IPSEC NAT Traversal Port Activity

Last updated a month ago on 2026-06-24

Created 6 years ago on 2020-02-18

About

This rule detects outbound IPSEC NAT Traversal (NAT-T) tunnels established from an internal host to an external destination. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal encapsulates IPSEC ESP traffic in UDP and, once a NAT device is detected, both peers float to UDP port 4500 for the tunnel data channel. The rule keys on this NAT-T signature, UDP traffic where both the source and destination port are 4500, from an internal source to an external destination, rather than on any UDP traffic to port 4500. This may be common on your network, but this technique is also used by threat actors to tunnel command and control or exfiltration traffic over the Internet to avoid detection.

Tags

Tactic: Command and ControlDomain: EndpointUse Case: Threat DetectionData Source: PAN-OSData Source: Network TrafficData Source: pfSenseData Source: ZeekLanguage: kuery

Severity

low

Risk Score

MITRE ATT&CK™

Command and Control (TA0011)(external, opens in a new tab or window)

↳ Non-Application Layer Protocol (T1095)(external, opens in a new tab or window)

↳ Protocol Tunneling (T1572)(external, opens in a new tab or window)

↳ Encrypted Channel (T1573)(external, opens in a new tab or window)

False Positive Examples

Legitimate site-to-site or client VPNs that use IPSEC NAT Traversal will establish outbound tunnels on UDP port 4500. Where these tunnels are expected, the internal source hosts or external VPN gateway IP addresses can be excluded. Requiring both the source and destination port to be 4500 already removes alerts caused by an external server coincidentally replying to an ephemeral UDP source port of 4500.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type

Query (Kibana Query Language)

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

packetbeat-*auditbeat-*filebeat-*logs-network_traffic.*logs-panw.*logs-pfsense.log-*logs-zeek.*

Related Integrations

network_traffic(external, opens in a new tab or window)

panw(external, opens in a new tab or window)

pfsense(external, opens in a new tab or window)

zeek(external, opens in a new tab or window)

Query

✄𐘗text code block:
✄𐘗(data_stream.dataset: (network_traffic.flow or zeek.connection) or (event.category: (network or network_traffic))) and
  network.transport:udp and source.port:4500 and destination.port:4500 and
  source.ip:(
    10.0.0.0/8 or
    172.16.0.0/12 or
    192.168.0.0/16
  ) and
  not destination.ip:(
    10.0.0.0/8 or
    127.0.0.0/8 or
    169.254.0.0/16 or
    172.16.0.0/12 or
    192.0.0.0/24 or
    192.0.0.0/29 or
    192.0.0.8/32 or
    192.0.0.9/32 or
    192.0.0.10/32 or
    192.0.0.170/32 or
    192.0.0.171/32 or
    192.0.2.0/24 or
    192.31.196.0/24 or
    192.52.193.0/24 or
    192.168.0.0/16 or
    192.88.99.0/24 or
    224.0.0.0/4 or
    100.64.0.0/10 or
    192.175.48.0/24 or
    198.18.0.0/15 or
    198.51.100.0/24 or
    203.0.113.0/24 or
    240.0.0.0/4 or
    "::1" or
    "FE80::/10" or
    "FF00::/8"
  )

Install detection rules in Elastic Security

Detect IPSEC NAT Traversal Port Activity in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).