Security

61

N300 Wireless ADSL2+ Modem Router DGN2200v4

Port Triggering to Open Incoming Ports

Some application servers (such as FTP and IRC servers) send replies to multiple port

numbers. Using the port triggering function of your modem router, you can tell the modem

router to open more incoming ports when a particular outgoing port originates a session.

An example is Internet Relay Chat (IRC). Your computer connects to an IRC server at

destination port 6667. The IRC server not only responds to your originating source port, but

also sends an “identify” message to your computer on port 113. Using port triggering, you can

tell the modem router, “When you initiate a session with destination port 6667, you have to

also allow incoming traffic on port 113 to reach the originating computer.” Using steps similar

to the preceding example, the following sequence shows the effects of the port triggering rule

you have defined:

1.

You open an IRC client program to start a chat session on your computer.

2.

Your IRC client composes a request message to an IRC server using a destination port

number of 6667, the standard port number for an IRC server process. Your computer then

sends this request message to your modem router.

3.

Your modem router creates an entry in its internal session table describing this

communication session between your computer and the IRC server. Your modem router

stores the original information, performs Network Address Translation (NAT) on the source

address and port, and sends this request message through the Internet to the IRC server.

4.

Noting your port triggering rule and having observed the destination port number of 6667,

your modem router creates an additional session entry to send any incoming port 113 traffic

to your computer.

5.

The IRC server sends a return message to your modem router using the NAT-assigned

source port (for example, port 33333) as the destination port. The IRC server also sends an

“identify” message to your modem router with destination port 113.

6.

Upon receiving the incoming message to destination port 33333, your modem router

checks its session table to determine whether there is an active session for port number

33333. Finding an active session, the modem router restores the original address

information replaced by NAT and sends this reply message to your computer.

7.

Upon receiving the incoming message to destination port 113, your modem router checks

its session table and learns that there is an active session for port 113, associated with your

computer. The modem router replaces the message’s destination IP address with your

computer’s IP address and forwards the message to your computer.

8.

When you finish your chat session, your modem router eventually senses a period of

inactivity in the communications. The modem router then removes the session information

from its session table, and incoming traffic is no longer accepted on port numbers 33333 or

113.

To configure port triggering, you need to know which inbound ports the application needs.

Also, you need to know the number of the outbound port that will trigger the opening of the

inbound ports. You can usually determine this information by contacting the publisher of the

application or the relevant user groups or news groups.

Only one computer at a time can use the triggered application.

Security

62

N300 Wireless ADSL2+ Modem Router DGN2200v4

Port Forwarding to Permit External Host

Communications

In both of the preceding examples, your computer initiates an application session with a

server computer on the Internet. However, you might need to allow a client computer on the

Internet to initiate a connection to a server computer on your network. Normally, your modem

router ignores any inbound traffic that is not a response to your own outbound traffic. You can

configure exceptions to this default rule by using the port forwarding feature.

A typical application of port forwarding can be shown by reversing the client-server

relationship from the previous web server example. In this case, a remote computer’s

browser needs to access a web server running on a computer in your local network. Using

port forwarding, you can tell the modem router, “When you receive incoming traffic on port 80

(the standard port number for a web server process), forward it to the local computer at

192.168.0.123.” The following sequence shows the effects of the port forwarding rule you

have defined:

1.

The user of a remote computer opens a browser and requests a web page from

www.example.com, which resolves to the public IP address of your modem router. The

remote computer composes a web page request message with the following destination

information:

Destination address

. The IP address of www.example.com, which is the address of your

modem router.

Destination port number

. 80, which is the standard port number for a web server

process.

The remote computer then sends this request message through the Internet to your

modem router.

2.

Your modem router receives the request message and looks in its rules table for any rules

covering the disposition of incoming port 80 traffic. Your port forwarding rule specifies that

incoming port 80 traffic should be forwarded to local IP address 192.168.0.123. Therefore,

your modem router modifies the destination information in the request message:

The destination address is replaced with 192.168.0.123.

Your modem router then sends this request message to your local network.

3.

Your web server at 192.168.0.123 receives the request and composes a return message

with the requested web page data. Your web server then sends this reply message to your

modem router.

4.

Your modem router performs Network Address Translation (NAT) on the source IP address,

and sends this request message through the Internet to the remote computer, which

displays the web page from www.example.com.

To configure port forwarding, you need to know which inbound ports the application needs.

You usually can determine this information by contacting the publisher of the application or

the relevant user groups or news groups.

Security

63

N300 Wireless ADSL2+ Modem Router DGN2200v4

How Port Forwarding Differs from Port Triggering

The following points summarize the differences between port forwarding and port triggering:

•

Port triggering can be used by any computer on your network, although only one

computer can use it at a time.

•

Port forwarding is configured for a single computer on your network.

•

With port triggering, the modem router does not need to know the computer’s IP address

in advance. The IP address is captured automatically.

•

Port forwarding requires that you specify the computer’s IP address during configuration,

and the IP address can never change.

•

Port triggering requires specific outbound traffic to open the inbound ports, and the

triggered ports are closed after a period of no activity.

•

Port forwarding is always active and does not need to be triggered.

Set Up Port Forwarding to Local Servers

The port forwarding feature lets you allow certain types of incoming traffic to reach servers on

your local network. For example, you might want to make a local web server, FTP server, or

game server visible and available to the Internet.

Use the Port Forwarding/Port Triggering screen to configure the modem router to forward

specific incoming protocols to computers on your local network. In addition to servers for

specific applications, you can also specify a default DMZ server to which all other incoming

protocols are forwarded.

Before you start, determine which type of service, application, or game you want to provide,

and the local IP address of the computer that will provide the service. The server computer

has to always have the same IP address.

To ensure that your server computer always has the same IP address, use the reserved IP

address feature of your product. See

Address Reservation

on page

42.



To forward specific incoming protocols:

1.

Select

Advanced > Advanced Setup > Port Forwarding/Port Triggering

.

Security

64

N300 Wireless ADSL2+ Modem Router DGN2200v4

2.

From the Service Name list, select the service or game that you will host on your network.

If the service does not appear in the list, see

Add a Custom Service

on page

64.

3.

In the Action list, select when you want to allow or block this port forwarding rule.

4.

In the Server IP Address field, enter IP address of your local computer that will receive the

inbound traffic covered by this rule.

5.

In the WAN Servers field, fill in the IP addresses covered by this rule.

6.

In the Log list, select

Never

or

Always

to specify when to log packets covered by this rule.

7.

Click

Add

.

The service appears in the list on the Port Forwarding screen.

Add a Custom Service

To define a service, game, or application that does not appear in the Service Name list, first

determine which port number or range of numbers the application uses. You can usually

determine this information by contacting the publisher of the application or user groups or

news groups. When you have the port number information, follow these steps.



To add a custom service:

1.

Select

Advanced > Advanced Setup > Port Forwarding/Port Triggering

.

2.

Select the

Port Forwarding

radio button as the service type.

3.

Click the

Add Custom Service

button.

4.

In the Name field, enter a descriptive name.

5.

In the Service Type list, select the protocol. If you are unsure, select

TCP/UDP

.

6.

In the External and Internal Starting Port fields, enter the beginning port number.

•

If the service uses only one port, enter the port number in the Ending Port field.

•

If the service uses a range of ports, enter the end port number in the Ending Port field.

7.

In the Internal IP Address field, enter the IP address of your local computer that will provide

this service.

8.

Click

Apply

.

The service appears in the list in the Port Forwarding/Port Triggering screen.

Security

65

N300 Wireless ADSL2+ Modem Router DGN2200v4

Edit or Delete a Port Forwarding Entry



To edit or delete a port forwarding entry:

1.

In the table, select the radio button next to the service name.

2.

Click

Edit Service

or

Delete Service

.

Application Example: Make a Local Web Server Public

If you host a web server on your local network, you can use port forwarding to allow web

requests from anyone on the Internet to reach your web server.



To make a local web server public:

1.

Assign your web server either a fixed IP address or a dynamic IP address using DHCP

address reservation.

In this example, your modem router always gives your web server an IP address of

192.168.0.33.

2.

In the Port Forwarding/Port Triggering screen, configure the modem router to forward the

HTTP service to the local address of your web server at

192.168.0.33

.

HTTP (port 80) is the standard protocol for web servers.

3.

(Optional) Register a host name with a Dynamic DNS service, and configure your modem

router to use the name.

To access your web server from the Internet, a remote user has to know the IP address

that your ISP assigned. However, if you use a Dynamic DNS service, the remote user can

reach your server by a user-friendly Internet name, such as mynetgear.dyndns.org.

Set Up Port Triggering

Port triggering is a dynamic extension of port forwarding that is useful in these cases:

•

More than one local computer needs port forwarding for the same application (but not

simultaneously).

•

An application needs to open incoming ports that are different from the outgoing port.

When port triggering is enabled, the modem router monitors outbound traffic looking for a

specified outbound “trigger” port. When the modem router detects outbound traffic on that

port, it remembers the IP address of the local computer that sent the data. The modem router

then temporarily opens the specified incoming port or ports and forwards incoming traffic on

the triggered ports to the triggering computer.

Port forwarding creates a static mapping of a port number or range to a single local computer.

Port triggering can dynamically open ports to any computer that needs them and can close

the ports when they are no longer needed.