Configuring A Server/Port Forwarding

(1502 total words in this text)
(15112 Reads)

Adding and configuring a server to run on an EN5861 is a fairly painless operation and can be completed within a few minutes. Port forwarding is also useful for other applications such as remote desktop.

There are many different types of server software around but most popular is that of a web server, this will allow you to host a web site on your local PC using your ADSL connection.

Windows 2000 and XP Pro both come with a version of Microsoft Internet Information Services (IIS) which can be installed and configured to work perfectly easily. A note of caution though is to remember to update to the latest patches and run the MS lockdown tool which should tighten the security somewhat.

Back to the EN5861, this will need configuring to forward all requests (TCP SYN flags) to an IP address on your network. There are two different ways to do this and probably the easiest is using the web interface which is available from firmware v5.3.x onwards.

A small word of warning:- There seems to be a 'bug' if you select ALL as the protocol and sometimes it won't work, it's good practice to just forward only the protocol/s you require. Also it is probably not advisable to use port 0 (redirect all ports) for the same reason.

METHOD 1

Start by pointing your browser to http://192.168.254.254 and logging in with your name (login) and password, then navigate to the Set NAT screen.

Follow the 4 step instructions on the screenshot:-

1. Select the server type.

2. Enter the local IP address of the server.

3. Add the server to the list.

4. reboot.

Now all requests entering the router from the WAN on the specified fort will be forwarded to your local IP address.

As you can see from the screenshot any ports can be forwarded to a local machine, if the server doesn't appear on the drop down menu then you can enter it my manually entering the ports in the Advanced Setup. A useful port to forward is 3389 which is for Terminal Services and Remote Desktop (RDC).

METHOD 2

Another way of setting port forwarding is by the Command Line Interface (CLI), this is handy if you have a BT owned router as you can alter the configuration using a console cable without flashing the firmware.

This is achieved by the command:-

system addServer <action> <protocol> <first port> [<last port> [<first local port>]]

<Action> One of the following command actions:

ipaddr Selects the host with this IP address as server (4 decimals separated by periods).

discard Discards the incoming server request.

me Sends the incoming server request to the local router, regardless of its IP address.

<Protocol> The protocol used by the selected server.

	ftp	FTP port.
	h323	H.323 port.
	http	HTTP port.
	smtp	SMTP port.
	sntp	SNTP port.
	t120	T.120 port.
	telnet	Telnet port.
	tftp	TFTP port.
	tcp	TCP only.
	udp	UDP only.
	all	All protocols.

<First port> The first or only port as seen by the remote end (Port used by the selected server). (A Numeric value between 0 and 65,535. A numeric value of 0 matches any port).

<Last port> The last port in the range of ports as seen by the remote end for the server on the LAN (optional).

<First local port> If specified, this is a port remapping of the incoming request from the remote end (optional).

It is also possible if you have more than one remote interface to use remote addserver with the same syntax:-

remote addServer <action> <protocol> <first port> [<last port> [<first local port>]] <remote name>

Examples

system addserver 192.168.254.1 http Forwards HTTP (80) to 192.168.254.254

system addserver 192.168.254.1 tcp 3389 Forwards TCP port 3389 to 192.168.254.1

system addserver 192.168.254.1 tcp 4990 4999 5001 Forwards TCP ports 4990-4999 to 5001-5010 and to 192.168.254.1

Firewall

Now that NAT is setup to forward incoming packets to a local server there is one possible problem, the firewall!
The firewall configuration will differ between configurations, but on the standard Efficient minsec.txt firewall script you will notice a line:-

remote ipfilter append input drop -p tcp -tcp syn internet

This basically drops ALL TCP connections to the router, so any connection to your server won't even get to the NAT translation/port forwarding!
A line is needed before this to accept TCP, but only on the specified port/s.

remote ipfilter append input accept -tcp syn -dp 80 internet

This will accept TCP to port 80 only, the next line of the script (original line) will then drop all TCP , the effect is then only port 80 will be open.

It's the same with any other ports that have been forwarded, just add them before the original line.

[ Back to EN5861 Information | Sections index ]