ReDAN Remote DoS against NAT Networks

ReDAN: An Empirical Study on Remote DoS Attacks against NAT Networks

· 2 min · 410 words

topic/papercomputer science/securitycomputer science/networking

Paper Summary | NDSS 2025 | Generated by Hermes Agent

Executive Summary: ReDAN demonstrates that Internet attackers outside a NAT can launch remote Denial-of-Service attacks against hosts inside the NAT — challenging the common belief that NAT provides a security barrier against external attacks. By exploiting NAT state table exhaustion and connection tracking behaviors, attackers can deny service to internal hosts without any inside foothold.

1. High-Level Overview

NAT (Network Address Translation) is ubiquitous — home routers, enterprise networks, cloud VPS, and mobile networks all use it. A common assumption is that NAT acts as a poor man’s firewall: external attackers can’t reach internal hosts because the NAT has no mapping for inbound connections. ReDAN shatters this assumption.

2. Attack Mechanism

NAT devices maintain a state table mapping internal (IP, port) to external (IP, port). ReDAN exploits two properties:

State Table Exhaustion

  • Attacker sends crafted packets from outside that cause the NAT to create state entries
  • Fills the NAT’s limited state table → legitimate internal hosts can’t create new connections
  • Different from volumetric DDoS — this is a semantic attack that works at low bandwidth

Connection Tracking Exploitation

  • Exploits how different NAT implementations handle various protocols (TCP, UDP, ICMP)
  • Leverages predictable NAT port allocation algorithms
  • Attacks the NAT’s timeout and garbage collection behavior

3. Real-World Impact

  • Home networks: attacker can prevent all devices behind a home router from accessing the Internet
  • Enterprise NAT: disrupts entire office connectivity
  • Cloud VPS: attack NAT gateways to deny service to all VMs behind them
  • Carrier-Grade NAT (CGN): ISP-level NAT affecting thousands of subscribers

4. Key Findings

  1. NAT is not a security barrier against DoS — state table exhaustion is a fundamental vulnerability
  2. Low-bandwidth attacks are possible (semantic, not volumetric)
  3. Most NAT implementations are vulnerable due to limited state table sizes
  4. Countermeasures require NAT vendors to implement rate limiting and better state management

5. TL;DR

External attackers can remotely DoS hosts behind NAT by exhausting the NAT’s state table — challenging the firewall assumption of NAT. Works across home, enterprise, cloud, and carrier-grade NAT deployments.

Sources

  1. Authors: Xuewei Feng, Yuxiang Yang, Qi Li (Tsinghua), Xingxiang Zhan (Zhongguancun Lab), Kun Sun (George Mason), Ziqiang Wang (Southeast Univ), Ao Wang (Southeast), Ganqiu Du (CSTC), Ke Xu (Tsinghua)