Citrix Virtual Apps and Desktops

NAT Compatibility

May 30, 2024

Contributed by:

To establish a direct connection between an external user device and the session host, HDX Direct leverages hole punching for NAT traversal and STUN to facilitate the exchange of the public IP address and port mappings for the client device and session host. This is similar to how VoIP, unified communications, and P2P solutions work.

As long as firewalls and other network components are configured to allow the UDP traffic for the STUN requests and the HDX sessions, HDX Direct for external users is expected to work. However, there are certain scenarios where the NAT types of the user and session host networks lead to an incompatible combination, thus causing HDX Direct to fail.

Validations

You can validate the NAT type on the client and the session host by using STUNTMAN’s STUN client utility:

Download the appropriate package for the target platform from stunprotocol.org, and extract the contents.
Open a terminal prompt and navigate to the directory where the contents were extracted.
Run the following command: .\stunclient.exe stunserver.stunprotocol.org --mode behavior
Take note of the output.

If the binding and behavior tests are successful, both binding test and behavior test report the success and a NAT behavior is specified:

NAT Success

If the tests fail, both binding test and behavior test report the failure.

NAT Failure

See the following table to determine if HDX Direct for external users is expected to work based on the test results of both the client and session host:

Client device	Session host	Expected to work?
Endpoint Independent Mapping	Endpoint Independent Mapping	Yes
Endpoint Independent Mapping	Endpoint Dependent Mapping	Yes
Endpoint Dependent Mapping	Endpoint Independent Mapping	Yes
Endpoint Dependent Mapping	Endpoint Dependent Mapping	No
fail	Any NAT type	No
Any NAT type	fail	No
fail	fail	No

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

NAT Compatibility

May 30, 2024

Contributed by:

May 30, 2024

Contributed by:

NAT Compatibility

Validations

In this article