A transparent framework for enabling incoming TCP connections to hosts behind a NAT gateway

This paper proposes a transparent and dynamic system to enable incoming TCP connections to hosts behind a NAT gateway without changes to client applications. We achieve this transparency with a daemon monitoring the gateway and modifications to the TCP/IP stack only on clients that need to receive incoming connections. Thus, we separate the issues of fire walling from address space conservation by allowing multiple hosts to be multiplexed onto a single IP address without affecting bidirectional connectivity.