We've already touched on this in the AH and ESP lessons. NAT (Network Address Translation) is the process where a router changes a private IP to a public one. The problem is that IPsec is designed to protect the integrity of the packet. If a router changes the IP header, the IPsec receiver thinks the packet was tampered with and drops it.
AH is the easiest case: it signs the IP header. NAT changes the header $ ightarrow$ signature fails $ ightarrow$ packet dropped. ESP is trickier. While ESP doesn't sign the outer header, many NAT routers only know how to forward TCP and UDP. ESP is its own protocol (Protocol 50). Most home routers don't know what to do with 'Protocol 50' and simply drop it.
💡 This is why many old VPN clients required you to 'Enable IPsec Passthrough' in your router settings. This told the router to blindly forward Protocol 50 packets.
During the IKE handshake, both peers send a 'NAT-D' (NAT Detection) payload. This is a hash of the IP and port. If the receiver's calculated hash doesn't match the one sent, it knows there is a NAT device in the middle.
The industry solved this with NAT-T (NAT Traversal). If a NAT device is detected, the IKE process switches the traffic from ESP (Protocol 50) to **UDP Port 4500**. The ESP packet is wrapped inside a standard UDP header. To the router, it looks like normal UDP traffic. To the receiver, it just strips the UDP header and finds the ESP packet inside.
⚠️ NAT-T increases the packet size. In an already bloated Tunnel Mode packet, adding a UDP header can be the 'last straw' that triggers MTU fragmentation and kills performance.
| Protocol | Default Port/Proto | NAT Result | NAT-T Solution |
|---|---|---|---|
| AH | Proto 51 | Broken (Header change) | None (Use ESP) |
| ESP | Proto 50 | Often Dropped | UDP Port 4500 |
| IKE | UDP 500 | Works | UDP 4500 |
When configuring a VPN gateway, you must ensure that your firewall allows both UDP 500 (for the initial IKE setup) and UDP 4500 (for the NAT-T data flow). If you only open 500, users on home Wi-Fi will be able to authenticate, but no data will actually flow through the tunnel.
Some 'Smart' firewalls perform 'Deep Packet Inspection' (DPI) and can see the ESP inside the UDP 4500 wrapper. If they don't like the encryption level, they may still drop the packet.
Verify exercises to earn ★ 150 XP and unlock next lab level.