ALG

Stands for: Application Level Gateway

Code in a NAT that reads and rewrites addresses inside an application's payload, so protocols such as FTP survive translation.

NAT rewrites headers, but protocols such as FTP, SIP and H.323 also write addresses into their payloads. An Application Level Gateway (RFC 2663) repairs those one protocol at a time; the same meddling breaks protected or NAT-aware traffic, which is why RFC 4787 wants UDP ALGs turned off.

FTP is the model, and RFC 3022 calls it the most popular ALG on NAT devices. The PORT command and the PASV reply carry an address and port in ASCII, so the ALG rewrites them and creates the mapping for the data connection they announce. Rewriting can change the length: with port 51234 written 200,34, the string 10,0,0,10,200,34 has 16 characters and 203,0,113,1,200,34 has 18, so the ALG must also shift TCP sequence numbers for the rest of the session. On Linux these are conntrack helpers, which create expectations, and the data connection is RELATED.

Every ALG is a protocol-specific workaround, and it fails wherever payloads are protected. An encoded payload disables it unless it holds the key; a DNS-ALG that rewrites answers breaks DNSSEC signatures; and NATs that rewrote any field holding their public address broke STUN until STUN XORed its addresses. RFC 4787 says NAT ALGs for UDP should be turned off, and RFC 5382 recommends disabling every TCP ALG except FTP by default.

Behind carrier-grade NAT, subscribers get only the ALGs their provider runs, and RFC 6333 notes that no AFTR can implement every current and future one.

Also known as: nat alg, application layer gateway, application-level gateway, ftp alg, conntrack helper

Sources

← All glossary entries