Mediation Server NAT Traversal for Direct VPN Tunnels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual private networking (VPN) technologies face challenges in establishing connections between computers behind Network Address Translation (NAT) devices, leading to restricted network connectivity and complexity in setup, especially when firewalls are involved, resulting in high failure rates and increased latency or bandwidth costs.
Innovation Solution
A server-mediated peer-to-peer system that uses a mediation server to assist clients in discovering and predicting NAT device logic, enabling direct low-latency tunnels between VPN members by executing a tunneling engine that performs NAT and firewall traversal, and switches to relaying when direct tunneling is not possible.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If NAT devices are used to share IP addresses, then IP address shortage is resolved, but network connectivity between computers behind NAT devices is restricted
Solution Approach 1:
The patent introduces a mediation server as an intermediary that facilitates direct peer-to-peer connections between computers behind NAT devices. The server assists in discovering and predicting NAT device logic, enabling direct tunnels without requiring NAT reconfiguration. This resolves the connectivity restriction while preserving IP address sharing.
2Object-affected harmful factors
If firewalls are configured to protect computers, then security is improved, but network accessibility from outside is reduced
Solution Approach 1:
The mediation server acts as a trusted intermediary that works with firewall configurations to establish connections. It performs firewall traversal by predicting firewall behavior and coordinating connection attempts, allowing secure computers behind firewalls to be accessible while maintaining security policies.
Solution Approach 2:
The system performs preliminary discovery and prediction of NAT and firewall logic before attempting direct connections. This advance preparation enables the mediation server to coordinate connection attempts that comply with firewall rules while establishing accessibility.
3Speed
If direct peer-to-peer connections are attempted without mediation, then latency is reduced, but connection success rate is low
Solution Approach 1:
The mediation server provides assisted direct peer-to-peer connections. It assists in discovering NAT and firewall logic, predicting connection parameters, and coordinating the establishment of direct tunnels. Once established, connections are direct with low latency, but the server's mediation ensures high success rates by preparing connections in advance.
Solution Approach 2:
The system performs preliminary discovery of NAT device logic and prediction of connection parameters before attempting direct connections. This advance preparation significantly increases connection success rates while maintaining the benefit of direct low-latency communication paths.
4Reliability
If NAT traversal techniques are implemented, then connectivity between NAT-protected computers is improved, but setup complexity increases
Solution Approach 1:
The mediation server performs automatic discovery and prediction of NAT device logic without requiring user configuration. Computers simply need to run the client software, and the server automatically assists in establishing direct connections by analyzing NAT behavior and coordinating connection attempts, eliminating complex manual setup.
5Reliability
If relaying is used as fallback when direct tunneling fails, then connectivity is ensured, but bandwidth costs and latency increase
Solution Approach 1:
The mediation server provides assisted direct peer-to-peer connections through discovery and prediction techniques. By enabling direct tunnels in most cases, the system avoids the need for continuous relaying, significantly reducing bandwidth costs and latency while maintaining connectivity guarantees as fallback.
Data Source
AI summary
A method and apparatus for facilitating communication between client computers is provided. The method provides for the use of ping probing by a server to determine the types of NAT devices and/or firewalls protecting the client computers. Once these are determined, the server can predict the response to communications from the client computers and instruct the client computers to contact each other. Once a session or tunnel is established it can be maintained through the use of a flag, even if contact with the server is lost.