NAT traversal and IPsec

In order for IPsec to work through a NAT, the following protocols need to be allowed through the NAT interface(s), eg. the LAN router:

• Internet Key Exchange (IKE) - User Datagram Protocol (UDP) port 500
• Encapsulating Security Payload (ESP) - IP protocol number 50
• Authentication Header (AH) - IP protocol number 51

or, in case of NAT-T:

• IKE - UDP port 500
• IPsec NAT-T - UDP port 4500

Often this is accomplished on home routers by enabling "IPsec Passthrough".

In Windows XP, NAT-T is enabled by default, but in XP with SP2, has been disabled by default for the case when the VPN server is also behind a NAT device, because of a rare and controversial security issue^[1]. IPsec NAT-T patches are also available for Windows 2000, Windows NT and Windows 98.

One usage of NAT-T and IPsec is to enable opportunistic encryption between systems. NAT-T allows systems behind NATs to request and establish secure connections on demand.