  In this paper we present the implementation of a WebRTC gateway service that
can forward ad-hoc RTP data plane traffic from a browser on one local network
to a browser on another local network. The advantage compared to the existing
IETF STUN (RFC 5389), TURN (RFC 5766) and ICE (RFC 5245) protocols is that it
does not require a public host and port mapping for each participating local
host, and it works with more restrictive firewall policies. WebRTC implements
ICE which combines STUN and TURN probes to automatically find the best
connection between two peers who want to communicate. In corporate networks,
simple hole punching and NAT traversal techniques typically do not work, e.g.
because of symmetric NATs. Dynamic allocation of ports on an external 3rd party
relay service is also typically blocked on restricted hosts. In our use case,
doctors at hospitals can only access port 80 through the hospital firewall on
external machines, and they need to communicate with patients who are typically
behind a NAT in a local WiFi network. VPN solutions only work for staff but not
between patients and staff. Our solution solves this problem by redirecting all
WebRTC traffic through a gateway service on the local network that has a secure
tunnel established with a public gateway. The public gateway redirects traffic
from multiple concurrent streams securely between local gateway services that
connect to it. The local gateways also communicate with browsers on their local
network to mimic a direct browser-to-browser connection without having to
change the browser runtime. We have demonstrated that this technique works well
within the hospital network and arbitrary patient networks, without the need
for any individual host configuration. In our evaluation we show that the
latency overhead is 18-20 ms for each concurrent stream added to the same
gateway service.
