Skip to content
uencoder

Restricted Cone NAT

Restricted cone NAT admits inbound packets only when the external host's source IP matches an IP the internal host has sent to—stricter than full cone.

Purpose

It restricts the external source IP so only external IPs the internal host contacted may reply, improving security at the cost of harder traversal.

Mechanism

The mapping is fixed, but an inbound packet is forwarded only if its source IP is one the internal host has already sent to. The external port is unrestricted, yet the source IP must match.

Use cases

  • NAT type analysis
  • P2P traversal assessment
  • VoIP

Related tools

References