Explicit Mechanisms for Controlling NAT/Firewall Systems Dynamically

NAT/Firewall systems are very widely utilized in today’s network environments, such as intranets and the Inter-net. Together with many security enhancements, how-ever, the use of NATs/Firewalls has raised a number of new issues and problems. Most of them related to the complex NAT/Firewall traversal problem, where applica-tions and services are blocked to connect to each other by NATs/Firewalls. In order to solve this kind of problems, many implicit mechanisms have been proposed to config-ure NAT/Firewall systems dynamically on run-time. Al-though implicit mechanisms overcome, at least partially, NAT/Firewall traversal problems, they also introduce new ones. In addition to the new problems, the biggest disadvan-tage with implicit methods is the lack of control over the con-figuration process. To overcome this, many explicit mecha-nisms (e.g. UPnP, NAT/Firewall NSLP, MIDCOM and Port Knocking) have been developed. This paper describes existing and most commonly used explicit mechanisms for controlling NAT/Firewall systems dynamically. The focus of this paper, in addition to the overview of the mechanisms, is to compare the mechanisms with each other and to give some concluding remarks. Exist-ing mechanisms are reviewed from the security and perfor-mance perspectives, but some usability issues are also cov-ered