Implications for Symmetric NAT / Relay

turtle · #1 (**permalink**) July 27th, 2006, 12:53 PM

My isp seems to have me behind a firewall and I end up sharing an IP with the other customers. When I run X-Lite and check the diagnostics, it reports:

Discovered Port Restricted Single Mapped Port Symmetric NAT Firewall

I also have a router in addition to the isp firewall, but I believe my router is STUN friendly. From the looks of it the isp firewall is not, though.

What implications does this have? I won't be able to use STUN at all, is that correct?

What will happen to incoming and outgoing calls? Will the calls have to be carried through a proxy server? Or will a proxy be able to setup the call and then I'll be able to connect directly to the other system (as long as the other system is public and not behind NAT, too)?

I've been trying to read quite a bit, but I'm not exactly clear on this. If you have any links for more info, that would be appreciated, too. Thanks.

mberlant · #2 (**permalink**) July 30th, 2006, 10:57 AM

There are threads here that deal with Symmetric NAT routers and others that talk about cascaded routers. They are two distinct challenges that need to be attacked separately. Did you read them before opening a new thread?

What advice from those threads still has you baffled? A more narrowly channeled question, echoing the advice you followed from previous discussions and the progress (or, lack thereof) you have made will be of immense help in assisting you in your quest for success.

For example, have you removed your router from the equation to attack your problem with your ISP first?

turtle · #3 (**permalink**) July 31st, 2006, 06:53 AM

I'm sorry, I read many of the threads. My system seems to be working fine, though I haven't tested it as much as I would like yet. So I'm not really asking whether it will work, or how to get it working, but rather what is happening under the covers.

I'm especially interested in figuring out whether I'll be able to make some direct connection with another system or whether I'll always be relayed through an outbound proxy.

If the system I'm calling (or calling me) has open ports and a public IP address, it would seem like there should be a mechanism where the proxy could set up the call and direct my system to initiate an outbound connection to the other party (instead of always routing the call traffic through the outbound proxy/relay). I'm not sure if that's what happens in reality, though.