8

Everyone knows the router is working like a firewall. Without port forwarding, a connection (no matter TCP or UDP) cannot be initiated from outside of the router. However, if a user initiate a TCP connection successfully from internal of the router, both sides of the router can then communicate with each other.

What happens to the UDP? If a user behind the router (he does nothing at all about port forwarding) sends a UDP to an external pc (assuming without any firewall or anything stopping receiving datagram in that pc), and the pc receives it. What if the PC wants to send some data back to the user who is behind the router? Can the data be received by the user? or can the data go through the router without any special operation?

I ask this because everyone knows UDP is connectionless. However, I believe some online shooting games use UDP. If I join a server to play, i will not need to do anything about port forwarding, but the udp data transfer between me and the server can still work.

Can anything explain some to me?

Thanks a lot.

Jack

Improve this question
2
  • Routing questions are probably better off on ServerFault.
    – Dav
    Feb 24, 2010 at 10:47
  • However, it gives an opportunity to link (again) to a bunch of NAT traversal documents, and correct a misconception. That definitely belongs here.
    – Andrew McGregor
    Feb 24, 2010 at 10:53

2 Answers 2

Reset to default
6

A stateful firewall can track UDP. It just creates an established connection for UDP once it has seen a packet coming from a masqueraded internal machine to an IP address on the internet. Any responding traffic is automatically forwarded to the internal machine.

Improve this answer
0

If 'everyone knows' that, they're still wrong.

A domestic NAT/router ends up blocking incoming connections by accident. This is not a feature, it's a fluke. And therefore you can't rely on the behaviour of it very much. It is of basically no security benefit, for example.

The IETF has an entire working group defining what these devices should do in order to make the least mess: BEHAVE

I refer to that page because there are too many documents to link individually.

There are a whole lot of ways of getting data through NAT devices, some listed on the behave pages, there are also STUN, UPnP, NAT-PMP, and Teredo

To answer you original question, it totally depends. Sometimes an outgoing packet will open a pinhole for the response, sometimes certain ports have proxies, and sometimes some traversal solution will be required. And sometimes it just completely doesn't work.

Improve this answer
3
  • I've used a shedload of modems and unix firewalls since 1996 -- other than some hassle with ipchains I've never encountered any firewall/router combo that didn't masquarade udp traffic properly.
    – Hassan Syed
    Feb 24, 2010 at 10:54
  • Actually, while a pure NAT device blocks incoming connections by accident (having no-where to send them), many NAT home routers now explicitly claim to be firewalls.
    – Douglas Leeder
    Feb 24, 2010 at 11:04
  • Many devices do claim to be firewalls... and that's true too, but it's distinct from the NAT. And yes, often it just works... but deploying an application on that assumption is a bad idea.
    – Andrew McGregor
    Feb 24, 2010 at 11:49

You must log in to answer this question.