Manuals / Netopia / Computer Equipment / Network Router

Netopia R910 manual Allowing VPNs through a Firewall, User’s Reference Guide

Models: R910

1 209

Download 209 pages 33.84 Kb

Page 98

10-98 User’s Reference Guide

Allowing VPNs through a Firewall

An administrator interested in securing a network will usually combine the use of VPNs with the use of a ﬁrewall or some similar mechanism. This is because a VPN is not a complete security solution, but rather a component of overall security. Using a VPN will add security to transactions carried over a public network, but a VPN alone will not prevent a public network from inﬁltrating a private network. Therefore, you should combine use of a ﬁrewall with VPNs, where the ﬁrewall will secure the private network from inﬁltration from a public network, and the VPN will secure the transactions that must cross the public network.

A strict ﬁrewall may not be provisioned to allow VPN trafﬁc to pass back and forth as needed. In order to ensure that a ﬁrewall will allow a VPN, certain attributes must be added to the ﬁrewall's provisioning. The provisions necessary vary slightly between ATMP and PPTP, but both protocols operate on the same basic premise: there are control and negotiation operations, and there is the tunnelled trafﬁc that carries the payload of data between the VPN endpoints. The difference is that ATMP uses UDP to handle control and negotiation, while PPTP uses TCP. Then both ATMP and PPTP use GRE to carry the payload.

For PPTP negotiation to work, TCP packets inbound and outbound destined for port 1723 must be allowed. Likewise, for ATMP negotiation to work, UDP packets inbound and outbound destined for port 5150 must be allowed. Source ports are dynamic, so, if possible, make this ﬂexible, too. Additionally, PPTP and ATMP both require a ﬁrewall to allow GRE bi-directionally.

The following sections illustrate a sample ﬁltering setup to allow either PPTP or ATMP trafﬁc to cross a ﬁrewall:

■“PPTP example” on page 10-99

■“ATMP example” on page 10-102

Make your own appropriate substitutions. For more information on ﬁlters and ﬁrewalls, see Chapter 13, “Security.”

Image 98

Netopia R910 manual Allowing VPNs through a Firewall, User’s Reference Guide, “PPTP example” on page “ATMP example” on page

Contents

Netopia R910 Ethernet Router for DSL and Cable Modems User’s Reference GuidePrinted Copies CopyrightPart Number How to use this guide ContentsFeatures and capabilities Chapter 2 - Setting Up Internet ServicesEasy Setup console screens Connecting a console cable to your routerChapter 7 - Easy Setup Accessing the Easy Setup console screensInstalling Dial-Up Networking DHCP NetBIOS OptionsVPN Default Answer Proﬁle Installing the VPN ClientChapter 12 - Monitoring Tools The SNMP Setup screenTelnet access 12-109Appendix A - Troubleshooting Chapter 14 - Utilities and DiagnosticsFactory defaults Conﬁguration problemsAppendix F - Technical Speciﬁcations and Safety Using address servingExported services Power requirementsChapter Introduction Features and capabilities“Features and capabilities” on page “How to use this guide” on page OverviewHow to use this guide 1-10 User’s Reference GuideDeciding on an ISP account Chapter Setting Up Internet ServicesSetting Up Internet Services DSL and cable modemsWith Network Address Translation Local LAN IP address information to obtain2-12 User’s Reference Guide Without Network Address TranslationFind a location “Identify the connectors and attach the cables” on pageChapter Making the Physical Connections Making the Physical Connections3-14 User’s Reference Guide Identify the connectors and attach the cablesWhat you need Making the Physical Connections Netopia R910 Ethernet Router back panel portsyour router” on page 8 9 10 12 13 14 15 16 Netopia R910 Ethernet Router status lights3-16 User’s Reference Guide “Connecting to an Ethernet network” on page Chapter Connecting to Your Local Area NetworkConnecting to Your Local Area Network Network ModelAfter Readying computers on your local network4-18 User’s Reference Guide Connecting to Your Local Area Network Application software TCP/IP stack Ethernet/EtherTalk Driver Your PC4-20 User’s Reference Guide Connecting to an Ethernet network10Base-T The Netopia R910 in a 10Base-T network with a hub Connecting to Your Local Area NetworkThe Netopia R910 in a 10Base-T network 4-22 User’s Reference Guide Conﬁguring TCP/IP Chapter Configuring TCP/IPHardware and operating system requirements “Hardware and operating system requirements” on pageDynamic conﬁguration recommended Conﬁguring TCP/IP on Windows 95 or5-24 User’s Reference Guide Static conﬁguration optional Conﬁguring TCP/IPDynamic conﬁguration recommended Conﬁguring TCP/IP on a Macintosh Computer5-26 User’s Reference Guide 1. Go to the Apple menu. Select Conﬁguring TCP/IPStatic conﬁguration optional Dynamic conﬁguration using MacIP optional 5-28 User’s Reference GuideConﬁguring TCP/IP 5-30 User’s Reference Guide Chapter Console-Based Management “Connecting through a Telnet session” on page“Connecting a console cable to your router” on page Console-Based Management6-32 User’s Reference Guide Connecting through a Telnet sessionUpgrade feature set. See “Upgrade feature set” on page Filter sets ﬁrewalls. See “About ﬁlters and ﬁlter sets” on pageConsole-Based Management Connecting a console cable to your routerConﬁguring Telnet software Navigating through the console screens 6-34 User’s Reference GuideAccessing the Easy Setup console screens Chapter Easy SetupEasy Setup console screens Easy SetupSee Appendix A, “Troubleshooting,” for more suggestions 7-36 User’s Reference GuideIf your ISP doesn’t support DHCP Quick Easy Setup connection pathIf your ISP supports DHCP Easy SetupFor more Easy Setup options see “More Easy Setup options” on page 7-38 User’s Reference GuideEasy Setup More Easy Setup optionsWAN Ethernet Conﬁguration IP Easy Setup 7-40 User’s Reference GuideEasy Setup Security Conﬁguration Easy Setup1. Select RESTART DEVICE. A prompt asks you to conﬁrm your choice 7-42 User’s Reference GuideEasy Setup is now complete WAN conﬁguration Chapter WAN and System Configuration“System conﬁguration features” on page WAN and System ConﬁgurationSystem conﬁguration screens 8-44 User’s Reference GuideNavigating through the system conﬁguration screens WAN and System ConﬁgurationSystem conﬁguration features 8-46 User’s Reference GuideIP address serving IP setupFilter sets ﬁrewalls Date and timeSNMP Simple Network Management Protocol Upgrade feature setConsole conﬁguration SecurityLogging WAN and System ConﬁgurationInstalling the Syslog client 8-50 User’s Reference GuideIP Setup and Network Address Translation Chapter IP Setup and Network Address TranslationNetwork Address Translation features “Network Address Translation features” on pageor corporate intranet router 9-52 User’s Reference GuideHOW NAT WORKS With NAT ISP 163.167.132.1 Without NAT 192.168.1.100 192.168.1.102 192.168.1.103 192.168.1.104 192.168.1.105IP Setup and Network Address Translation Using Network Address TranslationNote See “Associating port numbers with nodes” on page 9-54 User’s Reference Guide IP Setup and Network Address Translation Associating port numbers with nodesNetwork Address Translation guideline 9-56 User’s Reference Guide IP setupIP Setup and Network Address Translation CANCEL 9-58 User’s Reference GuideSelect Add Export. The Add Exported Service screen appears Exports, Add Export, and Delete ExportIP Setup and Network Address Translation Select Service. A pop-up menu of services and ports appearsIP subnets 9-60 User’s Reference GuideIP Setup and Network Address Translation For examplepage Static routes9-62 User’s Reference Guide Viewing static routes IP Setup and Network Address Translation9-64 User’s Reference Guide Adding a static routeDeleting a static route Rules of static route installationModifying a static route IP Setup and Network Address TranslationIP address serving 9-66 User’s Reference GuideServe DHCP Clients Serve BootP Clients Serve Dynamic WAN Clients IP Setup and Network Address Translation Follow these steps to conﬁgure IP Address ServingIP Address Pools 9-68 User’s Reference GuideIP Setup and Network Address Translation Numerous factors inﬂuence the choice of served address. It is difﬁcult to specify the address that will be served to a particular client in all circumstances. However, when the address server has been conﬁgured, and the clients involved have no prior address serving interactions, the Netopia R910 will generally serve the ﬁrst unused address from the ﬁrst address pool with an available address. The Netopia R910 starts from the pool on the ﬁrst row and continues to the pool on the last row of this screenDHCP NetBIOS Options 9-70 User’s Reference GuideIP Setup and Network Address Translation You have ﬁnished your IP setup 9-72 User’s Reference GuideSelect Release BootP Leases and press Return Chapter Virtual Private Networks VPN “VPN Default Answer Proﬁle” on page “VPN QuickView” on page“Installing the VPN Client” on page “About ATMP Tunnels” on page Virtual Private Networks VPN10-74 User’s Reference Guide Transi t In t ern etwor kSummary “About PPTP Tunnels” on page “About IPsec Tunnels” on page“About ATMP Tunnels” on page Virtual Private Networks VPN10-76 User’s Reference Guide PPTP configurationAbout PPTP Tunnels Note Proﬁles using PPTP do not offer a Telco Options screen Virtual Private Networks VPN10-78 User’s Reference Guide Virtual Private Networks VPN Encryption SupportMS-CHAP V2 and strong encryption 10-80 User’s Reference Guide ConfigurationAbout IPsec Tunnels Virtual Private Networks VPN The Add Connection Proﬁle screen appears10-82 User’s Reference Guide IP Profile Parameters Virtual Private Networks VPNAdvanced IP Profile Options 10-84 User’s Reference GuideVPN Default Answer Profile Virtual Private Networks VPN10-86 User’s Reference Guide Interoperation with other featuresVPN QuickView Virtual Private Networks VPN Proﬁle Name Lists the name of the Connection Proﬁle being used, if any10-88 User’s Reference Guide Installing Dial-Up NetworkingDial-Up Networking for VPN Creating a new Dial-Up Networking profile Virtual Private Networks VPNConfiguring a Dial-Up Networking profile 10-90 User’s Reference Guide4. Click the TCP/IP Settings button Virtual Private Networks VPNWindows 98 VPN installation Installing the VPN ClientWindows 95 VPN installation 10-92 User’s Reference GuideConnecting using Dial-Up Networking Virtual Private Networks VPN10-94 User’s Reference Guide ATMP configurationAbout ATMP Tunnels Note Proﬁles using ATMP do not offer a Telco Options screen Virtual Private Networks VPN10-96 User’s Reference Guide Virtual Private Networks VPN “PPTP example” on page “ATMP example” on page Allowing VPNs through a Firewall10-98 User’s Reference Guide Display/Change Input Filter screen PPTP exampleVirtual Private Networks VPN 10-100 User’s Reference Guide 0.0.0.0 Virtual Private Networks VPN0.0.0.0 0.0.0.0ATMP example 10-102 User’s Reference GuideVirtual Private Networks VPN 0.0.0.0 10-104 User’s Reference Guide0.0.0.0 0.0.0.0Chapter PPP over Ethernet PPP over Ethernet11-106 User’s Reference Guide The Netopia R910 offers the ability for PPP to reconﬁgure the router’s Ethernet LAN when establishing an unnumbered, non-NAT connection PPP Ethernet LAN ReconfigurationConfiguration PPP over EthernetQuick View 11-108 User’s Reference GuideMonitoring Tools Chapter Monitoring ToolsQuick View status overview “Quick View status overview” on page “Statistics & Logs” on page12-110 User’s Reference Guide General statusStatus lights Monitoring Tools Statistics & LogsGeneral Statistics Physical Interface Event histories12-112 User’s Reference Guide Network InterfaceMonitoring Tools WAN Event HistoryDevice Event History Routing tables 12-114 User’s Reference GuideIP routing table Monitoring ToolsServed IP Addresses 12-116 User’s Reference GuideSystem Information Monitoring Tools12-118 User’s Reference Guide The SNMP Setup screenSNMP Monitoring Tools SNMP trapsCommunity strings Viewing IP trap receivers Setting the IP trap receivers12-120 User’s Reference Guide Modifying IP trap receiversDeleting IP trap receivers Monitoring Tools12-122 User’s Reference Guide Suggested security measures “Telnet access” on page “About ﬁlters and ﬁlter sets” on pageChapter Security User accountsProtecting the conﬁguration screens 13-124 User’s Reference GuideProtecting the Security Options screen Telnet access SecurityHow ﬁlter sets work About ﬁlters and ﬁlter setsWhat’s a ﬁlter and what’s a ﬁlter set? 13-126 User’s Reference Guidepacket first filter match? Filter prioritySecurity send to next filter yes pass or discard? discard delete passA ﬁlter’s actions How individual ﬁlters work13-128 User’s Reference Guide A ﬁltering rulePort number comparisons Parts of a ﬁlterPort numbers SecurityPutting the parts together 13-130 User’s Reference GuideOther ﬁlter attributes Filtering example #1 SecurityFiltering example #2 Design guidelines13-132 User’s Reference Guide Disadvantages of ﬁlters An approach to using ﬁltersWorking with IP ﬁlters and ﬁlter sets SecurityAdding a ﬁlter set 13-134 User’s Reference GuideNaming a new ﬁlter set SecurityAdding ﬁlters to a ﬁlter set 13-136 User’s Reference GuideInput and output ﬁlters-source and destination 1. To make the ﬁlter active in the ﬁlter set, select Enabled and toggle it to Yes. If Enabled is toggled to No, the ﬁlter can still exist in the ﬁlter set, but it will have no effect SecurityViewing ﬁlters Viewing ﬁlter sets13-138 User’s Reference Guide Modifying ﬁltersA sample IP ﬁlter set Modifying ﬁlter setsDeleting a ﬁlter set Security13-140 User’s Reference Guide Possible modiﬁcations Security13-142 User’s Reference Guide Basic protocol types Firewall tutorial General ﬁrewall termsBasic IP packet components SecurityExample TCP/UDP Ports Firewall design rules13-144 User’s Reference Guide Firewall LogicImplied rules Binary representationLogical AND function SecurityEstablished connections Filter basics13-146 User’s Reference Guide Example IP ﬁlter set screenNetopia Example ﬁltersIncoming Packet Filter InternetExample 13-148 User’s Reference GuideExample Example SecurityExample 13-150 User’s Reference Guide Security RADIUS client configurationRADIUS Client Support RADIUS then Local 13-152 User’s Reference GuideRADIUS Server Authentication Port Local then RADIUSAdvanced Security Options be unable to configure this device unless a Radius Server isSecurity 13-154 User’s Reference Guide “Factory defaults” on page Chapter Utilities and DiagnosticsUtilities and Diagnostics “Ping” on page “Trace Route” on page “Telnet client” on pagePing 14-156 User’s Reference GuideUtilities and Diagnostics Trace Route 14-158 User’s Reference GuideTelnet client Utilities and DiagnosticsTransferring conﬁguration and ﬁrmware ﬁles with TFTP Factory defaultsDisconnect Telnet console session 14-160 User’s Reference GuideGET WAN MODULE FIRMWARE FROM SERVER Config File Name Updating ﬁrmwareUtilities and Diagnostics GET CONFIG FROM SERVER SEND CONFIG TO SERVERDownloading conﬁguration ﬁles 14-162 User’s Reference GuideUtilities and Diagnostics Uploading conﬁguration ﬁlesTransferring conﬁguration and ﬁrmware ﬁles with XMODEM 14-164 User’s Reference Guide Updating ﬁrmwareUploading conﬁguration ﬁles Utilities and DiagnosticsDownloading conﬁguration ﬁles Restarting the system 14-166 User’s Reference GuideTroubleshooting A-167 Appendix A TroubleshootingConﬁguration problems “Conﬁguration problems” on page A-167Problems communicating with remote IP hosts Console connection problemsNetwork problems Local routing problemsReset Switch Slot How to reset the router to factory defaultsPower outages Troubleshooting A-169A-170 User’s Reference Guide How to reach usTechnical support Before contacting NetopiaOnline Technical Support Troubleshooting A-171Online product information A-172 User’s Reference Guide Appendix B Understanding IP Addressing What is IP?“What is IP?” on page B-173 “About IP addressing” on page B-173 About IP addressingSubnets and subnet masks B-174 User’s Reference GuideSubnet masks Example Using subnets on a Class C IP internetUnderstanding IP Addressing B-175 Customer Site A B-176 User’s Reference GuideNetwork conﬁguration ISP NetworkUnderstanding IP Addressing B-177 Example Working with a Class C subnetDistributing IP addresses BackgroundTechnical note on subnet masking B-178 User’s Reference GuideUnderstanding IP Addressing B-179 Netopia R910 DHCP server characteristicsConﬁguration DHCP address servingTips and rules for distributing IP addresses Using address servingManually distributing IP addresses B-180 User’s Reference GuideUnderstanding IP Addressing B-181 A DHCP example Nested IP subnetsB-182 User’s Reference Guide Understanding IP Addressing B-183 InternetB-184 User’s Reference Guide Understanding IP Addressing B-185 BroadcastsPacket header types B-186 User’s Reference Guide Background Appendix C Understanding Netopia NAT BehaviorNetwork conﬁguration ISP NetworkC-188 User’s Reference Guide Understanding Netopia NAT Behavior C-189 Workstation AC-190 User’s Reference Guide WorkstationsExported services Understanding Netopia NAT Behavior C-191Important notes C-192 User’s Reference GuideUnderstanding Netopia NAT Behavior C-193 ConﬁgurationSummary C-194 User’s Reference GuideAppendix D Binary Conversion Table Binary Conversion Table D-195Binary D-196 User’s Reference GuideDecimal DecimalAppendix E Further Reading Further Reading E-197E-198 User’s Reference Guide Further Reading E-199 E-200 User’s Reference Guide Technical Speciﬁcations and Safety Information F-201 Appendix F Technical Specifications and Safety InformationPower requirements DescriptionDeclaration for Canadian users Regulatory noticesF-202 User’s Reference Guide Telecommunication installation cautions Important safety instructionsTechnical Speciﬁcations and Safety Information F-203 BatteryF-204 User’s Reference Guide Index-205 IndexNumerics Index-206 Index-207 13-131 Index-208Index-209