Passing NAT of VPN by improving UDP based on Agent

路松峰,胡维琦

2004-01-01

Abstract:IP address and port of the packets need to be changed by NAT device.However the information ,such as ports,is encrypted in IPSec protocol,resulting in the incompatibility between NAT and IPSec.UDP encapsulation of IPsec packets was introduced,and Agent was adopted to solve this problem.

What problem does this paper attempt to address?

Solution to VPN and Authentication System

LI Jian-jun,XU Duan-qing,GUO Wei-qing

DOI: https://doi.org/10.3969/j.issn.1000-7024.2005.09.068

2005-01-01

Abstract:Combining with living examples and based on IPSEC,the realization of the VPN system was approached in many internet circumstances of remote access(such as gateway,broadband,xDSL etc.),and in view of the deficiency and the hidden troubles of the traditional static password,introduces a working mechanism was introduced which took into consideration both the tokencard two factor authentication and Windows AD,and proveds to be flexible and liable for the single-sign on clients.
Incompatible Issues Between IPSec and NAT

邢飞,伍卫国,刘轶,钱德沛

DOI: https://doi.org/10.3969/j.issn.1000-3428.2003.19.037

2003-01-01

Abstract:IPSec has become a main tunneling technology in creating virtual private networks (VPN). However, it is shown that widespread network address translation (NAT) devices are becoming major barriers to the deployment of IPSec-based VPNs. In this paper, the incompatibility between IPSee and NAT/NAPT is clarified in detail, then two plausible solutions, RSFP and UDP encapsulation are introduced. After comparing these two proposals, a conclusion is drawn that the latter proposal will be a feasible and promising candidate to resolve the problem between IPSec and NAT.
NAT and IPSec Protocol Compatibility Problem and Solution

祝芝梅,李之棠

2004-01-01

Abstract:This article introduces the basic theory of IPSec and network address transform (NAT) protocol at first,then introduces the conflict between IPSec and NAT protocol;at last, explains the way to solve this conflict IPSec NAT-traversal by UDP encapsulation.
A Distributed Object-Based IPSec Multi-Tunnels Concurrent Architecture

Song Wang,Hongbing Lv

DOI: https://doi.org/10.1109/iccps.2011.6089933

2011-01-01

Abstract:In the existing IPSec architecture, in which tunnel is built in kernel, the number of concurrent tunnels is restricted by IP address configured on the machine and user can not control the process of establishing tunnel. This brings inconvenience when we use personal computer to measure the performance parameters of VPN Gateway (e.g. the maximum number of concurrent tunnels and the maximum rate of the new tunnels built). In order to solve this problem, this paper presents a novel IPSec multi-tunnels concurrent architecture which uses distributed objects to build tunnels in user space. The architecture privodes one Console which are used to control all AgentNodes and multiple AgentNodes which are used to build tunnels. In AgentNode, the negotiation processing of tunnels, the IPSec processing of packets and the protocol processing of TCP/IP are all completed in user space by objects. Meanwhile, AgentNode uses virtual IP address instead of local IP address to negotiate tunnel and the number of concurrent tunnels will be unlimited (only limited by memory). Moreover, based on distributed architecture, the number of AgentNode can be arbitrarily extended. Therefore, the system has a great deal of flexibility on the number of concurrent tunnels and the rate of tunnel establishment, which helps to accurately measure the performance parameters of VPN Gateway.
Improved User Datagram Porotocal Encapsulation Solution

邢飞,伍卫国,刘轶,钱德沛

DOI: https://doi.org/10.3321/j.issn:0253-987X.2003.10.011

2003-01-01

Abstract:An improved scheme of UDP encapsulation is proposed, in which the whole IP package protected by IP security protocol (IPSec) is encapsulated by adding a UDP/IP header. The scheme can solve problems such as AH authentication failure and TCP invalidation resulted from the UDP encapsulation scheme presented by IETF. And the UDP encapsulation scheme is proposed to solve the problem of the incompatibility between network address translation (NAT) and virtual private network (VPN) based on IP-Sec. The performance detail of the scheme proposed is formulated, and it is easier to be implemented comparing with the original method. The influence of the proposed scheme of UDP encapsulation on the network performance and security in the operation process are discussed.
A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Yan Shen,Qi-fei Zhang,Ling-di Ping,Yan-Fei Wang,Wen-juan Li

DOI: https://doi.org/10.1109/trustcom.2012.41

2012-01-01

Abstract:In the existing large-scale performance test of IPsec tunnel, it often needs special software and hardware. To solve the problem, this article proposed a new method, in which packet was encapsulated in user space, and a multi-tunnel controller was designed and implemented with the method of FSM(finite state machine), which controlled the negotiation and establishment of multiple tunnel, including L2tp, IKEv1, IKEv2, IKEv2+EAP and L2tp Over IPsec. Libpcap was used as the bottom layer driver of package, and the application of zero copy technique had reduced system cost immensely. At last, the result of the experiment verified the performance of the IKEv1 tunnel on Tunnel-mode and Transport-mode.
Fastpath-based VPN Gateway over Network Processor

Bo Ji,Jinfang Zhou,Junda Zhu,Liping Qian

DOI: https://doi.org/10.1049/cp:20061251

2006-01-01

Abstract:Networks, along with the explosive growth of the Internet, developed quickly and make our lives more convenient and efficient. However, at the same time, people will face much more network security problems such as illegal observation, modification, IP Spoofing, etc. This article proposes a novel type of universal software architecture named Fastpath which is purposely designed and optimized for Network Element (NE) in the Next Generation Networks (NGN), under Linux. Furthermore, it illustrates the experience in developing IPSec-based VPN gateway over IXP425, and offloading IPSec processing to NPEs and coprocessors by using APIs of software AccessLibrary through Open Crypto Framework (OCF). Finally, we investigate the performance issues both internally and externally. Through the benchmarks, we analyze the performance of the system and identify that Fastpath and network processor together can construct a universal and high-functional platform for NE which focuses on network processing.
VPN Test System Based on IPSec Network Protocol

陆敏锋,平玲娣,李卓

DOI: https://doi.org/10.3969/j.issn.1000-3428.2010.03.051

2010-01-01

Abstract:Aiming at the problem that the IPSec-based VPN product, this paper designs and achieves a IPSec-based VPN test system running on the Linux platform. This paper introduces the IPSec protocol and its architecture, and presents the design and achievement of the test system through analyzing the principle of the IPSec protocol. Experiment result shows that this test system is feasible and effective.
Interworking between IP security and NAT-PT under IPv4/IPv6 co-existent environments

y e runguo,y u shuyao,HongWei Yang,Chuck Song

DOI: https://doi.org/10.1117/12.575599

2005-01-01

Abstract:Similar to conventional NAT gateways, NAT-PT gateways break traditional TCP/IP's end-to-end argument property; hence, any IP-based applications protected by IPSec protocol cannot traverse NAT-PT gateways properly. The interworking issues between IPSec and NAT-PT gateways under IPv4/IPv6 co-existent environments were studied: This paper first pointed out the deficiency of current NAT-Traversal scheme when interworking with NAT-PT gateways and proposed an enhanced scheme, which enabled interworking between IPSec and NAT-PT gateways and served the following three scenarios: 1) secure communication between IPv6 hosts and IPv4 hosts; 2) secure communication between IPv6 subnets and IPv4 subnets; 3) secure communication between remote IPv6 hosts and legacy IPv4 subnets.
Research on Key Technology of VPN Centralized Management Based on SNMP

黄勇,陈小平,潘雪增,陈红洲,蒋晓宁

DOI: https://doi.org/10.16208/j.issn1000-7024.2008.09.057

2008-01-01

Abstract:Under the WAN environment,large-scale VPN networks is effectively and safely managed by long-distance centralized mana-gement system based on SNMP.To solve the flaw of topology discovery,a method in which agent initiates registry to the server is pro-posed.After analysis of the SNMPv3 security features,the public key authentication mechanism is introduced and the procedure of key negotiation is discussed in detail.For poor reliability and real-time data transmission of UDP-based SNMP,a strategy of configuration based on XML is given,which is proved to be feasible and efficient by the result of experiment at last.
Model Design of VPN Management System Based on Multi-Agent

Haichun Gao

2004-01-01

Abstract:The constant development of VPN service brings a lot of challenge toVPN management,this paper presents one kind of computer techniques-multi-agent technique to manage VPN. The technique possesses features of intelligence,cooperation,flexibility and expansion etc. It can solve problems of different network architectures and different network service providers. Both client and service provider will win together. This multi-agent based computer technique is very important for solving these problems.
Implementation the Traversing of NAT in SIP-based VoIP System

Chuangxin Guo

2006-01-01

Abstract:SIP is a text-based application-layer protocol. It can't be used in NAT or firewall environment. According to the specialties of entities of SIP messages, an application layer solution without expanding SIP, by achieving the mapped relation of IP address and Ports with STUN and overwriting the SIP messages and SDP messages to assure the communication connection are presented. In this way the system can implement the traversing of the NAT.
Principle and Application of Network Address Translation Systems

包亮,潘金贵

DOI: https://doi.org/10.3969/j.issn.1002-137X.2001.07.010

2001-01-01

Computer Science

Abstract:Since Network Address Translation (NAT)systems, which will translate address between two address realms,were first introduced to solve the address shortage problem,they have been adopted in many domains. In this paper, basic principles, primary forms and application will be discussed. And some countermeasure on the co-exist with IPSec will be given.
Quick NAT: High performance NAT system on commodity platforms

Junfeng Li,Dan Li,Yukai Huang,Yang Cheng,Ruilin Ling

DOI: https://doi.org/10.1109/LANMAN.2017.7972137

2017-01-01

Abstract:NAT gateway is an important network system in today's IPv4 network when translating a private IPv4 address to a public address. However, traditional NAT system based on Linux Netfilter cannot achieve high network throughput to meet modern requirements such as data centers. To address this challenge, we improve the network performance of NAT system by three ways. First, we leverage DPDK to enable polling and zero-copy delivery, so as to reduce the cost of interrupt and packet copies. Second, we enable multiple CPU cores to process in parallel and use lock-free hash table to minimize the contention between CPU cores. Third, we use hash search instead of sequential search when looking up the NAT rule table. Evaluation shows that our Quick NAT system significantly improves the performance of NAT on commodity platforms.
Study and Analysis on TCP Traversal through NAT

MA Yi-tao,XUE Zhi,WANG Yi-jun

DOI: https://doi.org/10.3969/j.issn.1009-8054.2008.04.024

2008-01-01

Abstract:The principles of both Network Address Translation(NAT) and NAT Traversal techniques based on TCP protocol are described in this paper. The paper focuses on a simple but robust NAT Traversal technique, which is known as "TCP Hole Punching". In addition, this paper analyzes some defects of the currently used "TCP Hole Punching", i.e. NATBalster[4], and provides some improved methods toward them. The success rate is increased by 5 percent.
Solution of NAT Traversal in SIP Integrated UDP Hole Punching and Http Proxy

Mingfei Zhou

2014-01-01

Abstract:Soft switch is the core technology of next generation network. SIP protocol as one of the most important protocols in the next generation network,has been widely used in VoIP systems. SIP protocol can't support SIP signaling and media stream through NAT,which limits its application and development in the WAN. Although there are many NAT traversal solutions,every solution has limitations. In this paper,explain the impact of NAT on the SIP communication in detail,introduce the basic principle of UDP hole punching technology,the process of using UDP hole punching through the cone NAT and using the Http proxy gateway through various NAT.Compared the advantages and disadvantages of various NAT traversal solutions,present a NAT traversal solution which integrates UDP hole punching and Http proxy gateway technology. After the argument and experiment,it proves the scheme is feasibile.
An Improved IPSec Protocol Scheme for the Problem of ICMP Packet Processing

胡少凤,李之棠

DOI: https://doi.org/10.3969/j.issn.1007-130x.2004.02.004

2004-01-01

Abstract:When IPSec is used in the tunneling mode, an additional external tunnel IP header to the initial IP packet is adjoined, in which the source and destination addresses are pointed to the original and final nodes that implement IPSec protocols respectively. This causes the router in packet transferring cannot forward correctly the ICMP error packets generated by its encapsulated IP data packets on the Internet. This is a hard nut to crack and there is now no mature and feasible scheme. The improved IPSec protocol scheme for this problem can give a satisfactory resolution without decreasing the efficiency of the current IPSec.
Research and Implementation for H.323 NAT Traversal

Tang Kun

2006-01-01

Abstract:Provides a basic understanding of the challenges when H.323 protocol transparently across NATs.Several different solutions are analyzed and compared,we provide a relatively safe and effective solution.A detail implementation is given based on OpenH.323 and GNUGK.
NAT traversal relay Server Relay Server and STUN Server AT Device

US A,Jinlin Wang,Yifeng Lu,Auxiliary-Relay Peer,Inner Peer

2017-01-01

Abstract:The present invention relates to a method based on the com bination of UPnP and STUN for NAT traversal. The method of the present invention effectively takes the advantages of UPnP and STUN. In particularly, when UpnP fails to traverse NAT, STUN is applied to perform the NAT traversal for the second time, so that the efficiency of the successful traversal is effectively improved. For the symmetric NAT traversal, a Port-Adding Sample Estimation method based on NAT add ing port mapping is provided for port estimation, to avoid the defects resulted from the third-party agent and the blindness of the speculation approach. And, where both of the commu nication peers in the P2P streaming media system are behind NAT, the method that the part of the ordinary outer peers with the sufficient bandwidth acts as the Auxiliary-Relay peers is provided to release the pressure of the relay server so that the bottle-neck of the communication is broken through.
The P2P Solution Research and Design Based on NAT Traversing Technology

Lei Yu,Tongping Shen,Sheng Hu,Fangliang Huang

DOI: https://doi.org/10.1109/IMCEC46724.2019.8984136

2019-10-01

Abstract:The technology of NAT (Network Address Translation) efficiently relieves the shortage pressure of IPv4 address, and it plays an important role in protecting network security. The technology development of P2P (Peer to Peer) changed the traditional structure of C/S and made communication parities can exchange information and resources directly and quickly. However, the existence of NAT has certain influence to the application of NAT. Based on this condition, the P2P solution that traverses NAT was put forwarded. The program is consist of P2P Server and P2P client, and the server runs on a computer that has a public network IP, and the client runs behind two different NATs, to simulate NAT traversal by Socket program for realizing P2P communication. The experiment result shows that P2P communication between two hosts locates behind NAT can be realized without interactive data passing through the central server.

Computer Science

Passing NAT of VPN by improving UDP based on Agent

Solution to VPN and Authentication System

Incompatible Issues Between IPSec and NAT

NAT and IPSec Protocol Compatibility Problem and Solution

A Distributed Object-Based IPSec Multi-Tunnels Concurrent Architecture

Improved User Datagram Porotocal Encapsulation Solution

A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Fastpath-based VPN Gateway over Network Processor

VPN Test System Based on IPSec Network Protocol

Interworking between IP security and NAT-PT under IPv4/IPv6 co-existent environments

Research on Key Technology of VPN Centralized Management Based on SNMP

Model Design of VPN Management System Based on Multi-Agent

Implementation the Traversing of NAT in SIP-based VoIP System

Principle and Application of Network Address Translation Systems

Quick NAT: High performance NAT system on commodity platforms

Study and Analysis on TCP Traversal through NAT

Solution of NAT Traversal in SIP Integrated UDP Hole Punching and Http Proxy

An Improved IPSec Protocol Scheme for the Problem of ICMP Packet Processing

Research and Implementation for H.323 NAT Traversal

NAT traversal relay Server Relay Server and STUN Server AT Device

The P2P Solution Research and Design Based on NAT Traversing Technology