Some protocols don't work well with basic NAT:
FTP (Active Mode):
- Server initiates data connection back to client
- Client advertises private IP in PORT command
- Solution: FTP ALG or passive mode
SIP (VoIP):
- SIP messages contain IP addresses in body
- Solution: SIP ALG, STUN, or Session Border Controllers
IPsec:
- ESP encrypts the transport header
- NAT can't modify encrypted ports
- Solution: NAT-T encapsulates ESP in UDP
Online Gaming:
- Many games use P2P connections
- Solution: STUN/TURN servers, UPnP
ALGs inspect specific protocols and fix embedded addresses.