| Internet-Draft | NATSAP | April 2025 |
| McLarty | Expires 4 October 2025 | [Page] |
This document defines the NAT Sub-Address Protocol (NATSAP), a Layer 5 encapsulation protocol designed to facilitate seamless bidirectional communication with devices behind Carrier-Grade NAT (CG NAT). NATSAP introduces dynamic sub-addresses assigned by the NAT router, which external clients can use alongside the public IP to route traffic back to internal devices without requiring traditional port forwarding. This document also defines the Dynamic Sub-Address Assignment Protocol (DSAAP), to facilitate the acquiring of a NATSAP Sub-Address.¶
The protocol offers backward compatibility with existing IPv4 infrastructure, efficient DNS-based service discovery, and simple, stateless mapping. By encapsulating application-layer traffic, NATSAP enables direct communication with devices behind NATs using a standardized socket notation and DNS records.¶
This note is to be removed before publishing as an RFC.¶
The latest revision of this draft can be found at https://Daniel-McLarty.github.io/NAT-Sub-Address-Protocol/draft-mclarty-nat-sub-address-protocol.html. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-mclarty-nat-sub-address-protocol/.¶
Discussion of this document takes place on the INTAREA Working Group mailing list (mailto:int-area@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/int-area/. Subscribe at https://www.ietf.org/mailman/listinfo/int-area/.¶
Source for this draft and an issue tracker can be found at https://github.com/Daniel-McLarty/NAT-Sub-Address-Protocol.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 4 October 2025.¶
Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
The proliferation of Carrier-Grade NAT (CG NAT) in IPv4 networks has made it increasingly difficult for devices behind NATs to host services. Traditional NAT traversal techniques, such as port forwarding, STUN, TURN, and UPnP, are cumbersome, inconsistent, and difficult to automate.¶
NATSAP addresses this issue by introducing:¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
NATSAP: NAT Sub-Address Protocol¶
DSAAP: Dynamic Sub-Address Assignment Protocol¶
CG NAT: Carrier-Grade Network Address Translation¶
Sub-Address: A unique 32-bit identifier assigned by the NAT router to an internal device.¶
NATSAP Table: A mapping table in the NAT router that associates sub-addresses with internal IPs.¶
A: example.com → 192.0.2.20
TXT: _natsap.example.com → "example.com, ABCD-1234"
¶
Third-Party Client Connection¶
NATSAP Encapsulation¶
The external client encapsulates its application-layer traffic inside a NATSAP packet.¶
The CG NAT router receives the packet, extracts the sub-address, and performs a table lookup to route the traffic to the appropriate internal device.¶
The router forwards the traffic to the internal client.¶
The internal client de-encapsulates the NATSAP packet and treats the application-layer traffic like normal.¶
The internal client then sends a standard reply to the external client.¶
If the external client has to send new traffic to the internal client the external client will build a new NATSAP packet.¶
| Field Name | Description |
|---|---|
| Version (8 bits) | NATSAP protocol version (e.g., 0x01). |
| Flags (8 bits) | Reserved for future use. |
| Destination Sub-Address (32 bits) | The Sub-Address of the server. |
| Encapsulated Data Length (16 bits) | Length of the encapsulated payload in bytes. |
| Encapsulated Data (variable) | The original datagram traffic (e.g., https) |
NATSAP uses DNS TXT records for service discovery.¶
A: example.com → 192.0.2.20
TXT: _natsap.example.com → "example.com, ABCD-1234"
Clients use the A record to find the public IP and the TXT record to retrieve the sub-address.¶
NATSAP defines a new URI format for addressing services:¶
natsap://<public-ip>[<sub-address>]:<original-port>¶
Example URI: natsap://192.0.2.20[ABCD-1234]:443¶
NATSAP is backward-compatible with existing IPv4 infrastructure:¶
No modifications to Layer 3 or Layer 4 protocols are required.¶
Non-NATSAP routers will simply drop unrecognized NATSAP packets.¶
Services using traditional ports remain unaffected.¶
The CG NAT router should rate-limit DSAAP requests to prevent abuse.¶
IANA may need to register both a TCP and UDP port to NATSAP. IANA may need to register a UDP port to DSAAP.¶
TODO acknowledge.¶