NAT abuse (IPv4)¶

Attack pattern¶

NAT was meant to stretch a shrinking address space, not to be a security control, and treating it as one is where the trouble starts. It keeps a table mapping inside connections to a shared outside address, and that table is a resource to exhaust and a state machine to confuse. Its helper code guesses at protocols to keep them working through the translation, and the guessing can be led astray. On the home router at the edge of it all, defaults are weak and updates rare.

1. NAT Abuse [OR]

    1.1 NAT Traversal Attacks [OR]
    
        1.1.1 TCP Hole Punching
            1.1.1.1 Simultaneous SYN Packet Techniques
            1.1.1.2 Port Prediction Algorithms
            1.1.1.3 Protocol-Specific Helpers (e.g., FTP)
            
        1.1.2 UDP Hole Punching
            1.1.2.1 STUN-Based Traversal
            1.1.2.2 TURN Relay Exploitation
            1.1.2.3 ICE Protocol Manipulation
            
        1.1.3 ICMP Traversal
            1.1.3.1 ICMP Error Message Abuse
            1.1.3.2 Ping Tunnel Establishment
            1.1.3.3 Covert ICMP Channels
            
    1.2 State Table Exhaustion [OR]
    
        1.2.1 Connection Flooding
            1.2.1.1 SYN Flood to Exhaust NAT Table
            1.2.1.2 UDP Session Flooding
            1.2.1.3 ICMP Flood to Consume State Resources
            
        1.2.2 Persistent Connection Attacks
            1.2.2.1 Long-Lived TCP Connections
            1.2.2.2 UDP Stream Maintenance
            1.2.2.3 NAT Keep-Alive Exploitation
            
    1.3 Application Layer Gateway (ALG) Exploits [OR]
    
        1.3.1 ALG Bypass Techniques
            1.3.1.1 Protocol Violation Attacks
            1.3.1.2 Encrypted Payload Bypass
            1.3.1.3 ALG Resource Exhaustion
            
        1.3.2 ALG-Specific Vulnerabilities
            1.3.2.1 SIP ALG Buffer Overflows
            1.3.2.2 FTP ALG Security Bypass
            1.3.2.3 DNS ALG Cache Poisoning
            
    1.4 Port Forwarding Abuse [OR]
    
        1.4.1 Unauthorised Access Through Forwarding
            1.4.1.1 Default Password Access to Forwarded Services
            1.4.1.2 Service Enumeration Through Forwarded Ports
            1.4.1.3 Backdoor Installation via Forwarded Services
            
        1.4.2 DMZ Host Exploitation
            1.4.2.1 DMZ Host as Attack Launch Point
            1.4.2.2 DMZ to Internal Network Pivoting
            1.4.2.3 DMZ Host Compromise
            
    1.5 NAT Slipstreaming [OR]
    
        1.5.1 Protocol Impersonation
            1.5.1.1 HTTP Header Manipulation
            1.5.1.2 SIP Message Injection
            1.5.1.3 FTP PORT Command Abuse
            
        1.5.2 Browser-Based Attacks
            1.5.2.1 WebRTC NAT Bypass
            1.5.2.2 JavaScript NAT Slipstreaming
            1.5.2.3 Cross-Protocol Attacks
            
    1.6 VPN Bypass Through NAT [OR]
    
        1.6.1 Split Tunnelling Exploitation
            1.6.1.1 Direct Internet Access While VPN Connected
            1.6.1.2 VPN Bypass for Malware C2
            1.6.1.3 Data Exfiltration Outside VPN Tunnel
            
        1.6.2 NAT on VPN Tunnel
            1.6.2.1 Double NAT Configuration Issues
            1.6.2.2 VPN Client NAT Bypass
            1.6.2.3 Mobile Device VPN NAT Issues
            
    1.7 Carrier-Grade NAT (CGNAT) Exploits [OR]
    
        1.7.1 Port Allocation Attacks
            1.7.1.1 Port Exhaustion at Carrier Level
            1.7.1.2 CGNAT State Table Overflow
            1.7.1.3 Shared Port Space Attacks
            
        1.7.2 User Identification Bypass
            1.7.2.1 IP Sharing for Anonymity
            1.7.2.2 CGNAT Log Evasion
            1.7.2.3 Law Enforcement Identification Challenges
            
    1.8 IoT NAT Vulnerabilities [OR]
    
        1.8.1 UPnP Exploitation
            1.8.1.1 Automatic Port Forwarding Abuse
            1.8.1.2 UPnP Reflection Attacks
            1.8.1.3 IoT Device Takeover via UPnP
            
        1.8.2 Limited NAT Traversal Capabilities
            1.8.2.1 IoT Device Isolation Bypass
            1.8.2.2 Cloud Service Impersonation
            1.8.2.3 Manufacturer Backdoor Exploitation
            
    1.9 IPv6 Transition Mechanisms [OR]
    
        1.9.1 NAT64/DNS64 Exploitation
            1.9.1.1 IPv6 to IPv4 Translation Bypass
            1.9.1.2 DNS64 Poisoning Attacks
            1.9.1.3 Protocol-Specific Translation Issues
            
        1.9.2 Dual-Stack Abuse
            1.9.2.1 IPv6 Preference Attacks
            1.9.2.2 Protocol Selection Manipulation
            1.9.2.3 Dual-Stack Implementation Flaws

A table, not a wall¶

NAT keeps a state table mapping inside sessions to the shared address, and a resource that is kept can be exhausted or poisoned.
Application Layer Gateways rewrite protocol-specific traffic to survive translation, and that rewriting is buggy and can be tricked.
Small-office and home routers ship with weak defaults, UPnP enabled, and firmware that is rarely if ever updated.
NAT behaviour turns unpredictable when packets take asymmetric paths, and a path that skips the NAT skips its state.
Sharing one address among many is the whole point, and it is also what makes attribution behind NAT hard.