Citrix Virtual Apps and Desktops

NAT Compatibility

March 4, 2025

Contributed by:

To establish a direct connection between an external user device and the session host, HDX Direct leverages hole punching for NAT traversal and STUN to facilitate the exchange of the public IP address and port mappings for the client device and session host. This is similar to how VoIP, unified communications, and P2P solutions work.

As long as firewalls and other network components are configured to allow the UDP traffic for the STUN requests and the HDX sessions, HDX Direct for external users is expected to work. However, there are certain scenarios where the NAT types of the user and session host networks lead to an incompatible combination, thus causing HDX Direct to fail.

Validations

You can validate the NAT type and filtering on the client and the session host by using STUNTMAN’s STUN client utility:

Download the appropriate package for the target platform from stunprotocol.org, and extract the contents.
Open a terminal prompt and navigate to the directory where the contents were extracted.
Run the following command to perform NAT binding and behavior test: stunclient.exe stunserver2025.stunprotocol.org --mode behavior
If the binding and behavior tests are successful, both binding test and behavior test report the success and a NAT behavior is specified:

If the tests fail, binding test and/or behavior test report the failure.
Run the following command to perform NAT binding and filtering test: stunclient.exe stunserver2025.stunprotocol.org --mode filtering
If the binding and filtering tests are successful, both binding test and filtering test report the success and a NAT filtering type is specified:

If the tests fail, binding test and/or filtering test report the failure.

After performing the tests above, check the following table to determine if HDX Direct for external users is expected to work based on the NAT behavior and filtering combination:

Client NAT Behavior	Client NAT Filtering	Session Host NAT Behavior	Session Host NAT Filtering	Expected to work?
Endpoint Independent Mapping	Any	Endpoint Independent Mapping	Any	Yes
Endpoint Independent Mapping	Endpoint Independent Filtering	Address Dedependent Mapping	Any	Yes
Endpoint Independent Mapping	Address Dependent Filtering	Address Dedependent Mapping	Any	No
Endpoint Independent Mapping	Address and Port Dependent Filtering	Address Dedependent Mapping	Any	No
Endpoint Independent Mapping	Endpoint Independent Filtering	Address and Port Dedependent Mapping	Endpoint Independent Filtering	Yes
Endpoint Independent Mapping	Address Dependent Filtering	Address Dedependent Mapping	Any	No
Endpoint Independent Mapping	Address and Port Dependent Filtering	Address Dedependent Mapping	Any	No
Address Dependent Mapping	Any	Endpoint Independent Mapping	Endpoint Independent Filtering	Yes
Address Dependent Mapping	Any	Endpoint Independent Mapping	Address Dependent Filtering	No
Address Dependent Mapping	Any	Endpoint Independent Mapping	Address and Port Dependent Filtering	No
Address Dependent Mapping	Any	Address Dependent Mapping	Any	No
Address Dependent Mapping	Any	Address and Port Dependent Mapping	Any	No
Address and Port Dependent Mapping	Any	Endpoint Independent Mapping	Endpoint Independent Filtering	Yes
Address and Port Dependent Mapping	Any	Endpoint Independent Mapping	Address Dependent Filtering	No
Address and Port Dependent Mapping	Any	Endpoint Independent Mapping	Address and Port Dependent Filtering	No
Address and Port Dependent Mapping	Any	Address Dependent Mapping	Any	No
Address and Port Dependent Mapping	Any	Address and Port Dependent Mapping	Any	No
Fail	Any	Any	Any	No
Any	Any	Fail	Any	No
Fail	Any	Fail	Any	No

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

NAT Compatibility

March 4, 2025

Contributed by:

March 4, 2025

Contributed by:

NAT Compatibility

Validations

In this article