RFC 5207
NAT and Firewall Traversal Issues of Host Identity Protocol (HIP) Communication
RFC 5207: NAT and Firewall Traversal Issues of Host Identity Protocol (HIP) Communication 🦋
okay bestie, so this is RFC 5207 💖 and the title is literally NAT and Firewall Traversal Issues of Host Identity Protocol (HIP) Communication. It's an Informational doc from April 2008, written by M. Stiemerling (NEC), J. Quittek (NEC), and L. Eggert (Nokia) 🫶. It doesn't list anything it obsoletes or updates, so it's a standalone little gem ✨.
Status of This Memo 🌸
this memo is here to give info to the Internet community. it's not a spec and it doesn't set any Internet standard 💅. you can distribute it as much as you want, no limits 🌈.
IESG Note 🎀
this RFC came out of the Internet Research Task Force (IRTF), so it's not up for any level of Internet Standard, no cap 🙈. the IRTF shares research and dev results about the Internet, and those results might not be ready for real deployment yet 💀.
Abstract ✨
okay so HIP changes how two Internet hosts talk to each other 🔥. the iconic part is that HIP doesn't need any changes to the classic network layer, aka the routers 👑. but in today's Internet, a bunch of devices that aren't routers mess with that classic network-layer behavior 😭. these are called "middleboxes," and they're basically in-between devices doing stuff beyond what a normal IP router does on the path between source and destination hosts 🧚.
some middleboxes don't bother HIP at all, some affect parts of it, and some can straight up make HIP communication impossible 💔. this doc is about the problems HIP runs into across paths with two specific middlebox types, NATs and firewalls 🍓. it also points out issues in the current HIP specs that make those crossings harder 🔍. and yes, this is a product of the IRTF HIP Research Group, obsessed 💜.
Table of Contents 🧚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. HIP across NATs . . . . . . . . . . . . . . . . . . . . . . . 4
2.1. Phase 1: HIP Base Exchange . . . . . . . . . . . . . . . . 4
2.1.1. IPv4 HIP Base Exchange . . . . . . . . . . . . . . . . 4
2.1.2. IPv6 HIP Base Exchange . . . . . . . . . . . . . . . . 5
2.2. Phase 2: ESP Data Exchange . . . . . . . . . . . . . . . . 5
3. HIP Across Firewalls . . . . . . . . . . . . . . . . . . . . . 6
3.1. Phase 1: HIP Base Exchange . . . . . . . . . . . . . . . . 6
3.1.1. IPv4 HIP Base Exchange . . . . . . . . . . . . . . . . 6
3.1.2. IPv6 HIP Base Exchange . . . . . . . . . . . . . . . . 6
3.2. Phase 2: ESP Data Exchange . . . . . . . . . . . . . . . . 7
4. HIP Extensions . . . . . . . . . . . . . . . . . . . . . . . . 7
5. NAT Extensions . . . . . . . . . . . . . . . . . . . . . . . . 8
6. Legacy NAT and Firewall Traversal . . . . . . . . . . . . . . 8
7. HIP across Other Middleboxes . . . . . . . . . . . . . . . . . 9
8. Security Considerations . . . . . . . . . . . . . . . . . . . 9
9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 10
10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
10.1. Normative References . . . . . . . . . . . . . . . . . . . 10
10.2. Informative References . . . . . . . . . . . . . . . . . . 101. Introduction 💅
okay so the current HIP spec [RFC4423] assumes simple Internet paths 🛣️, where routers forward globally routable IP packets based on their destination address alone. simple and clean, very on-brand 🎀.
but honestly? pure paths like that are getting rarer by the day 😩. for a bunch of reasons, lots of devices modify or extend the forwarding the network layer was originally built to do 🌈. [RFC3234] coined the term middleboxes for these, and it defines one as: "A middlebox is (...) any intermediary device performing functions other than the normal, standard functions of an IP router on the datagram path between a source host and destination host".
middleboxes affect communication in lots of ways 🙈. for example, they can inspect the flows of certain transport protocols, like TCP, and then selectively drop, insert, or modify packets 🔥. and if one of them runs into a higher-layer protocol it doesn't support, or even a variant of a supported protocol it doesn't know how to handle, communication through that middlebox can become impossible for that kind of traffic 💀.
there are tons of middlebox variants out there 🍓. the most common are network address translators and firewalls. [RFC3234] lists many other types too. one broad way to sort them is by behavior. the first group works on packets, doesn't touch application-layer payloads, and doesn't insert extra packets 🧚. that group includes NAT, NAT-PT, SOCKS gateways, IP tunnel endpoints, packet classifiers, markers, schedulers, transport relays, IP firewalls, application firewalls, involuntary packet redirectors, and anonymizers 🦋.
then there are the other middleboxes (like TCP performance-enhancing proxies, application-level gateways, gatekeepers, session control boxes, transcoders, proxies, caches, modified DNS servers, content and applications distribution boxes, and load balancers) that divert or modify URLs, application-level interceptors, and application-level multicast systems ✨. still, NATs and firewalls are the most frequent middleboxes HIP traffic runs into on the Internet 👑. so this memo focuses on how NAT and firewall middleboxes can mess with HIP traffic 🫶.
middleboxes can cause two different kinds of communication problems for HIP 😭. they can interfere with the transmission of HIP control traffic, or with the HIP data traffic carried inside the Encapsulating Security Payload (ESP) [RFC4303] 💜.
this doc is mainly a problem description that solution proposals can point back to 📝. it also talks about known approaches to solving the problem and gives recommendations for certain approaches depending on the scenario 🌸. and it does not promote using any of the discussed middlebox types 🙅♀️.
this memo was discussed and modified in the Host Identity Protocol Research Group, was reviewed by the Internet Research Steering Group (IRSG), and represents a consensus view of the research group at the time it was submitted for publication 🎀.
2. HIP across NATs 🦋
this section is all about HIP traversing network address translator (NAT) middleboxes 🌈. this doc uses the term NAT for a basic translation of IP addresses, and uses the term NAPT for NATs that also do port translation [RFC2663], if it matters to tell them apart 💅.
HIP works in two phases 🔥. first it does a HIP "base exchange" handshake, and only then does it start exchanging application data in the second phase 🫶. this section describes the problems that show up in each phase when NATs sit along the path from the HIP initiator to the responder 🧚.
2.1. Phase 1: HIP Base Exchange 🌸
the HIP base exchange uses different transport mechanisms for IPv6 and IPv4 ✨. with IPv6, it uses a HIP-specific IPv6 extension header, while with IPv4 it uses the IP payload [RFC5201] 👑.
2.1.1. IPv4 HIP Base Exchange 🍓
the HIP protocol spec [RFC5201] suggests encapsulating the IPv4 HIP base exchange in a new IP payload type 📝. the chances of getting it through a NAT depend on what kind of NAT is in the path 🔍. the IPv4 HIP base exchange gets through basic NATs (the ones that only translate IP addresses) without problems, as long as the NAT only interprets and modifies the IP header and doesn't look inside the IP payload 🦋.
but real talk, basic NATs are rare 😩. NAPT devices, which inspect and translate transport-layer port numbers, are way more common 💀. and since the IP payload used for the IPv4 base exchange has no port numbers or other demultiplexing fields, NAPTs can't relay it 🙈.
there's also the well-known "data receiver behind a NAT" problem 😭. HIP nodes behind a NAT aren't reachable unless they start the communication themselves, because otherwise the NAT doesn't have the translation state it needs 💜.
2.1.2. IPv6 HIP Base Exchange 🧚
the IPv6 HIP base exchange uses empty IPv6 packets (no payload) 🌈. the base exchange info gets carried in new HIP extension headers ✨. this approach can cause problems if NAT middleboxes translate or multiplex IP addresses 🔥.
IPv6 NATs are rare right now 💅. but when they do show up, they work pretty similarly to IPv4 NATs 👑. so they'll likely block IP payloads other than the "well-known" transport protocols 🙅♀️. and that includes the IPv6 HIP base exchange, which doesn't have any IP payload at all 💀.
2.2. Phase 2: ESP Data Exchange 🫶
once the base exchange finishes, HIP uses ESP to secure data transmission between the two HIP nodes 🔐. so HIP runs into the same NAT traversal challenges that IPsec does 😭. [RFC3715] digs into these issues for IPsec and describes three distinct problem categories: NAT-intrinsic issues, NAT implementation issues, and helper incompatibilities 📝.
this section focuses on the first category, the NAT-intrinsic issues 🎀. the other two categories are outside this document's scope 🌸. they're handled in the BEHAVE working group or in [RFC3489] 🦋.
with ESP-encrypted data traffic, all upper-layer headers are invisible to a NAT 🙈. so when the IP header changes during NAT traversal, it can invalidate upper-layer checksums sitting inside the ESP-protected payload 💀. HIP hosts already dodge this by substituting Host Identity Tags (HITs) for IP addresses during checksum calculations [RFC5201] ✨.
even though ESP-encrypted packets can traverse NATs, [RFC3715] notes that the Security Parameter Index (SPI) values of this traffic only have one-way significance 🔍. NATs can use SPI values to demultiplex different IPsec flows, kind of like how they use port number pairs to demultiplex unencrypted transport flows 🧚. also, NATs may modify SPIs, similar to how they modify port numbers, when multiple IPsec nodes behind them happen to pick identical SPIs 🌈. but NATs can only see the SPIs of outgoing IPsec flows, and they can't determine the SPIs of the return traffic 😩.
3. HIP Across Firewalls 🛡️
this section is about HIP traversing IP firewalls and packet filters 💅. these middleboxes inspect individual packets and decide whether to forward, discard, or process them in some special way, based on a set of filter rules and their associated actions 🔥.
firewalls aren't inherently a problem for HIP, as long as their policy rules let the HIP base exchange and IPsec traffic through 🫶. the next sections cover specific issues HIP runs into in typical firewall setups 🌸.
3.1. Phase 1: HIP Base Exchange 🦋
3.1.1. IPv4 HIP Base Exchange 💀
a common and recommended firewall config for IPv4 is to block all unknown traffic by default, and to allow only well-known transport protocols, often just on specific ports and with specific characteristics ("scrubbed" traffic) ✨. and sadly, this common setup blocks the HIP base exchange 😭.
3.1.2. IPv6 HIP Base Exchange 🌸
Okay so IPv6 firewalls are basically giving IPv4 firewalls 💅 Their setup is pretty similar. Lots of IPv4 firewalls just yeet any IP packet that has an IP option in it 💀 With IPv6, the expectation is that firewalls will block IPv6 extension headers in general, or at least block the unknown ones. Payloads that aren't specific, well-known transport protocols are likely getting blocked too 🙈 So just like IPv4, this blocks the HIP base exchange. Not it. 😭
Here's another mood: the "data receiver behind a NAT" problem (see Section 2.1.1) shows up for both IPv4 and IPv6 firewalls 🦋 Firewalls usually block everything coming into the protected network unless it's identifiable return traffic from an earlier outbound communication. So HIP peers basically can't be reached from outside the protected network, because the firewall blocks base exchange attempts from outside peers. Main character problem, but make it networking 👑
3.2. Phase 2: ESP Data Exchange ✨
Firewalls are honestly less of a problem than NATs when it comes to passing ESP traffic 🫶 The biggest concern is common firewall setups that block ESP traffic, because ESP isn't a well-known transport protocol and ports can't be used to identify return flows 😤 Still, firewalls could use mechanisms similar to Security Parameter Index (SPI) multiplexed NAT (SPINAT) to use SPIs as flow identifiers [YLITALO] 🧚
4. HIP Extensions 🔥
This section is all about possible changes to HIP that try to make NAT and firewall traversal better 💖 Specifically, the reachability of HIP peers behind those middleboxes, and getting the HIP base exchange through them. Sections 2 and 3 describe a bunch of problems with encapsulation schemes for the HIP base exchange in IPv4 and IPv6, so this section is the glow-up plan for those 🌈
UDP may improve HIP operation in the presence of NATs and firewalls 🦋 It may also help with traversing other middleboxes too. For example, load balancers that use IP- and transport-layer information can operate correctly with UDP-encapsulated HIP traffic ✨
HIP nodes located behind a NAT must notify their communication peers about the contact information 📬 The contact information is the NAT's public IP address and a specific UDP port number. This lets peers send return traffic to HIP nodes behind the NAT. It would need a new HIP mechanism, so it's not free 💅
To be reachable behind a NAT, you need a rendezvous point that lets HIP nodes behind a NAT register an IP address and port number that can be used to contact them 🧭 Depending on the type of NAT, you may only need the rendezvous point during the base exchange, or throughout the whole communication instance. A rendezvous point is also useful for HIP nodes behind firewalls, because they have an analogous problem, as described in Section 3 🌸
The proposed mobility management packet exchange [RFC5206] [NIKANDER] can support this method of NAT traversal 🎀 The original intention of this extension was to support host mobility and multihoming. This mechanism is similar to the Alternate Network Address Types (ANAT) described in [RFC4091]. The difference is that HIP peers use mobility management messages to notify peers about rendezvous points, which is similar to [RFC4091] 🦋 HIP peers must determine their contact address before they can announce it to their peers. No skipping that step, bestie 😤
5. NAT Extensions 💜
IPsec SPIs only have one-way significance, as described in Section 2.2 🙃 So NATs and firewalls can see the SPI values of outgoing packets, but they can't learn the SPI values of the matching inbound return traffic in the same way. Two methods exist:
First, NATs can observe the HIP base exchange and learn the SPI values that HIP peers agree to use. After that, NATs can map outgoing and incoming IPsec flows accordingly 🔍 This approach is called "architectured NAT", or SPINAT [YLITALO], and firewalls can use it too. It does require HIP-specific NAT modifications.
Second, HIP peers can use a generic NAT or firewall signaling protocol to explicitly signal the right SPI values to their NATs and firewalls 📣 This approach doesn't need HIP-specific changes at the middlebox, but it does need HIP to be integrated with the signaling protocol at the end systems 🧑💻
Possible solutions for signaling SPI values are the mechanisms proposed in the IETF NSIS WG (NATFW NSLP) and the MIDCOM MIB module [RFC5190]. Using MIDCOM with HIP needs extra knowledge about network topology 🗺️ For example, in multihomed environments with different border NATs or firewalls, a host has to know which of the multiple NATs/firewalls to signal. So this solution can be problematic 😬
Using the NSIS NAT/FW traversal (NATFW NSLP) mechanism, HIP nodes can signal the SPI values used in both directions ✨ NATFW NSLP makes sure signaling messages reach all NATs and firewalls along the data path (path-coupled signaling). NSIS is generally supported at both peers, but NATFW NSLP also offers a "proxy mode" for scenarios where only one end supports NSIS. That has deployment advantages, which is very iconic 👑
6. Legacy NAT and Firewall Traversal 🧚
The solutions outlined in Section 5 require that NATs and firewalls get updated to support new functions, like HIP itself or NSIS NATFW signaling 🛠️ NATs and firewalls are already widely deployed, so it will be impossible to upgrade or replace all of these middleboxes with HIP support 😭 This section explores how HIP works when legacy NATs and firewalls that aren't HIP-aware are in the way. Because the vast majority of deployed NATs currently support IPv4 only, this section focuses on them 🌈
For HIP over IPv4, UDP encapsulation of HIP traffic already solves some NAT traversal issues 🎀 Usually, UDP packets can traverse NATs and firewalls when the communication was initiated from the inside. However, traffic initiated from outside a NAT is typically dropped, because it can't be demultiplexed to the final destination (for NATs) or it's prohibited by policy (for firewalls) 🚫
Even when UDP encapsulation lets the HIP base exchange succeed, ESP still causes problems [RFC3715] 🥲 Some NAT implementations offer "VPN pass-through", where the NAT learns about IPsec flows and tries to correlate outgoing and incoming SPI values. This often only works reliably for a small number of nodes behind a single NAT, because of the possibility of SPI collisions 💀
A better solution may be to use UDP encapsulation for ESP [RFC3948], enabled through a new parameter in the base exchange 💖 It is for further study whether to mandate UDP encapsulation for all HIP traffic, to reduce the complexity of the protocol 🤔
HIP may also consider other NAT/firewall traversal mechanisms, like the widely deployed Universal Plug and Play (UPNP) [UPNP] 🔌 UPNP can be used to configure middleboxes on the same link as a HIP node.
7. HIP across Other Middleboxes 🦋
This document focuses on NAT and firewall middleboxes, and doesn't discuss the other types identified in [RFC3234] 🙌 NATs and firewalls are the most frequently deployed middleboxes at the time of writing. Future versions of this document may describe how HIP interacts with other types of middleboxes, so stay tuned 👀
8. Security Considerations 🚨
Opening pinholes in firewalls (i.e., loading firewall rules that allow packets to traverse) and creating NAT bindings are highly security-sensitive actions 😱 Any mechanism that does this to support HIP traversal across middleboxes should be well protected. Detailed discussion of the related security issues can be found in the security considerations sections of the corresponding standards documents, such as [RFC3715] and [RFC5190] 🔐
This document has not considered whether some of the options listed above pose additional threats to the security of the HIP protocol itself. Those threats are still a mystery, so keep that in mind 🫣
9. Acknowledgments 💜
Big thank-you to the people who helped improve this document through thoughtful suggestions and feedback: Pekka Nikander, Tom Henderson, and the HIP research group 🫶 The authors would also like to thank the final reviewers, Kevin Fall, Mark Allman, and Karen Sollins 👑
Lars Eggert and Martin Stiemerling are partly funded by Ambient Networks, a research project supported by the European Commission under its Sixth Framework Program 🇪🇺 The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the Ambient Networks project or the European Commission.
10. References 📚
10.1. Normative References 🧷
[RFC2663] Srisuresh, P. and M. Holdrege, "IP Network Address
Translator (NAT) Terminology and Considerations",
RFC 2663, August 1999.
[RFC3948] Huttunen, A., Swander, B., Volpe, V., DiBurro, L., and M.
Stenberg, "UDP Encapsulation of IPsec ESP Packets",
RFC 3948, January 2005.
[RFC4423] Moskowitz, R. and P. Nikander, "Host Identity Protocol
(HIP) Architecture", RFC 4423, May 2006.
[RFC5201] Moskowitz, R., Nikander, P., Jokela, P., Ed., and T.
Henderson, "Host Identity Protocol", RFC 5201,
April 2008.10.2. Informative References 🌷
[NIKANDER] Nikander, P., Ylitalo, J., and J. Wall, "Integrating
Security, Mobility, and Multi-Homing in a HIP Way", Proc.
Network and Distributed Systems Security Symposium
(NDSS) 2003, February 2003.
[RFC3234] Carpenter, B. and S. Brim, "Middleboxes: Taxonomy and
Issues", RFC 3234, February 2002.
[RFC3489] Rosenberg, J., Weinberger, J., Huitema, C., and R. Mahy,
"STUN - Simple Traversal of User Datagram Protocol (UDP)
Through Network Address Translators (NATs)", RFC 3489,
March 2003.
[RFC3715] Aboba, B. and W. Dixon, "IPsec-Network Address
Translation (NAT) Compatibility Requirements", RFC 3715,
March 2004.
[RFC4091] Camarillo, G. and J. Rosenberg, "The Alternative Network
Address Types (ANAT) Semantics for the Session
Description Protocol (SDP) Grouping Framework", RFC 4091,
June 2005.
[RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)",
RFC 4303, December 2005.
[RFC5190] Quittek, J., Stiemerling, M., and P. Srisuresh,
"Definitions of Managed Objects for Middlebox
Communication", RFC 5190, March 2008.
[RFC5206] Henderson, T., Ed., "End-Host Mobility and Multihoming
with the Host Identity Protocol", RFC 5206, April 2008.
[UPNP] UPNP Web Site, "Universal Plug and Play Web Site", Web
Site http://www.upnp.org/, July 2005.
[YLITALO] Ylitalo, J., Melen, J., Nikander, P., and V. Torvinen,
"Re-Thinking Security in IP-Based Micro-Mobility", Proc.
7th Information Security Conference (ISC) 2004,
September 2004.Authors' Addresses 🦋
Martin Stiemerling
NEC Europe Ltd.
Kurfuersten-Anlage 36
Heidelberg 69115
Germany
Phone: +49 6221 4342 113
Fax: +49 6221 4342 155
EMail: stiemerling@nw.neclab.eu
URI: http://www.nw.neclab.eu/
Juergen Quittek
NEC Europe Ltd.
Kurfuersten-Anlage 36
Heidelberg 69115
Germany
Phone: +49 6221 4342 115
Fax: +49 6221 4342 155
EMail: quittek@nw.neclab.eu
URI: http://www.nw.neclab.eu/
Lars Eggert
Nokia Research Center
P.O. Box 407
Nokia Group 00045
Finland
Phone: +358 50 48 24461
EMail: lars.eggert@nokia.com
URI: http://research.nokia.com/people/lars_eggert/Full Copyright Statement ✨
Okay bestie, time for the legal bit, but make it cute 🎀 The IETF Trust owns the copyright here, and it's dated 2008 💜
Copyright (C) The IETF Trust (2008).
This document is subject to the rights, licenses and restrictions in BCP 78 and at http://www.rfc-editor.org/copyright.html. Except as set forth there, the authors keep all their rights 🦋
The document and the info in it are provided on an "AS IS" basis, and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE all say NO to warranties, whether express or implied 🙈 That includes no promise that using the info won't infringe anyone's rights, and no implied warranties of merchantability or fitness for a particular purpose. Heavy, but important 💅
Intellectual Property 🌸
The IETF doesn't take a position on whether any Intellectual Property Rights or other rights claimed about the tech in this doc are valid, how far they reach, or whether any license for them is available. It also doesn't say it has done any independent search for such rights 🔍 If you want the procedures for rights in RFC docs, check BCP 78 and BCP 79 📚
Copies of IPR disclosures sent to the IETF Secretariat, plus any assurances of licenses that will be available, or the results of an attempt to get a general license or permission for implementers or users to use those proprietary rights, can be found in the IETF on-line IPR repository at http://www.ietf.org/ipr 🧚
The IETF also invites anyone interested to bring to its attention any copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 💖
📦 where this page comes from
- ietf: rfc5207 2008-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms