Wireless ADSL2+ Modem Router DG834Gv5 User Manual

3-6

Protecting Your Network

v1.0, March 2010

•

To edit an existing rule, select its button on the left side of the table and click

Edit

.

•

To delete an existing rule, select its button on the left side of the table and click

Delete

.

•

To move a rule to a different position in the table, select its button, and then click

Move

. At the

prompt, enter the number of the desired new position, and then click

OK

.

Inbound Rules (Port Forwarding)

Because the

modem router

uses Network Address Translation (NAT), your network presents only

one IP address to the Internet, and outside users cannot directly access any of your local

computers. However, by defining an inbound rule you can make a local server (for example, a Web

server or game server) visible and available to the Internet. The rule tells the modem router to

direct inbound traffic for a particular service to one local server based on the destination port

number. This is also known as port forwarding.

Remember that allowing inbound services opens holes in your firewall. Enable only those ports

that are necessary for your network. Following are two application examples of inbound rules.

Figure 3-4

Note:

Some broadband ISP accounts do not allow you to run any server processes (such

as a Web or FTP server) from your location. Your ISP might periodically check for

servers and might suspend your account if it discovers any active services at your

location. If you are unsure, see the acceptable use policy of your ISP.

Wireless ADSL2+ Modem Router DG834Gv5 User Manual

Protecting Your Network

3-7

v1.0, March 2010

To add an inbound rule:

1.

From the Firewall Rules screen, click

Add

in the Inbound Rules section to display the

following screen:

2.

Either select a service from the

Inbound Services

drop-down list, or select

User Defined

and

create a custom service.

3.

When you are finished, click

Apply

.

The settings are:

•

Service

. From this list, select the application or service to be allowed or blocked. The list

already displays many common services, but you are not limited to these choices. Use the

Services screen to add any additional services or applications that do not already appear.

•

Action

. Select when you want this type of traffic to be handled. You can block or allow

always, or you can choose to block or allow according to the schedule you have defined in the

Schedule screen.

•

Send to LAN Server

. Enter the IP address of the computer or server on your LAN which will

receive the inbound traffic covered by this rule.

•

WAN Users

. These settings determine which packets are covered by the rule, based on their

source (WAN) IP address. Select the option that you want:

–

Any

. All IP addresses are covered by this rule.

–

Address range

. If this option is selected, you must enter the

Start

and

Finish

fields.

–

Single address

. Enter the required address in the

Start

field.

•

Log

. You can select whether the traffic will be logged. The choices are:

Figure 3-5

Wireless ADSL2+ Modem Router DG834Gv5 User Manual

3-8

Protecting Your Network

v1.0, March 2010

–

Never

. No log entries will be made for this service.

–

Always

. Any traffic for this service type will be logged.

–

Match

. Traffic of this type that matches the rule will be logged.

–

Not match

. Traffic of this type that does not match the rule will be logged.

Considerations for Inbound Rules

If your external IP address is assigned dynamically by your ISP, the IP address might change

periodically as the DHCP lease expires. Consider using the Dynamic DNS feature so that external

users can always find your network.

If the IP address of the local server computer is assigned by DHCP, it might change when the

computer is rebooted. To avoid this, use the Reserved IP address feature in the LAN IP menu to

keep the computer’s IP address constant.

Local computers must access the local server using the computer’s local LAN address

(192.168.0.11 in the previous example). Attempts by local computers to access the server using the

external WAN IP address will fail.

Outbound Rules (Service Blocking)

The modem router allows you to block the use of certain Internet services by computers on your

network. This is called service blocking or port filtering. You can define an outbound rule to block

Internet access from a local computer based on the following:

•

IP address of the local computer (source address)

•

IP address of the Internet site being contacted (destination address)

•

Time of day

•

Type of service being requested (service port number)

To add an inbound rule:

1.

From the Firewall Rules screen, click

Add

in the Outbound Rules section to display the

following screen:

Wireless ADSL2+ Modem Router DG834Gv5 User Manual

Protecting Your Network

3-9

v1.0, March 2010

2.

Either select a service from the

Inbound Services

drop-down list, or select

User Defined

and

create a custom service.

3.

When you are finished, click

Apply

.

The Outbound Services screen includes the following fields:

•

Service

. Select the application or service from the drop-down list to be allowed or blocked.

You can use the Add Custom Service feature to add any additional services or applications that

are not in the list; see

“Services”

for details.

•

Action

. Choose when you want this type of traffic to be handled. You can block or allow

always, or you can block or allow according to the schedule defined in the Schedule screen.

•

LAN users

. This setting determine which packets are covered by the rule, based on their

source LAN IP address. Select the desired option:

–

Any

. All IP addresses are covered by this rule.

–

Address range

. If this option is selected, you must fill in the

Start

and

Finish

fields.

–

Single address

. Enter the required address in the Start field.

•

WAN users

. This setting determines which packets are covered by the rule, based on their

destination WAN IP address. Select the option that you want:

–

Any

. All IP addresses are covered by this rule.

–

Address range

. If this option is selected, you must fill in the

Start

and

Finish

fields.

–

Single address

. Enter the required address in the

Start

field.

Figure 3-6

Wireless ADSL2+ Modem Router DG834Gv5 User Manual

3-10

Protecting Your Network

v1.0, March 2010

•

Log

. Select whether the traffic will be logged. The choices are:

–

Never

. No log entries will be made for this service.

–

Always

. Any traffic for this service type will be logged.

–

Match

. Traffic of this type that matches the rule will be logged.

–

Not match

. Traffic of this type that does not match the rule will be logged.

Order of Precedence for Rules

As you define new rules, they are added to the tables in the Firewall Rules screen, as shown:

For any traffic attempting to pass through the firewall, the packet information is subjected to the

rules in the order shown in the rules table, beginning at the top and proceeding to the default rules

at the bottom. In some cases, the order of precedence of two or more rules might be important in

determining the disposition of a packet. The Move button allows you to relocate a defined rule to a

new position in the table.

Services

Services are functions performed by server computers at the request of client computers. For

example, Web servers serve Web pages, time servers serve time and date information, and game

hosts serve data about other players’ moves. When a computer on the Internet sends a request for

service to a server computer, the requested service is identified by a service or port number. This

number appears as the destination port number in the transmitted IP packets. For example, a packet

that is sent with destination port number 80 is an HTTP (Web server) request.

The service numbers for many common protocols are defined by the Internet Engineering Task

Force (IETF) and published in RFC 1700, “Assigned Numbers.” Service numbers for other

applications are typically chosen from the range 1024 to 65535 by the authors of the application.

Figure 3-7