> accomodate return packets from the specific IP/port combination that
> was the destination of the UDP packet that caused the entry to be created.
> This clearly breaks TFTP, which specifies that responses from the server
> come from a separate socket with a unique TID (port) for the ``session''.

Your sysadmin is right. Sysadmins generally are not too happy (includes me)
to
allow a connectionless protocol which uses UDP like TFTP. A TCP based
protocol such as FTP going
through a firewall is much more agreeable. Just allowing udp port 69 does
not work, the destination port will
change after the first packet are sent.

> Is this truly how NAT is intended to work with UDP? Or is our Cisco
> router just mis-configured in some subtle way?

One solution might be to try "secure tunneling" (I have not tried it). I
don't know how much of it is supported in your router.

--Turi

Relevant Pages

  • Re: NAT is not a mechanism for securing a network.. but.. HELP!
    ... For years I have heard people claim that NAT could be circumvented ... > packet is routed. ... but the only outside network I have access to right now ... > Firewall is a term, most people use other than it was intended. ...
    (comp.security.firewalls)
  • Re: NAT vs. True Firewalls
    ... not just mean packet filter. ... A firewall can be made up of one or more ... components that can block or filter protocol traffic between two networks. ... So a NAT can be as much part of a firewall implementation as the ...
    (comp.security.firewalls)
  • Re: NAT vs. True Firewalls
    ... > not just mean packet filter. ... A firewall can be made up of one or more ... > components that can block or filter protocol traffic between two networks. ... So a NAT can be as much part of a firewall implementation as ...
    (comp.security.firewalls)
  • [fw-wiz] Checkpoint and RTSP NAT
    ... The clients are behind a Checkpoint NGX firewall doing NAT. ... Capturing packets i saw that the NAT in the Checkpoint box is the problem. ... packet from server when de-NATing the packet: ... Did anyone knows if Checkpoint NGX can be awareness of RTSP when using NAT, ...
    (Firewall-Wizards)
  • Re: An application gateway firewall based on Linux - ITShield firewall
    ... Most of them also include stateful and non stateful packet ... traverse a packet filtering firewall undetected. ... UDP is certainly "connectionless" however many types of UDP traffic that ... even though there is no "connection". ...
    (comp.security.firewalls)