Advanced Settings

51

WiFi Cable Modem Router C3700

5.

If the wireless computer or device you want displays in the list, click its radio button to

capture its MAC address. Otherwise, type its MAC address. The MAC address is found on

the computer or device.

6.

If no device name displays, type a descriptive name for the computer or device that you are

adding.

7.

Click the

Add

button.

The Wireless Card Access List screen displays.

8.

Click the

Apply

button.

Port Forwarding and Port Triggering

By default, the modem router blocks inbound traffic from the Internet to your computers

except for replies to your outbound traffic. Create exceptions to this rule for these purposes:

•

To allow remote computers on the Internet to access a server on your local network.

•

To allow certain applications and games to work correctly when your modem router does

not recognize their replies.

Your modem router provides two features for creating these exceptions: port forwarding and

port triggering. The next sections provide background information to help you understand

how port forwarding and port triggering work, and the differences between the two.

Remote Computer Access Basics

When a computer on your network accesses a computer on the Internet, your computer

sends your modem router a message containing the source and destination address and

process information. Before forwarding your message to the remote computer, your modem

router must modify the source information and create and track the communication session

so that replies can be routed back to your computer.

Here is an example of normal outbound traffic and the resulting inbound responses:

1.

You open a browser, and your operating system assigns port number 5678 to this

browser session.

2.

You type http://www.example.com into the URL field, and your computer creates a web

page request message with the following address and port information. The request

message is sent to your modem router.

Source address

. The IP address of your computer.

Source port number

. 5678, which is the browser session.

Destination address

. The IP address of www.example.com, which your computer finds

by asking a DNS server.

Destination port number

. 80, which is the standard port number for a web server

process.

Advanced Settings

52

WiFi Cable Modem Router C3700

3.

Your modem router creates an entry in its internal session table describing this

communication session between your computer and the web server at www.example.com.

Before sending the web page request message to www.example.com, your modem router

stores the original information and then modifies the source information in the request

message, performing Network Address Translation (NAT):

•

The source address is replaced with the public IP address of your modem router. This

step is necessary because your computer uses a private IP address that is not

globally unique and cannot be used on the Internet.

•

The source port number is changed to a number that is chosen by the modem router,

such as 33333. This step is necessary because two computers could independently

be using the same session number.

Your modem router then sends this request message through the Internet to the web

server at www.example.com.

4.

The web server at www.example.com composes a return message with the requested web

page data. The return message contains the following address and port information. The

web server then sends this reply message to your modem router.

Source address

. The IP address of www.example.com.

Source port number

. 80, which is the standard port number for a web server process.

Destination address

. The public IP address of your modem router.

Destination port number

. 33333.

5.

Upon receiving the incoming message, your modem router checks its session table to

determine whether there is an active session for port number 33333. Finding an active

session, the modem router then modifies the message to restore the original address

information that is replaced by NAT. Your modem router sends this reply message to your

computer, which displays the web page from www.example.com. The message now

contains the following address and port information.

Source address

. The IP address of www.example.com.

Source port number

. 80, which is the standard port number for a web server process.

Destination address

. The IP address of your computer.

Destination port number

. 5678, which is the browser session that made the initial

request.

6.

When you finish your browser session, your modem router eventually detects a period of

inactivity in the communications. Your modem router then removes the session information

from its session table, and incoming traffic is no longer accepted on port number 33333.

Port Triggering to Open Incoming Ports

In the preceding example, requests are sent to a remote computer by your modem router

from a particular service port number, and replies from the remote computer to your modem

router are directed to that port number. If the remote server sends a reply to a different port

number, your modem router does not recognize it and discards it. However, some application

Advanced Settings

53

WiFi Cable Modem Router C3700

servers (such as FTP and IRC servers) send replies to multiple port numbers. Using the port

triggering function of your modem router, you can tell the modem router to open more

incoming ports when a particular outgoing port originates a session.

An example is Internet Relay Chat (IRC). Your computer connects to an IRC server at

destination port 6667. The IRC server not only responds to your originating source port, but

also sends an “identify” message to your computer on port 113. Using port triggering, you can

tell the modem router, “When you initiate a session with destination port 6667, you must

allow incoming traffic also on port 113 to reach the originating computer.” Using steps similar

to the preceding example, the following sequence shows the effects of the port triggering rule

you have defined:

1.

You open an IRC client program to start a chat session on your computer.

2.

Your IRC client composes a request message to an IRC server using a destination port

number of 6667, the standard port number for an IRC server process. Your computer then

sends this request message to your modem router.

3.

Your modem router creates an entry in its internal session table describing this

communication session between your computer and the IRC server. Your modem router

stores the original information, performs Network Address Translation (NAT) on the source

address and port, and sends this request message through the Internet to the IRC server.

4.

Noting your port triggering rule and having observed the destination port number of 6667,

your modem router creates an additional session entry to send any incoming port 113 traffic

to your computer.

5.

The IRC server sends a return message to your modem router using the NAT-assigned

source port (as in the previous example, say port 33333) as the destination port. The IRC

server also sends an identify message to your modem router with destination port 113.

6.

Upon receiving the incoming message to destination port 33333, your modem router

checks its session table to determine whether there is an active session for port number

33333. Finding an active session, the modem router restores the original address

information that is replaced by NAT and sends this reply message to your computer.

7.

Upon receiving the incoming message to destination port 113, your modem router checks

its session table and learns that there is an active session for port 113, associated with your

computer. The modem router replaces the destination IP address of the message with the

IP address of your computer and forwards the message to your computer.

8.

When you finish your chat session, your modem router eventually senses a period of

inactivity in the communications. The modem router then removes the session information

from its session table, and incoming traffic is no longer accepted on ports 33333 or 113.

To configure port triggering, you need to know which inbound ports the application needs.

Also, you need to know the number of the outbound port that triggers the opening of the

inbound ports. You can usually determine this information by contacting the publisher of the

application or user groups or newsgroups.

Note:

Only one computer at a time can use the triggered application.

Advanced Settings

54

WiFi Cable Modem Router C3700

Port Forwarding to Permit External Host Communications

In both of the preceding examples, your computer initiates an application session with a

server computer on the Internet. However, you need to allow a client computer on the Internet

to initiate a connection to a server computer on your network. Normally, your modem router

ignores any inbound traffic that is not a response to your own outbound traffic. You can

configure exceptions to this default rule by using the port forwarding feature.

A typical application of port forwarding can be shown by reversing the client-server

relationship from the previous web server example. In this case, a browser on a remote

computer accesses a web server running on a computer in your local network. Using port

forwarding, you can tell the modem router, “When you receive incoming traffic on port 80 (the

standard port number for a web server process), forward it to the local computer at

192.168.0.123.” The following sequence shows the effects of the port forwarding rule you

have defined:

1.

The user of a remote computer opens a browser and requests a web page from

www.example.com, which resolves to the public IP address of your modem router. The

remote computer composes a web page request message with the following destination

information:

Destination address

. The IP address of www.example.com, which is the address of your

modem router.

Destination port number

. 80, which is the standard port number for a web server

process.

The remote computer then sends this request message through the Internet to your

modem router.

2.

Your modem router receives the request message and looks in its rules table for any rules

covering the disposition of incoming port 80 traffic. Your port forwarding rule specifies that

incoming port 80 traffic is forwarded to local IP address 192.168.0.123. Therefore, your

modem router modifies the destination information in the request message:

The destination address is replaced with 192.168.0.123.

Your modem router then sends this request message to your local network.

3.

Your web server at 192.168.0.123 receives the request and composes a return message

with the requested web page data. Your web server then sends this reply message to your

modem router.

4.

Your modem router performs Network Address Translation (NAT) on the source IP address,

and sends this request message through the Internet to the remote computer, which

displays the web page from www.example.com.

To configure port forwarding, you need to know which inbound ports the application needs.

Usually you can determine this information by contacting the publisher of the application or

the relevant user groups and newsgroups.

Advanced Settings

55

WiFi Cable Modem Router C3700

How Port Forwarding Differs from Port Triggering

The following points summarize the differences between port forwarding and port triggering:

•

Port triggering is used by any computer on your network, although only one computer can

use it at a time.

•

Port forwarding is configured for a single computer on your network.

•

Port triggering requires specific outbound traffic to open the inbound ports, and the

triggered ports are closed after a period of no activity.

•

Port forwarding is always active and is never triggered.

Set Up Port Forwarding to Local Servers

Using the port forwarding feature, you can allow certain types of incoming traffic to reach

servers on your local network. For example, you want to make a local web server, FTP

server, or game server visible and available to the Internet.

Use the Port Forwarding/Port Triggering screen to configure the modem router to forward

specific incoming protocols to computers on your local network. In addition to servers for

specific applications, you can also specify a default DMZ server to which all other incoming

protocols are forwarded.

Before starting, you determine which type of service, application, or game you want to

provide, and the local IP address of the computer that provides the service. The server

computer always must have the same IP address.



To set up port forwarding:

Tip:

To ensure that your server computer always has the same IP address,

use the reserved IP address feature of your wireless cable gateway.

1.

From the Advanced tab, select

Advanced Setup > Port Forwarding/Port Triggering

.