Translate the packet quoted inside an ICMP error
05An Internet Control Message Protocol (ICMP) error contains part of the packet that triggered it. Rewriting only the outer address is insufficient.
Separate malformed input lacks enough quoted bytes to identify a port. The bounded helper stops the local rewrite before assigning an internal destination.
Source for this drawing: RFC 3022 · Read RFC section 4.3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Later UDP NAT guidance says receiving ICMP MUST NOT terminate a mapping. It is related guidance, not a formal update of RFC 3022.
Read the updated RFC section ↗The quoted packet must make sense to the original private sender.
- Section 4.3 describes changes to the outer IP/ICMP headers and the embedded original IP header. The embedded IP address, embedded IP checksum and ICMP checksum need correction.
- For a quoted TCP/UDP or ICMP query in NAPT, the appropriate quoted port or query identifier also needs translation.
- The worked error is ICMP Destination Unreachable quoting an outbound TCP packet. Its first eight transport bytes include the ports but not the TCP checksum field; the helper does not invent absent bytes.
- If a quoted UDP checksum field is present and nonzero, the helper adjusts it for the changed pseudo-header address and port without pretending the full payload was quoted. An original UDP zero checksum remains zero.
- The bounded helper refuses a truncated or mismatching quote rather than guessing a local mapping. This is a local safety guard, not a newly asserted universal NAT discard requirement.
The illustration uses a complete outer IPv4/ICMP error and the original 20-byte IP header plus eight transport bytes. It does not implement every ICMP type, IP option, fragment or malicious-input case, and receiving an error does not delete the mapping. Later UDP-specific guidance in RFC 4787 section 9 explicitly says an ICMP message MUST NOT terminate a NAT mapping.
Read the RFC section ↗