Re: [MMUSIC] RTSP and NATs

[Magnus Westerlund <magnus.westerlund@era.ericsson.se>]

Hi Philippe,

philippe.gentric@philips.com wrote:

> Magnus,
>
> I strongly support the recommendation to not use ALGs,
> therefore STUN should be used instead but then you wrote:
>
>
> > To be able to use STUN to traverse symmetric NATs the  STUN  server
> >  needs to be co-located with the streaming server media distribution
> >  ports. As this will create implementations difficulties and  possi-
> > bly security problems this SHOULD NOT be done.
>
> I am surprised, I would have proposed _on the contrary_ a "SHOULD" here
> (since traversing symetric NATs is a key feature) !
>  
> also what do you mean by  "implementation difficulties" ? (I really cannot see any ?)
> and could you explicit what type of _additional_ security issues this would cause
> (i.e. issues that are not inherent to running either a RTSP or a STUN server in the first place ?)
>  
The problem of running STUN for a symmetric NAT is that the STUN server 
must be located at the servers sending port. So using the same RTSP 
mechanism that are used for traversing a cone-nat the client would:
1. first contact a well known port with the server for each his media 
stream to get the mapping of the stream. The client can't use any other 
then the well known port because it doesn't know what port to send to.
2. In the SETUP ask the server to send from its STUN servers well known 
port. It also needs to receive RTCP on that port.
3. For keep alive on the RTP port the client needs to send periodically 
STUN messages to the STUN server.

This is a mess for a implementor. It need to have a STUN server 
receiving the STUN messages while the RTP/RTCP stack should receive all 
other messages. Also all the clients need to reside on the same port 
number which creates a multiplexing nightmare.

If you change the setup phase so that the streams are first SETUP to 
dummy ports then reconfigured with a later message, the STUN could be 
located at each media streams source address. However in this setup it 
is actually better to use symmetric RTP in all regards except perhaps 
hi-jacking of media streams. However with certain restrictions you can 
actually end up with at least the same level of security that RTSP 
provides today.

How are you using STUN to traverse a symmetric NAT?

Best Regards

Magnus


--

Magnus Westerlund 
Multimedia Technologies, Ericsson Research ERA/TVA/A
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Torshamsgatan 23           | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: magnus.westerlund@era.ericsson.se



_______________________________________________
mmusic mailing list
mmusic@ietf.org
https://www1.ietf.org/mailman/listinfo/mmusic