Netgear FVS338 Reference Guide

ProSafe VPN Firewall 50
FVS338 Reference
Manual

NETGEAR, Inc.

350 East Plumeria Drive
San Jose, CA 95134

202-10046-09
v1.0
January 2010

© 2006–2010 by NETGEAR, Inc.. All rights reserved.

Technical Support

Please refer to the support information card that shipped with your product. By registering your product at

http://www.netgear.com/register, we can provide you with faster expert technical support and timely notices of product

and software upgrades.
NETGEAR, Inc. Support Information
Phone: 1-888-NETGEAR, for US & Canada only. For other countries, see your Support information card.
E-mail: [e-mail]
North American NETGEAR website: http://www.netgear.com

Trademarks

NETGEAR, the NETGEAR logo and ProSafe are trademarks and/or registered trademarks of NETGEAR, Inc.
Microsoft, Windows, and Windows NT ar e registered trademarks of Microsoft Corporation. Other brand and product
names are registered trademarks or trademarks of their respective holders.

Statement of Conditions

In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to
make changes to the products described in this document without notice.

NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit
layout(s) described herein.

Federal Communications Commission (FCC) Compliance Notice: Radio Frequency
Notice

This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to
part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a
residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and
used in accordance with the instruct ions, may cause harmf ul interference to radio communications. However, there is no
guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to
radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try
to correct the interference by one or more of the following measures:

• Reorient or relocate the receiving antenna.

• Increase the separation between the equipment and receiver.

• Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.

• Consult the dealer or an experienced radio/TV technician for help.

EU Regulatory Compliance Statement

The ProSafe VPN Firewall 50 is compliant with the following EU Council Directives: 89/336/EEC and LVD 73/23/
EEC. Compliance is verified by testing to the following standards: EN55022 Class B, EN55024 and EN60950-1.

ii

v1.0, January 2010

Bestätigung des Herstellers/Importeurs

Es wird hiermit bestätigt, daß das ProSafe VPN Firewall 50 gemäß der im BMPT -AmtsblVfg 243/1991 und Vfg 46/1992
aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte (z.B. Testsender) kann jedoch
gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung.

Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt
gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.

Certificate of the Manufacturer/Importer

It is hereby certified that the ProSafe VPN Firewall 50 has been suppressed in accordance with the conditions set out in
the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test transmitters) in
accordance with the regulations may, however , be subject to certain restricti ons. Plea se refer to the notes in the operating
instructions.

Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market
and has been granted the right to test the series for compliance with the regulations.

Voluntary Control Council for Interference (VCCI) Statement

This equipment is in the second category (information equipment to be used in a residential area or an adjacent area
thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing
Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas.

When used near a radio or TV receiver , it may become the cause of radio interference.
Read instructions for correct handling.

Additional Copyrights

AES Copyright (c) 2001, Dr. Brian Gladman, [e-mail], Worcester, UK.

All rights reserved.
TERMS
Redistribution and use in source and binary forms, with or without modification, are permitted
subject to the following conditions:

1. Redistributions of source code must retain the above copyright notice, this list of
conditions, and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions, and the following disclaimer in the documentation and/or other materials
provided with the distribution.

3. The copyright holder’s name must not be used to endorse or promote any products
derived from this software without his specific prior written permission.

This software is provided “as is” with no express or implied warranties of correctness or fitness
for purpose.

v1.0, January 2010

iii

Open SSL Copyright (c) 1998–2000 The OpenSSL Project. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted
provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of
conditions, and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions, and the following disclaimer in the documentation and/or other materials
provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the
following acknowledgment: “This product includes software developed by the OpenSSL
Project for use in the OpenSSL Toolkit (

4. The names “OpenSSL Toolkit” and “OpenSSL Project” must not be used to endorse or
promote products derived from this software without prior written permission. For written
permission, contact [e-mail].

5. Products derived from this software may not be called “OpenSSL” nor may “OpenSSL”
appear in their names without prior written permission of the OpenSSL Project.

6. Redistributions of any form whatsoever must retain the following acknowledgment: “This
product includes software developed by the OpenSSL Project for use in the OpenSSL
Toolkit (

THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT “AS IS,” AND ANY
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This product includes cryptographic software written by Eric Young ([e-mail]). This
product includes software written by Tim Hudson ([e-mail]).

MD5 Copyright (C) 1990, RSA Data Security, Inc. All rights reserved.

License to copy and use this software is granted provided that it is identified as the “RSA Data
Security, Inc. MD5 Message-Digest Algorithm” in all material mentioning or referencing this
software or this function. License is also granted to make and use derivative works provided
that such works are identified as “derived from the RSA Data Security, Inc. MD5 Message­Digest Algorithm” in all material mentioning or referencing the derived work.
RSA Data Security, Inc. makes no representations concerning either the merchantability of
this software or the suitability of this software for any particular purpose. It is provided “as is”
without express or implied warranty of any kind.
These notices must be retained in any copies of any part of this documentation and/or
software.

http://www.openssl.org/).”

http://www.openssl.org/).”

iv

v1.0, January 2010

PPP Copyright (c) 1989 Carnegie Mellon University. All rights reserved.

Redistribution and use in source and binary forms are permitted provided that the above
copyright notice and this paragraph are duplicated in all such forms and that any
documentation, advertising materials, and other materials related to such distribution and use
acknowledge that the software was developed by Carnegie Mellon University. The name of
the University may not be used to endor se or promote products derived from thi s software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED “AS IS” AND WITHOUT ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Zlib zlib.h. Interface of the zlib general purpose compression library version 1.1.4, March 11th,

2002. Copyright (C) 1995–2002 Jean-loup Gailly and Mark Adler.

This software is provided “as is,” without any express or implied warranty. In no event will the
authors be held liable for any damages arising from the use of this software. Permission is
granted to anyone to use this software for any purpose, including commercial applications,
and to alter it and redistribute it freely, subject to the following restrictions:

1. The origin of this software must not be misrepresented; you must not claim that you wrote
the original software. If you use this software in a product, an acknowledgment in the
product documentation would be appreciated but is not required.

2. Altered source versions must be plainly marked as such, and must not be misrepresented
as being the original software.

3. This notice may not be removed or altered from any source distribution.

Jean-loup Gailly: [e-mail]; Mark Adler: madler@alu mni.caltech.edu.
The data format used by the zlib library is described by RFCs (Request for Comments) 1950
to 1952 in the files
format), and rfc1952.txt (gzip format).

ftp://ds.internic.net/rfc/rfc1950.txt (zlib format), rfc1951.txt (deflate

Product and Publication Details

Model Number: FVS338
Publication Date: January 2010
Product Family: VPN firewall
Product Name: ProSafe VPN Firewall 50
Home or Business Product: Business
Language: English
Publication Part Number: 202-10046-09
Publication Version Number 1.0

v1.0, January 2010

v

vi

v1.0, January 2010

Contents

ProSafe VPN Firewall 50 FVS338 Reference Manual

About This Manual

Conventions, Formats and Scope ...................................................................................xiii

How to Print This Manual ................................................................................................xiv

Revision History ..................... ... .......................................... ... ..........................................xiv

Chapter 1
Introduction

Key Features ..................................................................................................................1-1

Full Routing on Both the Broadband and Serial WAN Ports ....................................1-2

A Powerful, True Firewall with Content Filtering ......................................................1-2

Security ....................................................................................................................1-3

Autosensing Ethernet Connections with Auto Uplink ...............................................1-3

Extensive Protocol Support ......................................................................................1-3

Easy Installation and Management ..........................................................................1-4

Maintenance and Support ...................... ... ... ... ... .... ... ... ... .... ...... ... .... ... ... ... ... .... ... ... ..1-5

Package Contents ..........................................................................................................1-5

VPN Firewall Hardware Components .................................... .... ... ... ... .... ... ...... ... .... ... ... ..1-5

Front Panel ...............................................................................................................1-6

Rear Panel ...............................................................................................................1-7

Factory Default Login .....................................................................................................1-8

Chapter 2
Connecting the VPN Firewall to the Internet

Understanding the Connection Steps .............................................................................2-1

Logging in to the VPN Firewall .............................. ... .... ... ... ... .... .....................................2-2

Navigating the Menus .....................................................................................................2-3

Configuring your Internet Connection .............................................................................2-3

Manually Configuring Your Broadband Internet Connection ...........................................2-9

Configuring the WAN Mode ..........................................................................................2-11

Configuring Dynamic DNS (Optional) ...........................................................................2-14

v1.0, January 2010

vii

ProSafe VPN Firewall 50 FVS338 Reference Manual

Configuring Advanced WAN Options (Optional) ...........................................................2-16

Additional WAN Related Configuration ..................................................................2-18

Chapter 3
LAN Configuration

Choosing the VPN Firewall DHCP Options ....................................................................3-1

Configuring the LAN Setup Options ...............................................................................3-2

Managing Groups and Hosts ........................................... ... ... .... ... ... ... .... ... ... ... ... .... ... ... ..3-6

Creating the Network Database ......... .......................................... ............................3-6

Viewing the Network Database ................................................................................3-7

Adding Devices to the Network Database ................................................................3-8

Changing Group Names in the LAN Groups Database ...........................................3-9

Setting Up DHCP Address Reservation ...................................................................3-9

Configuring Multi-Home LAN IPs Addresses ................................................................3-10

Configuring Static Routes .............................................................................................3-11

Static Route Example .............................................................................................3-13

Configuring Routing Information Protocol (RIP) ........................... ... ... .... ... ... ...... .... ... ...3-14

Chapter 4
Firewall Protection and Content Filtering

About Firewall Security and Content Filtering ................................................................4-1

Using Rules to Block or Allow Specific Kinds of Traffic ..................................................4-2

Services-Based Rules .. .......................................... ... .......................................... .....4-2

Viewing the Firewall Rules .......................................................................................4-7

Order of Precedence for Firewall Rules ...................................................................4-8

Setting the Default Outbound Policy ............................................ .... ... ... ... ... .... ... ... ..4-8

Creating a LAN WAN Outbound Services Rule .......................................................4-8

Creating a LAN WAN Inbound Services Rule ..........................................................4-9

Modifying Rules ......................................................................................................4-10

Inbound Rules Examples .......................................................................................4-11

Outbound Rules Example: Blocking Instant Messenger ........................................4-14

Configuring Other Firewall Features .............................................................................4-15

Attack Checks ................................. ... .... ... ... .......................................... ................4-15

Configuring Session Limits .....................................................................................4-17

Managing the Application Level Gateway for SIP Sessions ..................................4-19

Creating Services, QoS Profiles, and Bandwidth Profiles ............................................4-20

Adding Customized Services .................................................................................4-20

viii Contents

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Specifying Quality of Service (QoS) Priorities ........................................ ... ... ....... ...4-22

Creating Bandwidth Profiles ...... ... ... ... ....................................................................4-23

Setting a Schedule to Block or Allow Specific Traffic ....................... ... .... ... ... ... ... ..........4-25

Blocking Internet Sites (Content Filtering) ....................................................................4-26

Configuring Source MAC Filtering ................................................................................4-29

Configuring IP/MAC Address Binding ...........................................................................4-31

Configuring Port Triggering ...........................................................................................4-33

E-Mail Notifications of Event Logs and Alerts ......................................... ......................4-36

Administrator Tips .........................................................................................................4-36

Chapter 5
Virtual Private Networking

Considerations for Dual WAN Port Systems ..................................................................5-1

Using the VPN Wizard for Client and Gateway Configurations ...................................... 5-2

Creating Gateway to Gateway VPN Tunnels with the Wizard .................................5-2

Creating a Client to Gateway VPN Tunnel ...............................................................5-6

Testing the Connections and Viewing Status Information ....................... ...................... 5-12

NETGEAR VPN Client Status and Log Information ............................................... 5-12

VPN Firewall VPN Connection Status and Logs .... ... ... ... .... ... ...... .... ... ... ... ... .... ... ...5-14

Managing VPN Policies ...... .......................................... ... .......................................... ...5-15

Configuring IKE Policies ............................... .......................................... ... .............5-16

Configuring VPN Policies .......................................................................................5-18

Managing Certificates ......................... ... ... .......................................... ..........................5-19

Viewing and Loading CA Certificates .....................................................................5-21

Viewing Active Self Certificates ..............................................................................5-22

Obtaining a Self Certificate from a Certificate Authority ......................... ... ... .... ...... 5-22

Managing your Certificate Revocation List (CRL) .. ... ... ..........................................5-25

Extended Authentication (XAUTH) Configuration ............................ ................... ..........5-26

Configuring XAUTH for VPN Clients ......................................................................5-27

User Database Configuration .... ... ... .......................................... .............................5-29

RADIUS Client Configuration .................................................................................5-30

Assigning IP Addresses to Remote Users (ModeConfig) .............................................5-32

ModeConfig Operation ...........................................................................................5-32

Configuring Mode Config Operation on the VPN Firewall ......................................5-33

Configuring the ProSafe VPN Client for ModeConfig ....................................... ......5-38

Configuring Keepalives and Dead Peer Detection .......................................................5-42

Contents ix

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Configuring Keepalives ..........................................................................................5-42

Configuring Dead Peer Detection ..........................................................................5-43

Configuring NetBIOS Bridging with VPN ......................................................................5-44

Chapter 6
VPN Firewall and Network Management

Performance Management ................................................. ... .... ... ... ...............................6-1

Bandwidth Capacity . .... ... .......................................... ... .......................................... ..6-1

VPN Firewall Features That Reduce Traffic .............................................................6-2

VPN Firewall Features That Increase Traffic ...........................................................6-4

Using QoS to Shift the Traffic Mix ............................................................................6-7

Tools for Traffic Management ................................. ... ... ... .... ... ... ...............................6-7

Configuring Users, Administrative Settings, and Remote Management .........................6-7

Changing Passwords and Settings ..........................................................................6-8

Adding External Users ....... ... .... ... ... .......................................... ... ............................6-9

Configuring an External Server for Authentication ................. ................................6-10

Enabling Remote Management Access .................................................................6-14

Using an SNMP Manager ......................................................................................6-16

Managing the Configuration File ............................................................................6-18

Configuring Date and Time Service .......................................................................6-21

Monitoring System Performance .............................. .... ... ... ... .... ... ... ... .... ...... ... ... .... ... ...6-23

Activating Notification of Events and Alerts ............................................................6-23

Viewing the Logs ....................................................................................................6-26

Enabling the Traffic Meter ......................................................................................6-27

Viewing the Router Configuration and System Status ...........................................6-30

Monitoring VPN Firewall Statistics ............................ ... ... .... ...................................6-32

Monitoring WAN Ports Status ................. ... ... .......................................... ... .............6-33

Monitoring Attached Devices ....... ... ... .... ... .............................................................6-34

Monitoring VPN Tunnel Connection Status ............................... ... .... ... ... ... ....... ... ...6-35

Viewing the VPN Logs ...........................................................................................6-36

Viewing the DHCP Log ..........................................................................................6-37

Viewing Port Triggering Status ...............................................................................6-37

Chapter 7
Troubleshooting

Basic Functions ..............................................................................................................7-1

Power LED Not On ...................................................................................................7-2

x Contents

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

LEDs Never Turn Off ................................................................................................7-2

LAN or Internet Port LEDs Not On ............ .......................................... ... ..................7-2

Troubleshooting the Web Configuration Interface ..........................................................7-3

Troubleshooting the ISP Connection ..............................................................................7-4

Troubleshooting a TCP/IP Network Using a Ping Utility .................................................7-5

Testing the LAN Path to Your VPN Firewall .............................................................7-5

Testing the Path from Your PC to a Remote Device ................................................7-6

Restoring the Default Configuration and Password ............... .... ... ... ... .... ... ... ... ... ....... ... ..7-7

Problems with Date and Time .........................................................................................7-7

Performing Diagnostics ...................................... ... ... .... ... ... ... .........................................7-8

Appendix A
Default Settings and Technical Specifications

Appendix B
System Logs and Error Messages

System Log Messages .................................................................................................. B-1

System Startup ............................. ... ... .... ... .......................................... ... ................. B-1

Reboot ....................................... .......................................... ... ................................. B-2

NTP .................................... ................................................................. .................... B-2

Login/Logout ........................................................................................................... B-3

VPN Firewall Restart .......................................... .... .......................................... ....... B-3

IPSec Restart ........... .......................................... .... .......................................... ... .... B-4

WAN Status ..................... .......................................... ... .......................................... . B-4

Web Filtering and Content Filtering Logs ................................................................ B-7

Traffic Metering Logs ................................................................. ... .... ... ... ... ... ........... B-8

Unicast Logs ......... ... .... ... .......................................... ... .......................................... . B-8

FTP Logging ................................. .......................................... ... .............................. B-9

Invalid Packet Logging .......... .... ... .......................................... ............................... B-10

Routing Logs ............................................................................................................... B-12

LAN to WAN Logs ................................................................................................. B-13

WAN to LAN Logs ................................................................................................. B-13

Appendix C
Two Factor Authentication

Why do I need Two-Factor Authentication? ...................................................................C-1

What are the benefits of Two-Factor Authentication? ............................................. C-1

What is Two-Factor Authentication ......................................................................... C-2

Contents xi

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

NETGEAR Two-Factor Authentication Solutions ....................................................... .... C-2

Appendix D
Related Documents

Index

xii Contents

v1.0, January 2010

About This Manual

The NETGEAR® Pr oSafe™ VPN Firewall 50 FVS338 Reference Manual describes how to install,
configure and troubleshoot the ProSafe VPN Firewall 50. The information in this manual is
intended for readers with intermediate computer and Internet skills.

Conventions, Formats and Scope

The conventions, formats, and scope of this manual are described in the following paragraphs.

• Typographical Conventions. This manual uses the following typographical conventions.

Italics Emphasis, books, CDs, file and server names, extensions

Bold User input, IP addresses, GUI screen text

Fixed Command prompt, CLI text, code

italics URL links

• Formats. This manual uses the following formats to highlight special messages:

Note: This format is used to highlight information of importance or special interest.

Tip: This format is used to highlight a procedure that will save time or resources.

Warning: Ignoring this type of note may result in a malfunction or damage to the

equipment.

Danger: This is a safety warning. Failure to take heed of this notice may result in

personal injury or death.

v1.0, January 2010

xiii

ProSafe VPN Firewall 50 FVS338 Reference Manual

• Scope. This manual is written for the VPN firewall according to these specifications:

Product Version ProSafe VPN Firewall 50
Manual Publication Date January 2010

For more information about network, Internet, firewall, and VPN technologies, see the links to the
NETGEAR website in Appendix D, “Related Documents.

”

Note: Updates to this product are available on the NETGEAR, Inc. website at

http://kb.netgear.com/app/home.

How to Print This Manual

T o print this manual, your computer must have the free Adobe Acrobat reader installed in order to
view and print PDF files. The Acrobat reader is available on the Adobe websit e at

http://www.adobe.com.

Tip: If your printer supports printing two pages on a single sheet of paper, you can

save paper and printer ink by selecting this feature.

Revision History

Part Number

202-10046-02 1.0 Product update: New firmware and new user Interface
202-10046-03 1.0 Remove Trend Micro
202-10046-04 1.0 Updated features
202-10046-05 1.0 New features: IP/MAC Binding; Bandwidth Limits; Session Limits;

202-10046-05 1.1 Document corrections
202-10046-05 1.2 Document additions to Appendix B
202-10046-06 1.0 Maintenance release

xiv About This Manual

Version
Number

Date Description

IKE Keep Alive; Dead Peer Detection; Oray support

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

202-10046-08 1.0 Adds these corrections and topics for the March 2009 firmware

maintenance release:

• WIKID 2 factor authentication

• SIP AGL support

• DHCP Relay support

• Update VPN configuration procedure topics

• Update the Certificate management topic

• Correct the firewall scheduling topic

202-10046-09 1.0 January

2010

Added the following new features for the January 2010 firmware
maintenance release:

• Connection reset and delay options on the Broadband ISP Settings
screen (see “Manually Configuring Your Broadband Internet

Connection”).

• Support for DNS 3322 in the Dynamic DNS submenu (see

“Configuring Dynamic DNS (Optional)”).

• Support for an address range for inbound LAN rules on the Add
LAN WAN Inbound Service screen (see “Inbound Rules (Port

Forwarding)” and “Creating a LAN WAN Inbound Services Rule”).

• Support for new log options such as Resolved DNS Names and
VPN on the Firewall Logs & E-mail screen (see “Activating

Notification of Events and Alerts”).

In addition, made the following substantial changes to the book:

• Provided new captures for almost all screens and resized the some
existing screen captures for better viewing.

• Made global stylistic changes for consistency and clarity.

• Made minor revisions in Chapter 1, “Introduction.”

• Reorganized Chapter 2, “Connecting the VPN Firewall to the

Internet.” In addition:

* Revised all sections in this chapter.
* Added the “Understanding the Connection Steps” section.
* Added the “Navigating the Menus” section.
* Added the “Additional WAN Related Configuration” section.
* Moved the “Enabling the Traffic Meter” section to Chapter 6,

“VPN Firewall and Network Management.”

• Reorganized Chapter 3, “LAN Configuration,” In addition:

* Made major revision in the “Configuring the LAN Setup Options”
section.
* Revised all sections in this chapter.

About This Manual xv

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

202-10046-09
(continued)

1.0 January
2010

(continued)

• Reorganized Chapter 4, “Firewall Protection and Content Filtering.”
In addition:

* Revised all sections in this chapter.
* Added the “Configuring Other Firewall Features” section (which
includes the new “Managing the Application Level Gateway for

SIP Sessions” subsection).

* Added the “Creating Services, QoS Profiles, and Bandwidth

Profiles” section.

• Reorganized Chapter 5, “Virtual Private Networking.” In addition:

* Made a major revision of the “Managing Certificates” section in
this chapter.
* Added the “Configuring Keepalives and Dead Peer Detection”
section.
* Added the “Configuring NetBIOS Bridging with VPN” section.
* Made revisions in all other sections of this chapter.

• Reorganized Chapter 6, “VPN Firewall and Network Management.”
In addition:

* Made major revisions in the “Configuring Users, Administrative

Settings, and Remote Management” section.

* Made major revisions in the “Monitoring System Performance”
section.
* Added the “Monitoring VPN Firewall Statistics” section.
* Added the “Monitoring Attached Devices” section.
* Included the “Enabling the Traffic Meter” section (moved from

Chapter 2, “Connecting the VPN Firewall to the Internet”).

* Moved the “Performing Diagnostics” section to Chapter 7,

“Troubleshooting.”

* Made revisions in all other sections of this chapter.

• Revised all sections in Chapter 7, “Troubleshooting” and included
the “Performing Diagnostics” section (moved from Chapter 6, “VPN

Firewall and Network Management”).

xvi About This Manual

v1.0, January 2010

Chapter 1

Introduction

The ProSafe VPN Firewall 50 FVS338 integrates an 8-port switch that connects your local area
network (LAN) to the Internet through an external access device such as a cable modem or DSL
modem.

The FVS338 is a complete security solution that protects your network from attacks and
intrusions. For example, the FVS338 provides support for Stateful Packet Inspection, Denial of
Service (DoS) attack protection and multi-NAT support. The FVS338 supports multiple Web
content filtering options, plus browsing activity reporting and instant alerts—both, via e-mail.
Network administrators can establish restricted access policies based on time-of-day, Website
addresses and address keywords, and share high-speed cable/DSL Internet access for a local
network.

The FVS338 is a plug-and-play device that can be installed and configured within minutes.
This chapter contains the following sections:

• “Key Features” on this page

• “Package Contents” on page 1-5

• “VPN Firewall Hardware Components” on page 1-5

• “Factory Default Login” on page 1-8

Key Features

The FVS338 provides the following features:

• One 10/100 Mbps port for an Ethernet connection to a broadband W AN device, such as a cable
modem or DSL modem, and one serial port for a dial-up modem connection to the Internet
through the public switched telephone network (PSTN).

• Dual WAN ports (one broadband and one serial) provide for increased system reliability.

• Support for up to 50 VPN tunnels.

• Support for up to 400 internal LAN users (and 50K connections ).

• Easy, web-based setup for installation and management.

• URL keyword content filtering and site blocking security.

1-1

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

• Quality of Service (QoS) support for traffic prioritization.

• Built in 8-port 10/100 Mbps switch.

• Extensive Protocol Support.

• Login capability.

• SNMP for manageability.

• Front panel LEDs for easy monitoring of status and activity.

• Flash memory for firmware upgrade.

Full Routing on Both the Broadband and Serial WAN Ports

You can install, configure, and operate the FVS338 to take full advantage of a variety of routing
options on both the serial and broadband WAN ports, including:

• Internet access via either the serial or broadband port.

• Auto rollover connectivity (fail-over) through an analog modem connected to the serial port
If the broadband Internet connection fails, after waiting for an pre-specified amount of time
the FVS338 can automatically establish a backup dial-up Internet connection via its serial port.

A Powerful, True Firewall with Content Filtering

Unlike simple Internet sharing NAT routers, the FVS338 is a true firewall, using stateful packet
inspection to defend against hacker attacks. Its firewall features include:

• DoS protection. Automatically detects and thwarts DoS attacks such as Ping of Death, SYN
Flood, LAND Attack, and IP Spoofing.

• Blocks unwanted traffic from the Internet to your LAN.

• Blocks access from your LAN to Internet locations or services that you specify as off-limits.

• Logs security incidents. The FVS338 will log security events such as blocked incoming traffic,
port scans, attacks, and administrator logins. You can configure the FVS338 to e-mail the log
to you at specified intervals. You c an also configure the FVS338 to send immediate alert
messages to your e-mail address or e-mail pager whenever a significant event occurs.

• With its URL keyword filtering feature, the FVS338 prevents objectionable content from
reaching your PCs. The FVS338’s firewall allows you to control access to Internet content by
screening for keywords within W eb addresses. You can configure the firewall to log and report
attempts to access objectionable Internet sites.

1-2 Introduction

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Security

The VPN firewall is equipped with several features designed to maintain security, as described in
this section.

• PCs Hidden by NAT. NAT opens a temporary path to the Internet for requests originating
from the local network. Requests originating from outside the LAN are discarded, preventing
users outside the LAN from finding and directly accessing the PCs on the LAN.

• Port Forwarding with NAT. Although NAT prevents Internet locations from directly
accessing the PCs on the LAN, the FVS338 allows you to direct incoming traffic to specific
PCs based on the service port number of the incoming request. You can specify forwarding of
single ports or ranges of ports.

• Exposed Host (Software DMZ). Incoming traffic from the Internet is normally discarded by
the FVS338 unless the traffic is a response to one of your local computers or a service for
which you have configured an inbound rule. Instead of discardi ng this traffic, you can have it
forwarded to one computer on your network.

Autosensing Ethernet Connections with Auto Uplink

With its internal 8-port 10/100 switch, the FVS338 can connect to either a 10 Mbps standard
Ethernet network or a 100 Mbps Fast Ethernet network. Both the LAN and WAN interfaces are
autosensing and capable of full-duplex or half-duplex operation.

TM

The firewall incorporates Auto Uplink
whether the Ethernet cable plugged into the port should have a ‘normal’ connection such as to a
PC or an ‘uplink’ connection such as to a switch or hub. That port will then configure itself to the
correct configuration. This feature also eliminates the need to worry about crossover cables, as
Auto Uplink will accommodate either type of cable to make the right connection.

technology. Each Ethernet port will automatically sense

Extensive Protocol Support

The FVS338 supports the Transmission Control Protocol/Internet Protocol (TCP/IP) and Routing
Information Protocol

• IP Address Sharing by NAT. The VPN firewall allows several networked PCs to share an
Internet account using only a single IP address, which may be statically or dynamically
assigned by your Internet service provider (ISP). This technique, known as NAT, allows the
use of an inexpensive single-user ISP account.

Introduction 1-3

(RIP).

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

• Automatic Configuration of Attached PCs by DHCP. The FVS338 dynamically assigns
network configuration information, including IP, gateway, and domain name server (DNS)
addresses, to attached PCs on the LAN using the Dynamic Host Configuration Protocol
(DHCP). This feature greatly simplifies configuration of PCs on your local network.

• DNS Proxy. When DHCP is enabled and no DNS addresses are specified, the FVS338
provides its own address as a DNS server to the attached PCs. The FVS338 obtains actual
DNS addresses from the ISP during connection setup and forwards DNS requests from the
LAN.

• PPP over Ethernet (PPPoE). PPPoE is a protocol for connecting remote hosts to the Internet
over a DSL connection by simulating a dial-up connection. This feature eliminates the need to
run a login program such as EnterNet or WinPOET on your PC.

Easy Installation and Management

You can install, configure, and operate the FVS338 within minutes after connecting it to the
network. The following features simplify installation and management tasks:

• Browser-based management. Browser-based configuration allows you to easily configure
your firewall from almost any type of personal computer, such as Windows, Macintosh, or
Linux. A user-friendly Setup Wizard is provided and online help documentation is built into
the browser-based Web Management Interface.

• Smart Wizard. The FVS338 automatically senses the type of Internet connection, asking you
only for the information required for your type of ISP account.

• VPN Wizard. The FVS338 includes the NETGEAR VPN Wizard to easily configure VPN
tunnels according to the recommendations of the Virtual Private Network Consortium (VPNC)
to ensure the VPN tunnels are interoperable with other VPNC-compliant VPN routers and
clients.

• SNMP. The FVS338 supports the Simple Network Management Protocol (SNMP) to let you
monitor and manage log resources from an SNMP-compliant system manager. The SNMP
system configuration lets you change the system variables for MIB2.

• Diagnostic functions. The FVS338 incorporates built-in diagnostic functions such as Ping,
Trace Route, DNS lookup, and remote reboot.

• Remote management. The FVS338 allows you to securely login to the Web Management
Interface from a remote location on the Internet. For additional security, you can limit remote
management access to a specified remote IP address or range of addresses, and you can choose
a nonstandard port number.

1-4 Introduction

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

• Visual monitoring. The FVS338’s front panel LEDs provide an easy way to monitor its status
and activity.

Maintenance and Support

NETGEAR offers the following features to help you maximize your use of the FVS338:

• Flash memory for firmware upgrade.

• Technical support seven days a week, 24 hours a day, according to the terms identified in the
Warranty and Support information card provided with your product.

Package Contents

The product package should contain the following items:

• FVS338 ProSafe VPN Firewall 50

•AC power adapter

• Category 5 Ethernet cable

• Resource CD, including:
– Application Notes and other helpful information.
– ProSafe VPN Client Software (one user license)

• Warranty and Support Information Card.

If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep the
carton, including the original packing materials, in case you need to return the firewall for repair.

VPN Firewall Hardware Components

Following is a description of the front and rear panels of the FVS338, including instructions for
installing the FVS338 using the rack mounting hardware.

Introduction 1-5

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Local
LEDs

Internet

LEDs

Modem

LED

Power

LED

Test
LED

Front Panel

The FVS338 front panel shown below contains the port connections, status LEDs, and the factory
defaults reset button.

Figure 1-1

The table below describes each item on the front panel and its operation.

Table 1-1. Object Descriptions

Object Activity Description

Power LED

Test LED

MDM LED

Internet
LEDs

On (Green) Power is supplied to the FVS338.
Off Power is not supplied to the FVS338.
On (Amber) Test mode: The system is initializing or the initialization has failed.
Blinking (Amber) Writing to Flash memory (during upgrading or resetting to defaults).
Off The system has booted successfully.
On (Green) The serial port has successfully connected to an ISP and received an

IP Address.
Blinking (Green) Server data is being transmitted or received by the serial port.
Off The serial port has no link.

Link/Act LED

On (Green) The WAN port has detected a link with a connected Ethernet device.
Blinking (Green) Data is being transmitted or received by the WAN port.
Off The WAN port has no link.

1-6 Introduction

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Table 1-1. Object Descriptions (continued)

Object Activity Description

Internet
LEDs

(continued)

Local LEDs

100 LED

On (Green) The WAN port is operating at 100 Mbps.
Off The WAN port is operating at 10 Mbps.

Link/Act LED

On (Green) The LAN port has detected a link with a connected Ethernet device.
Blinking (Green) Data is being transmitted or received by the LAN port.
Off The LAN port has no link.

100 LED

On (Green) The LAN port is operating at 100 Mbps.
Off The LAN port is operating at 10 Mbps.

Rear Panel

The rear panel of the FVS338 contains the On/Off switch and AC power connection.

Figure 1-2

Viewed from left to right, the rear panel contains the following elements:

• Modem port: serves as the WAN2 Internet (dial-up) port through the public switched
telephone network (PSTN).

• Factory Defaults reset button.

• Local ports: 8-port RJ-45 10/100 Mbps Fast Ethernet Switch, N-way automatic speed
negotiation, auto MDI/MDIX.

• Internet port: serves as the WAN1 Internet (broadband) port. One RJ-45 WAN port, N-way
automatic speed negotiation, Auto MDI/MDIX.

•On/Off switch

• DC power in (12 VDC, 1.2A)

Introduction 1-7

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

LAN IP Address
User Name
Password

Factory Default Login

Check the label on the bottom of the FVS338’s enclosure if you forget the following factory
default information:

• IP Address: http://192.168.1.1 to reach the Web-based GUI from the LAN

•User name: admin

• Password: password

To log in to the FVS338 once it is connected:

1. Go to http://192.168.1.1.

2. Enter admin for User Name and password for Password.

1-8 Introduction

Figure 1-3

Figure 1-4

v1.0, January 2010

Chapter 2

Connecting the VPN Firewall to the Internet

This section provides instructions for connecting the ProSafe VPN Firewall 50 FVS338, including
these topics:

• “Understanding the Connection Steps” on this page

• “Logging in to the VPN Firewall” on page 2-2

• “Navigating the Menus” on page 2-3

• “Configuring your Internet Connection” on page 2-3

• “Manually Configuring Your Broadband Internet Connection” on page 2-9

• “Configuring the WAN Mode” on page 2-11

• “Configuring Dynamic DNS (Optional)” on page 2-14

• “Configuring Advanced WAN Options (Optional)” on page 2-16

Understanding the Connection Steps

Typically, six steps are required to complete the basic Internet connection of your VPN firewall.

1. Connect the firewall physically to your network. Connect the cables and restart your
network according to the instructions in the installation guide. See the ProSafe VPN Firewall
50 FVS338 Installation Guide for complete steps. A PDF of the Installation Guide is on the
NETGEAR website at: http://kbserver.netgear.com.

2. Log in to the VPN Firewall. After logging in, you are ready to set up and configure your
VPN firewall. You can also change your password and enable remote management at this
time. See “Logging in to the VPN Firewall” on page 2-2.

3. Configure the Internet connections to your ISP(s). During this phase, you will connect to
your ISPs. See “Configuring your Internet Connection” on page 2-3.

4. Configure the WAN mode (required for dial-up backup WAN operation). Select either
NAT or classical routing, and select either single WAN mode or single WAN with dial-up
backup WAN operation. See “Configuring the WAN Mode” on page 2-11.

v1.0, January 2010

2-1

ProSafe VPN Firewall 50 FVS338 Reference Manual

5. Configure dynamic DNS on the WAN ports (optional). If required, configure your fully
qualified domain names during this phase. See “Configuring Dynamic DNS (Optional)” on

page 2-14.

6. Configure the WAN options (optional). Optionally, you can change the MAC address, the
default MTU size, and the port speed. However, these are relatively advanced features and
changing them is not usually required. See “Configuring Advanced WAN Options (Optional)”

on page 2-16.

Each of these tasks is detailed separately in this chapter. Setting up VPN tunnels is covered in

Chapter 5, “Virtual Private Networking.”

Logging in to the VPN Firewall

To connect to the VPN firewall, your computer needs to be configured to obtain an IP address
automatically from the VPN firewall by DHCP. For instructions on how to configure your
computer for DHCP, see the “Preparing Your Network” document that you can access from

Appendix D, “Related Documents.”

To log in to the VPN firewall:

1. Open an Internet Explorer or Firefox browser. In the browser window, enter
http://192.168.1.1 in the address field. The FVS338 login screen will display.

Figure 2-1

2. Enter admin for the User Name and password for the Password, both in lower case letters.
The VPN firewall user name and password are not the same as any user name or password you
may use to log in to your Internet connection.

3. Click Login. The Web Configuration Manager appears, displaying the Router Status screen as
the default screen.

2-2 Connecting the VPN Firewall to the Internet

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Note: See “Enabling Remote Management Access” on page 6-14 for information on

remote management. If you enable remote management, change your password
to a more secure one than the standard factory default (see “Changing

Passwords and Settings” on page 6-8).

Navigating the Menus

The Web Configuration Manager menus are organized in a layered structure of main categories
and submenus:

• Main menu. The horizontal orange bar near the top of the page is the main menu, containing
the primary configuration categories. Clicking on a primary category changes the contents of
the submenu bar.

• Submenu. The horizontal grey bar immediately below the main menu is the submenu,
containing subcategories of the currently selected primary category.

• Tab. Immediately below the submenu bar, at the top of the menu active window, are one or
more tabs, further subdividing the currently selected subcategory if necessary.

• Option arrow . To the right of the tabs on some menus are one or more blue dots with an arrow
in the center . Clicking an option arrow brings up either a popup window or an ad vanced option
menu.

Tip: In the instructions in this guide, we may refer to a menu using the notation

primary | subcategory, such as Network Configuration | WAN Settings. In this
example, Network is the selected primary category (in the main menu) and
WAN Settings is the sele cted subcategory (in the submenu).

You can now proceed to the first configuration task, configuring the VPN firewall’s Internet
connections.

Configuring your Internet Connection

You can configure both broadband ISP settings and dial-up ISP settings from the WAN Settings
submenu.

Connecting the VPN Firewall to the Internet 2-3

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Broadband ISP WAN Port Settings

To automatically configure the broadband ISP connection:

1. Select Network Configuration from the main menu and WAN Settings from the submenu.
The Broadband ISP Settings screen will display.

Figure 2-2

2. Click Auto Detect at the bottom of the screen to automatically detect the type of Internet
connection provided by your ISP. Auto Detect will probe for different connection methods and
suggest one that your ISP will most likely support.

2-4 Connecting the VPN Firewall to the Internet

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

When Auto Detect successfully detects an active Internet service, it reports which connection
type it discovered. The options are described in the Table 2-1.

Table 2-1. Internet connection methods

Connection Method Data Required

PPPoE Login (Requires username and password).
PPTP Login (Requires username and password, local IP address, and PPTP

server IP address).
DHCP (Dynamic IP) No data is required.
Fixed IP IP address and related data are supplied by your ISP.

3. Click Broadband Status at the top right of the screen to verify your broadband connection
status. Click connect if a connection is not yet established.

Figure 2-3

If Auto Detect does not find a connection, you will be prompted to check the physical
connection between your VPN firewall and the DSL line or to check your VPN firewall’s
MAC address (see “Configuring Advanced WAN Options (Optional)” on page 2-16).

4. As an optional step, set up the traffic meter for the broadband connection (see “Configuring

the WAN Mode” on page 2-11).

Note: At this point in the configuration process, you are now connected to the Internet

through the broadband Ethernet WAN. As an option, you can continue with the
configuration of the dial-up ISP serial WAN interface.

Connecting the VPN Firewall to the Internet 2-5

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Dial-up ISP Serial WAN port Settings

The Dialup Settings screen will assist you in setting up the VPN firewall to access the Internet
connection using a dial-up modem. Since the Dialup ISP Settings must be configured manually,
you will need all of your ISP settings information before you begin.

To configure the dial-up ISP connection:

1. Select Network Configuration from the main menu and WAN Settings from the submenu.

2. Click the Dialup ISP Settings tab to display the Dialup Settings screen.

Figure 2-4

2-6 Connecting the VPN Firewall to the Internet

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

3. In the Dial-up Account section of the screen, enter the following settings:

• Account/User name. The account name or the user name provided by your ISP. This

name will be used to log in to the ISP server.

• Password. The account password for the dial-up ISP.

• Telephone. The telephone number or access number to dial for connectivity. Enter the

number using the format described in your modem’s user manual.

• Alternative Telephone. An alternative number that will be dialed if the first number is not

available. (This is an option).

4. In the Dial-up Connection Status section of the screen, specify the method to use for your
dial-up connection. The VPN firewall can automatically dial to the ISP when a connection is
needed or can be configured to wait for manual intervention. Configure one of the following
options:

• Check the Connect automatically disconnect after idle for ___ min. radios box for the

modem to connect automatically. Specify the idle minute time. The VPN firewall will
connect whenever an outbound connection request is made from a computer on the LAN.
The connection will be terminated if there is no data transfer during the specified time
interval in the Dialup Timeout Value field (the default is 60 seconds).

• Check the Connect and disconnect manually radio box to disable auto dialing and allow

manual control over connecting via dial-up. To connect manually, click the Dial-Up
Status link at the top and then click Connect. The connection will be terminated if there is
no data transfer during the specified time interval in the Dialup Timeout Value field (the
default is 60 seconds).

5. In the Internet (IP Address) section of the screen, select the IP address and DNS servers.

Note: Dial-up ISPs usually assign the IP address automatically when connecting.

• Select the IP address by selecting one of the following radio boxes:

– Get Dynamically from ISP. Enables the VPN firewall to accept the IP address that is

dynamically assigned by the ISP. This is the default setting.

– Use Static IP Address. Requires the VPN firewall to function with the static IP

address that was assigned by the ISP. Enter the IP address in the IP Address field.

Connecting the VPN Firewall to the Internet 2-7

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

• Select the DNS servers by selecting one of the following radio boxes:

– Get Automatically From ISP. Enables the VPN firewall to accept the DNS servers

that are dynamically assigned by the ISP. This is the default setting.

– Use These DNS Servers. Requires the VPN firewall to function with the static DNS

servers that were assigned by the ISP. Enter the IP addresses of the DNS servers in the
Primary DNS Server and Secondary DNS Server fields. A secondary DNS server is
optional.

6. Enter any modem-specific parameters to tune the VPN firewall for different modems:

• Serial Line Speed. Select the baud rate with which the serial port of the VPN firewall and

the modem connect. Available speeds range from 4.8Kbps to 460.8Kbps.

• Modem Type. If your modem type is listed in the pull-down menu, select it. For most

56Kbps modems, the U.S. Robotics 56K FAX EXT PnP selection should work. If this
does not work, select User Defined Modem and enter the initial string for your modem.
The initial string is usually defined in the modem’s user manual.

• Dial-up Type. Select one of the following options:

– Check the Tone radio box if your phone line supports touch tone dialing.
– Select the Pulse radio box for pulse mode dialing.
– Select the Other – use Dial String radio box to configure additional options such as

auto-answer. Consult your modem manual for dial strings.

7. Click Apply to save your settings.
As an optional step, set up the traffic meter for the dial-up connection (see “Configuring the

WAN Mode ” on page 2-11).

Note: The response time of your serial port Internet connection will be slower than a

broadband Internet connection.

Tip: If you experience connectivity problems with the dial-up ISP, try a different

baud rate setting and ensure that the modem parameters you selected match the
modem connected to the VPN firewall.

2-8 Connecting the VPN Firewall to the Internet

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Manually Configuring Your Broadband Internet Connection

If you know your broadband ISP connection type, you can bypass the Auto Detect feature and
connect your VPN firewall manually. Ensure that you have all of the relevant connection
information such as IP addresses, account information, type of ISP connection, and so on, before
you begin. Unless your ISP automatically assigns your configuration automatically via DHCP, you
will need the configuration parameters from your ISP.

To automatically configure the broadband ISP connection:

1. Select Network Configuration from the main menu and WAN Settings from the submenu.
The Broadband ISP Settings screen will display.

Figure 2-5

Connecting the VPN Firewall to the Internet 2-9

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

2. Does your Internet connection require a login? If you need to enter login information every
time you connect to the Internet through your ISP, select Yes. Otherwise, select No.

3. What type of IPS connection do you use? If your connection is PPTP or PPPoE, then you
must log in (select the Yes radio box in the previous step). The text box fields that require data
entry will be highlighted, based on the connection that you selected. If your ISP has not
assigned any login information, then choose the No radio box in the previous step and skip this
section. For example:

• Austria (PPTP). If your ISP uses PPTP for login, select this radio box. Then, fill in the

following highlighted fields:
– Account Name (also known as Host Name or System Name). Enter the valid account

name for the PPTP connection (usually your e-mail “ID” assigned by your ISP). Some
ISPs require entering your full e-mail address here.

– Domain Name. Your domain name or workgroup name assigned by your ISP, or your

ISPs domain name. You may leave this field blank.

– Idle Timeout. Check the Keep Connected radio box to keep the connection always

on. To logout after the connection is idle for a period of time, select Idle Time and
enter the number of minutes to wait before disconnecting in the timeout field. This is
useful if your ISP charges you based on the amount of time you have logged in.

– My IP Address. IP address assigned by the ISP to make the connection with the ISP

server.

– Server IP Address. IP address of the PPTP server.

• Other (PPPoE). If you have installed login software such as WinPoET or Ethernet, then

your connection type is PPPoE. Select this connection and configure the following fields:
– Account Name: Valid account name for the PPPoE connection
– Domain Name: Name of your ISPs domain or your domain name if your ISP has

assigned one. You may leave this field blank.

– Idle Timeout: Select Keep Connected, to keep the connection always on. To logout

after the connection is idle for a period of time, select Idle Time and enter the n umber
of minutes to wait before disconnecting, in the timeout field.

– Connection Reset. Select this checkbox to to specify a time when the PPPoE WAN

connection is reset, that is, the connection is disconnected momentarily and then re­established. Enter the hour and minutes in the Disconnect Time fields to specify when
the connection should be disconnected. Enter the seconds in the Delay field to specify
the period after which the connection should be re-established.

2-10 Connecting the VPN Firewall to the Internet

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

4. If your ISP has assigned a fixed (static or permanent) IP address, select the Use Static IP
Address radio box and fill in the following fields:

• IP Address. Static IP address assigned to you. This will i dentify the VPN firewal l to your

ISP.

• Subnet Mask. This is usually provided by the ISP or your network administrator.

• Gateway IP Address. IP address of the ISP’s gateway. This is usually provided by the ISP

or your network administrator.

If your ISP has not assigned a Static IP address, select the Get dynamically from ISP radio
box. The ISP will automatically assign an IP address to the VPN firewall using DHCP network
protocol.

5. If your ISP has not assigned any Domain Name Servers (DNS) addresses, select the Get
dynamically from ISP radio box. If your ISP has assigned DNS addresses, select the Use
these DNS Servers radio box. Ensure that you enter valid DNS server IP addresses in the

fields. Incorrect DNS entries may cause connectivity issues.

Note: Domain name servers (DNS) convert Internet names such as www .google.com,

www.netgear.com, etc. to Internet addresses called IP addresses. Incorrect
settings here will result in connectivity problems.

6. Click Apply to save the settings or click Cancel to revert to the previous settings.

7. Click Test to try and connect to the NETGEAR website. If you connect successfully and your

settings work, then you may click Logout or go on and configure additional settings. To check
on the connection status, click on the Broadband Status link.

Configuring the WAN Mode

The WAN Mode screen allows you to configure how your VPN firewall uses your external
Internet connections (for example, your WAN port or dial-up modem connections), and whether or
not the connection rolls over to a secondary link when there is a failure on the primary link.

• NAT. NAT is the technology which allows all PCs on your LAN to share a single Internet IP
address. Viewed from the Internet, the WAN port on the VPN firewall is configured with a
single IP address—the “public” address. PCs on your LAN can use any “private” IP address
range, and these IP addresses are not visible from the Internet.

– The VPN firewall uses NAT to select the correct PC (on your LAN) to receive any

incoming data and hides internal IP addresses from computers on the Internet.

– If you only have a single Internet IP address, you MUST use NAT.

Connecting the VPN Firewall to the Internet 2-11

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

NAT is the default setting. Select NAT if your ISP has assigned only one IP address to you.
The computers that connect through the VPN firewall must then be assigned IP addresses from
a private subnet (for example: 192.168.1.0).

• Classical Routing. In this mode, the VPN firewall performs routing, but without NAT . T o gain
Internet access, each PC on your LAN must have a valid Internet IP address.

If your ISP has allocated many IP addresses to you, and you have assigned one of these
addresses to each PC, you can choose classical routing. Or, you can use classical routing for
routing private IP addresses within a campus environment. Otherwise, selecting this method
will not allow Internet access through the VPN firewall.

Note: The VPN firewall will delete all inbound firewall rules when switching

between NAT and Classical Routing.

To configure the WAN mode:

1. Select Network Configuration from the main menu and WAN Mode from the submenu. The
WAN Mode screen will display.

Figure 2-6

2. Check either the NAT or Classical Routing radio box. NAT is the default.

2-12 Connecting the VPN Firewall to the Internet

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

3. In the Port Mode section of the screen, select the port mode settings to configure your VPN
firewall to use only one WAN port (either the broadband port or the dial-up port) or to select
the dial-up port as a backup.

• If you are connected to only one ISP, then select the Use only single WAN port radi o box

and select the WAN port that is connected to your ISP from the pull-down menu.

• If you have both ISP links connected for Internet connectivity, check the Primary

Broadband with Dialup as backup for auto-rollover.

4. In the WAN Failure Detection Method section of the screen, configure the failure detection

method to notify the VPN firewall of a link failure if you are using dial-up as a backup to
engage auto-rollover. The VPN firewall checks the connection of the primary link at regular
intervals to detect its status. Check the radio box of one the following methods to detect link
failure:

• Select DNS lookup using configured DNS Servers to detect failure of the Broadband

link, using the DNS servers configured on the Broadband ISP Settings screen.

• Select DNS lookup using this DNS Server and enter the IP address of the DNS server to

specify a DNS server for detecting WAN failure

• Select Ping this IP address and enter an IP address to detect WAN failure by pinging to

an IP address. Ensure that this destination host is reliable.

If a failure is detected on the primary broadband connection, the secondary dial-up connection
connects to the Internet. When the primary connection is detected as back online, the
secondary dial-up connection disconnects.

Specify the test period and failover number:

• Test Period. Enter the test period in seconds, which specified how often the VPN firewall

should run the configured detection method. The default is 30 seconds.

• Failover after. Enter the number of failures that should occur before the VPN firewall

rolls-over to the dial-up port. The default is 4.

5. Enter Apply to save your settings or Cancel to revert to the previous settings.

Connecting the VPN Firewall to the Internet 2-13

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Configuring Dynamic DNS (Optional)

Note: If your ISP assigns a private WAN IP address such as 192.168.x.x or 10.x.x.x, the

dynamic DNS service will not be available since private addresses cannot be
routed on the Internet.

Dynamic DNS (DDNS) is an Internet service that allows routers with varying public IP addresses
to be located using Internet domain names. To use DDNS, you must setup an account with a
DDNS provider such as DynDNS.org, TZO.com, Oray .net, or 3322.or g. (Links to DynDNS, TZO,
Oray, and 3322 are provided for your convenience on the Dynamic DNS Configuration screen.)

If your network has a permanently assigned IP address, you can register a domain name and ha ve
that name linked with your IP address by public Domain Name Servers (DNS). However, if your
Internet account uses a dynamically assigned IP address, you will not know in advance what your
IP address will be, and the address can change frequently—hence, the need for a commercial
DDNS service, which allows you to register an extension to its domain, and restores DNS requests
for the resulting FQDN (fully qualified domain name) to your frequently-changing IP address.

For rollover mode, you will need an FQDN to implement features such as exposed hosts and
virtual private networks, regardless of whether you have a fixed or dynamic IP address.

After you have configured your account information in the VPN firewall, whenever your ISP­assigned IP address changes, your VPN firewall will automatically contact your dynamic DNS
service provider, log in to your account, and register your new IP address.

Note: If your ISP assigns a private WAN IP address such as 192.168.x.x or 10.x.x.x, the

dynamic DNS service will not work because private addresses will not be routed
on the Internet.

To configure a dynamic DNS address:

1. Select Network Configuration from the main menu and Dynamic DNS from the submenu.
The Dynamic DNS screen displays (se e Figure 2-7 on page 2-15).

2-14 Connecting the VPN Firewall to the Internet

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Figure 2-7

A tab is provided for each supported DNS service provider.
The WAN Mode section on the screen displays the currently configured WAN Mode: Single

Port Broadband, Single Port Dial-up, or Auto Rollover with Primary Broadband.
If you have configured Single Port, select the tab for a DNS service provider, then fill out the

DDNS section for that port. If you have enabled Auto Rollover, select the tab for a DNS
service provider and complete both sections. (Only those options that match the configured
WAN Mode will be access ible.)

2. Select the Dynamic DNS Service radio box you want to enable. The fields corresponding to
the selection you have selected will be highlighted. Each DNS service provider requires its
own parameters.

3. Access the website of one of the DDNS service providers and set up an account. A link to each
DDNS provider is near the top right of the window opposite to the DDNS service provider
tabs. The link is encircled with a line in Figure 2-7.

Connecting the VPN Firewall to the Internet 2-15

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

4. After setting up your account, return to the Dynamic DNS Configuration screen and fill in the
required fields for the DDNS service that you selected:

a. In the Host and Domain Name field, enter the entire FQDN name that your dynamic DNS

service provider gave you (for example: <yourname>.dyndns.org).

b. Enter the user name, user e-mail address, or account name requested by the DDNS service

to identify you when logging into your DDNS account.

c. Enter the password, or user key, for your DDNS account.
d. If your dynamic DNS provider allows the use of wild cards in resolving your URL, you

may check the Use wildcards radio box to activate this feature.
For example, the wildcard feature will cause

the same IP address as

yourhost.dyndns.org

*.yourhost.dyndns.org to be aliased to

5. Click Apply to save your configuration or click Cancel to revert to the previous settings.

Configuring Advanced WAN Options (Optional)

To configure the broadband advanced WAN options:

1. Select Network Configuration from the main menu and Broadband ISP Settings from the
submenu.

2. Click the Advanced link. The Broadband Advanced Options screens displays.

Figure 2-8

2-16 Connecting the VPN Firewall to the Internet

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

3. Edit the default information that you want to change in the following sections of the screen:

• MTU Size. The normal MTU (Maximum Transmit Unit) value for most Ethernet

networks is 1500 Bytes, or 1492 Bytes for PPPoE connections. For some ISPs you may
have to reduce the MTU. But this is rarely required, and should not be done unless you are
sure it is necessary for your ISP connection.

• Speed. In most cases, your VPN firewall can automatically determine the connection

speed of the Internet (WAN) port. If you cannot establish an Internet connection and the
Internet LED blinks continuously, you may have to manually select the port speed.
AutoSense is the default.

If you know that the Ethernet port on your broadband modem supports 100BaseT, select
100BaseT Half_Duplex; otherwise, select 10BaseT Half_Duplex. Use the half-duplex
settings unless you are sure you need full duplex.

• Router's MAC Address. Each computer or router on your network has a unique 32-bit

local Ethernet address. This is also referred to as the computer's MAC (Media Access
Control) address. The default is Use Default Address. However, if your ISP requires
MAC authentication, then select either

– Use this Computer’s MAC address to enable the VPN firewall to use the MAC

address of the computer you are now using, or

– Use This MAC Address to manually type in the MAC address that your ISP expects.
The format for the MAC address is XX:XX:XX:XX:XX:XX (numbers 0-9 and either

uppercase or lowercase letters A-F). If you select Use This MAC Address and then type
in a MAC address, your entry will be overwritten.

4. Click Apply to save your settings.

To configure the dial-up advanced WAN options:

1. Select Network Configuration from the main menu and Dial-up ISP Settings from the
submenu.

2. Click the Advanced link. The Dial-up Advanced Options screens displays.

3. If required, change the standard MTU value for the dial-up modem. This is the only settings

that you can change on this screen. The standard value for the MTU is 576 bytes, but some
ISPs may require that you reduce the MTU. However, this is rarely required, and should not be
done unless specifically required by the ISP.

4. Click Apply to save your settings.

Connecting the VPN Firewall to the Internet 2-17

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Additional WAN Related Configuration

• If you want the ability to manage the VPN firewall remotely, enable remote management at
this time (see “Enabling Remote Management Access” on page 6-14). If you enable remote
management, we strongly recommend that you change your password (see “Changing

Passwords and Settings” on page 6-8).

• At this point, you can set up the traffic meter for the WAN, if desired. See “Enabling the

Traffic Meter” on page 6-27.

2-18 Connecting the VPN Firewall to the Internet

v1.0, January 2010

Chapter 3

LAN Configuration

This chapter describes how to configure the LAN settings, LAN groups, and routing features of
your ProSafe VPN Firewall 50 FVS338, including the following sections:

• “Choosing the VPN Firewall DHCP Options” on this page

• “Configuring the LAN Setup Options” on page 3-2

• “Managing Groups and Hosts” on page 3-6

• “Configuring Multi-Home LAN IPs Addresses” on page 3-10

• “Configuring Static Routes” on page 3-11

• “Configuring Routing Information Protocol (RIP)” on page 3-14

Choosing the VPN Firewall DHCP Options

By default, the VPN firewall will function as a DHCP (Dynamic Host Configuration Protocol)
server, allowing it to assign IP, DNS server, WINS Server, and default gateway addresses to all
computers connected to the VPN firewall LAN. The assigned default gateway address is the LAN
address of the VPN firewall. IP addresses will be assigned to the attached PCs from a pool of
addresses that you must specify. Each pool address is tested before it is assigned to avoid duplicate
addresses on the LAN. The DHCP options are available for both the LAN and DMZ settings.

For most applications, the default DHCP and TCP/IP settings of the VPN firewall are satisfactory.
See the link to “TCP/IP Networking Basics” in Appendix D, “Related Documents” for an
explanation of DHCP and information about how to assign IP addresses for your network.

If another device on your network will be the DHCP server, or if you will manually configure the
network settings of all of your computers, clear the Enable DHCP server radio box by selecting
the Disable DHCP Server radio box. Otherwise, leave it checked.

Specify the pool of IP addresses to be assigned by setting the starting IP address and ending IP
address. These addresses should be part of the same IP address subnet as the VPN firewall’s LAN
IP address. Using the default addressing scheme, you should define a range between 192.168.1.2
and 192.168.1.100, although you may wish to save part of the range for devices with fixed
addresses.

3-1

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

The VPN firewall will deliver the following parameters to any LAN device that requests DHCP:

• An IP address from the range that you have defined.

• Subnet mask.

• Gateway IP address (the VPN firewall’s LAN IP address).

• Primary DNS server (the VPN firewall’s LAN IP address).

• WINS server (if you entered a WINS server address in the DHCP section of the LAN Setup
screen).

• Lease time (date obtained and duration of lease).

DHCP Relay options allow you to make the VPN firewall a DHCP relay agent. The DHCP relay
agent makes it possible for DHCP broadcast messages to be sent over routers that do not support
forwarding of these types of messages. The DHCP Relay Agent is therefore the routing protocol
that enables DHCP clients to obtain IP addresses from a DHCP server on a remote subnet, or
which is not located on the local subnet. If you have no configured DHCP relay agent, your clients
would only be able to obtain IP addresses from the DHCP server which is on the same subnet. To
enable clients to obtain IP addresses from a DHCP server on a remote subnet, you have to
configure the DHCP relay agent on the subnet that contains the remote clients, so that it can relay
DHCP broadcast messages to your DHCP server.

When the DNS Proxy option is enabled, the VPN firewall will act as a proxy for all DNS requests
and communicate with the ISP’s DNS servers (as configured on the Broadband ISP Settings screen
and Dial-up ISP Settings screen). All DHCP clients will receive the primary/secondary DNS IP
addresses along with the IP address where the DNS proxy is running, which is the the devices’s
LAN IP address. When disabled, all DHCP clients will receive the DNS IP addresses of the ISP
excluding the DNS proxy IP address. The feature is particularly useful in Auto Rollover mode. For
example, if the DNS servers for each connection are different, then a link failure may render the
DNS servers inaccessible. However, when the DNS proxy is enabled, then clients can make
requests to the VPN firewall and the VPN firewall, in turn, sends those requests to the DNS servers
of the active connection.

Configuring the LAN Setup Options

The LAN Setup screen allows configuration of LAN IP services such as DHCP and allows you to
configure a secondary or “multi-home” LAN IP setup in the LAN. The default values are suitable
for most users and situations. Disable the DNS Proxy if you are using a dual WAN configuration
with route diversity and failover. These are advanced settings most usually configured by a
network administrator.

3-2 LAN Configuration

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Note: If you enable the DNS Relay feature, you will not use the FVS338 as a DHCP

server but rather as a DHCP relay agent for a DHCP server somewhere else on
your network.

To configure the LAN options:

1. Select Network Configuration from the main menu and LAN Settings from the submenu.
The LAN Setup screen will display.

Figure 3-1

2. In the LAN TCP/IP Setup section, configure the following settings:

• IP Address. The LAN address of your VPN firewall (factory default: 192.168.1.1).

LAN Configuration 3-3

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Note: If you change the LAN IP address of the VPN firewall while connected

through the browser, you will be disconnected. You must then open a new
connection to the new IP address and log in again. For example, if you
change the default IP address 192.168.1.1 to 10.0.0.1, you must now enter
https://10.0.0.1 in your browser to reconnect to the Web Configuration
Manager.

• IP Subnet Mask. The subnet mask specifies the network number portion of an IP address.

Your VPN firewall will automatically calculate the subnet mask based on the IP address
that you assign. Unless you are implementing subnetting, use 255.255.255.0 as the subnet
mask.

3. In the DHCP section, select Disable DHCP Server, Enable DHCP Server, or DHCP Relay.
By default, the VPN firewall will function as a DHCP server, providing TCP/IP configuration
settings for all computers connected to the VPN firewall’s LAN. If another device on your
network will be the DHCP server, or if you will manually configure all devices, click Disable
DHCP Server. If the VPN firewall will function as a DHCP relay agent, select DHCP Relay
and enter the IP address of the DHCP relay gateway in the Relay Gateway field.

If the DHCP server is enabled, enter the following parameters:

• Domain Name. (Optional) The DHCP will assign the entered domain to DHCP clients.

• Starting IP Address. Specifies the first of the contiguous addresses in the IP address pool.

Any new DHCP client joining the LAN will be assigned an IP address between this
address and the Ending IP Address. The IP address 192.168.1.2 is the default start address.

• Ending IP Address. Specifies the last of the contiguous addresses in the IP address pool.

The IP address 192.168.1.100 is the default ending address.

Note: The starting and sending DHCP addresses should be in the same “network”

as the LAN TCP/IP address of the VPN firewall (the IP address in the
LAN TCP/IP Setup section of the LAN Setup screen).

• Primary DNS Server. (Optional) If an IP address is specified, the VPN firewall will

provide this address as the primary DNS server IP address. If no address is specified, the
VPN firewall will provide its own LAN IP address as the primary DNS server IP address.

• Secondary DNS Server. (Optional) If an IP address is specified, the VPN firewall will

provide this address as the secondary DNS server IP address.

3-4 LAN Configuration

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

• WINS Server. (Optional) Specifies the IP address of a local Windows NetBIOS Server if

one is present in your network.

• Lease Time. This specifies the duration for which IP addresses will be leased to clients.
If you will use a Lightweight Directory Access Protocol (LDAP) authentication server for

network-validated domain-based authentication, select Enable LDAP Information to enable
the DHCP server to provide LDAP server information. Enter the following parameters:

• LDAP Server. Specifies the name or the IP address of the device that hosts the LDAP

server.

• Search Base. Specifies the distinguished name (dn) at which to start the search, specified

as a sequence of relative distinguished names (rdn), connected with commas and without
any blank spaces. For most users, the search base is a variation of the domain name. For
example, if your domain is yourcompany.com, your search base dn might be as follows:
dc=yourcompany,dc=com.

• port. Specifies the port number that the LDAP server is using. Leave this field blank for

the default port.

4. In the Advanced Settings section, configure the following settings:

• Enable DNS Proxy. If the DNS proxy is enabled (which is the default setting), the DHCP

server will provide the VPN firewall’s LAN IP address as the DNS server for address
name resolution. If this radio box is unchecked, the DHCP server will provide the ISP’s
DNS server IP addresses. The VPN firewall will still service DNS requests sent to its LAN
IP address unless you disable DNS Proxy in the VPN firewall settings (see “Inbound

Rules Examples” on page 4-11).

The feature is particularly useful in Auto Rollover mode. For example, if the DNS servers
for each connection are different, then a link failure may render the DNS servers
inaccessible.

• Enable ARP Broadcast. If ARP broadcast is enabled (which is the default setting), the

Address Resolution Protocol (ARP) is broadcast on the LAN so that IP addresses can be
mapped to physical addresses (that is, MAC addresses).

5. Click Apply to save your settings.

Note: Once you have completed the LAN IP setup, all outbound traffic is allowed

and all inbound traffic is discarded. To change these traffic rules, refer to

Chapter 4, “Firewall Protection and Content Filtering.”

LAN Configuration 3-5

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Managing Groups and Hosts

The Known PCs and Devices table on the Groups and Hosts screen contains a list of all known
PCs and network devices, as well as hosts, that are assigned dynamic IP addresses by this VPN
firewall. Collectively, these entries make up the Network Database.

The Network Database is updated by these methods:

• Using the DHCP Server. By default, the DHCP server in this VPN firewall is enabled, and
will accept and respond to DHCP client requests from PCs and other network devices. These
requests also generate an entry in the Network Database. Because of this, leaving the DHCP
Server feature (on the LAN screen) enabled is strongly recommended.

• Scanning the Network. The local network is scanned using standard methods such as ARP.
This will detect active devices which are not DHCP clients. However, sometimes the name of
the PC or device cannot be accurately determined, and will be shown as Unknown.

• Manual Entry. You can manually enter information about a network device.

Creating the Network Database

The Network Database offers a number of advantages:

• Generally, you do not need to enter either IP address or MAC addresses. Instead, you can just
select the desired PC or device.

• No need to reserve an IP address for a PC in the DHCP Server. All IP address assignments
made by the DHCP Server will be maintained until the PC or device is removed from the
database, either by expiry (inactive for a long time) or by you.

• No need to use a fixed IP address on PCs. Because the address allocated by the DHCP Server
will never change, you don't need to assign a fixed IP address to a PC to ensure it always has
the same IP address.

• MAC-level control over PCs. The Network Database uses the MAC address to identify each
PC or device. So changing a PC’s IP address does not affect any restrictions on that PC.

• Group and individual control over PCs
– You can assign PCs to groups and apply restrictions to each group using the Firewall

Rules screen (see “Using Rules to Block or Allow Specific Kinds of Traffic” on page 4-2).

– You can also select the groups to be covered by the Block Sites feature (see “Blocking

Internet Sites (Content Filtering)” on page 4-26).

3-6 LAN Configuration

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

– If necessary, you can also create firewall rules to apply to a single PC (see “Configuring

Source MAC Filtering” on page 4-29). Because the MAC address is used to identify each

PC, users cannot avoid these restrictions by changing their IP address.

• A computer is identified by its MAC address—not its IP address. Hence, changing a
computer’s IP address does not affect any restrictions applied to that PC.

Viewing the Network Database

To view the Network Database, follow these steps:

1. Select Network Configuration from the primary menu and LAN Settings from the submenu.
The LAN Setup screen will display.

2. Click the LAN Groups tab. The LAN Groups screen will display.

Figure 3-2

The Known PCs and Devices table lists the entries in the Network Database. For each computer
or device, the following fields are displayed:

• Name. The name of the computer or device. Computers that do not support the NetBIOS
protocol will be listed as Unknown. In this case, the name can be edited manually for easier
management. If the computer was assigned an IP address by the DHCP server, then an asterisk
is be appended to the name.

• IP Address. The current IP address of the computer. For DHCP clients of the VPN firewall,
this IP address will not change. If a computer is assigned a static IP address, you must to
update this entry manually when the IP address of the computer changes.

• MAC Address. The MAC address of the computer’s network interface.

LAN Configuration 3-7

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

• Group. Each PC or device can be assigned to a single group. By default, a computer is
assigned to the first group (Group 1). To change the group assignment, click edit.

• Action/edit. Allows modification of the selected entry.

Adding Devices to the Network Database

To add devices manually to the Network Database:

1. To add computers to the network database manually, fill in the following fields:

• Name. The name of the PC or device.

• IP Address Type. From the pull-down menu, choose how this device receives its IP

address:
– Select Fixed (Set on PC) if the IP address is statically assigned on the computer itself.
– Select Reserved (DHCP Client) to direct the VPN firewall to reserve the IP address

for allocation by the DHCP server (see “Setting Up DHCP Address Reservation” on

page 3-9).

Note: When assigning a reserved IP address to a client, the IP address selected

must be outside the range of addresses allocated to the DHCP server pool.

• IP Address. The IP address that this computer or device is assigned. If the IP Address

Type is Reserved (DHCP Client), the VPN firewall will reserve the IP address for the
associated MAC address.

• MAC Address. The MAC address of the computer’s network interface. The MAC

address format is six colon-separated pairs of hexadecimal characters (0-9 and A-F), su ch
as 01:23:45:67:89:AB.

• Group. The group to which the computer has to be assigned. (Group 1 is the default

group.)

2. Click Add to add the new entry to the network database.

3. As an optional step: To enable DHCP address reservation for the entry that you just added to
the Known PCs and Devices table, select the checkbox for the table entry and click Save
Binding to bind the IP address to the MAC address for DHCP assignment.

3-8 LAN Configuration

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Changing Group Names in the LAN Groups Database

By default, the LAN Groups are named Group1 through Group8. You can rename these group
names to be more descriptive, such as Engineering or Marketing.

To edit the names of any of the eight available groups:

1. From the LAN Groups screen, click the Edit Group Names link to the right of the tabs. The
Network Database Group Names screen appears.

Figure 3-3

2. Select the radio button next to any group name to make that name active for editing.

3. Type a new name in the field.

4. Select and edit other group names if desired.

5. Click Apply to save your settings.

Setting Up DHCP Address Reservation

When you specify a reserved IP address for a device on the LAN (based on the MAC address of
the device), that computer or device will always receive the same IP address each time it accesses
the VPN firewall’s DHCP server. Reserved IP addresses should be assigne d to servers or access
points that require permanent IP settings. The Reserved IP address that you select must be outside
of the DHCP Server pool.

To reserve an IP address, manually enter the device on the LAN Groups screen, specifying
Reserved (DHCP Client), as described in “Adding Devices to the Network Database” on page 3-

8.

LAN Configuration 3-9

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Note: The reserved address will not be assigned until the next time the PC contacts the

VPN firewall's DHCP server. Reboot the PC or access its IP configuration and
force a DHCP release and renew.

Configuring Multi-Home LAN IPs Addresses

If you have computers using different IP networks in the LAN, (for example., 172.16.2.0,

10.0.0.0), then you can add aliases to the LAN port and give computers on those networks access

to the Internet through the VPN firewall. This allows the VPN firewall to act as a gateway to
additional logical subnets on your LAN. You can assign the VPN firewall an IP address on each
additional logical subnet.

To add a secondary LAN IP address:

1. Select Network Configuration from the primary menu and LAN Settings from the submenu.
The LAN Setup screen will display.

2. Click the LAN Multi-homing tab. The LAN Multi-homing screen will display.

Figure 3-4

The Available Secondary LAN IPs table lists the secondary LAN IP addresses added to the
VPN firewall.

• IP Address. The IP address alias added to the LAN port of the VPN firewall. This is the
gateway for computers that need to access the Internet.

• Subnet Mask. IPv4 Subnet Mask.

• Action/edit. Click to make changes to the selected entry.

3-10 LAN Configuration

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

• select all. Selects all the entries in the Available Secondary LAN IPs table.

• delete. Deletes selected entries from the Available Secondary LAN IPs table.

3. Type in the IP Address and the Subnet Mask in the respective text fields.

4. Click add. The Secondary LAN IP address will be added to the Secondary LAN IPs table.

Note: Additional IP addresses cannot be configured in the DHCP server. The hosts on the

secondary subnets must be manually configured with the IP addresses, gateway IP
and DNS server IPs.

Warning: Make sure the secondary IP addres ses are different from the LAN, WAN, and

any other subnet attached to this VPN firewall.

Example:
Broadband port IP address: 10.0.0.1 with subnet 255.0.0.0
Dial-up port IP address: 20.0.0.1 with subnet 255.0.0.0
LAN IP address: 192.168.1.1 with subnet 255.255.255.0
Secondary LAN IP: 192.168.20.1 with subnet 255.255.255.0

Configuring Static Routes

Static routes provide additional routing information to your VPN firewall. Under normal
circumstances, the VPN firewall has adequate routing information after it has been configured for
Internet access, and you do not need to configure additional static routes. You must configure
static routes only for unusual cases such as multiple firewalls or multiple IP subnets located on
your network.

To add or edit a static route:

1. Select Network Configuration from the main menu and Routing from the submenu. The
Routing screen will display (see Figure 3-5 on page 3-12).

LAN Configuration 3-11

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Figure 3-5

2. Click Add. The Add Static Route screen will display.

Figure 3-6

3. Enter a name for the static route in the Route Name field (for identification purpose only).

4. Determine whether the route is:

• Active or Inactive. A route can be added to the Static Routes table and made inactive, if

not needed. This allows routes to be used as needed without deleting the entry and re­adding it. An inactive route is not broadcast if RIP is enabled. Select the Active radio box
to make this route effective.

• Private: Determine whether the route can be shared with other routers when RIP is

enabled. Select the Private radio box if you want to limit access to the LAN only. The
route will not be shared in a RIP broadcast or multicast.

5. Destination IP Address. Enter the IP address of the route’s final destination.

6. IP Subnet Mask. Enter the subnet mask of the route’s final destination. If the destination is a
single host, enter 255.255.255.255.

3-12 LAN Configuration

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

7. Interface. From the pull-down menu, select the physical network interface (Broadband­Virtual, Broadband-Ethernet, Dialup, or LAN) through which this route is accessible.

8. Gateway IP Address. Enter the IP address of the gateway through which the destination host
or network can be reached. (This must be a device on the same LAN segment as the VPN
firewall.)

9. Metric. Enter the metric value that determines the priority of the route. If multiple routes to
the same destination exist, the route with the lowest metric is chosen. Usually, a setting of 2 or
3 works, but if this is a direct connection, set it to 1.

10. Click Apply to save the static route to the Static Routes table.

Static Route Example

For example, a static route is needed if:

• You r primary Internet access is through a cable modem to an ISP.

• You have an ISDN firewall on your home network for connecting to the company where you
are employed. This firewall’s address on your LAN is 192.168.1.100.

• You r company’s network is 134.177.0.0.

When you first configured your VPN firewall, two implicit static routes were created. A default
route was created with your ISP as the gateway, and a second static route was created to your local
network for all 192.168.1.x addresses. With this configuration, if you attempt to access a device on
the 134.177.0.0 network, your VPN firewall will forward your request to the ISP. The ISP
forwards your request to the company where you are employed, and the request will likely be
denied by the company’s firewall.

In this case you must define a static route, telling your VPN firewall that 134.177.0.0 should be
accessed through the ISDN firewall at 192.168.1.100.

In this example:

• The destination IP address and IP subnet mask fields specify that this static route applies to all

134.177.x.x addresses.

• The gateway IP address fields specifies that all traffic for these addresses should be forwarded
to the ISDN firewall at 192.168.1.100.

• A metric value of 1 will work since the ISDN firewall is on the LAN.

• Private is selected only as a precautionary security measure in case RIP is activated.

LAN Configuration 3-13

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Configuring Routing Information Protocol (RIP)

RIP (Routing Information Protocol, RFC 2453) is an Interior Gateway Protocol (IGP) that is
commonly used in internal networks (LANs). It allows a router to exchange its routing information
automatically with other routers, and allows it to dynamically adjust its routing tables and adapt to
changes in the network. RIP is disabled by default.

To configure RIP:

1. Select Network Configuration from the main menu and Routing from the submenu. The
Routing screen will display (see Figure 3-5 on page 3-12).

2. Click the RIP Configuration link. The RIP Configuration screen will display.

Figure 3-7

3. From the RIP Direction pull-down menu, select the direction for the VPN firewall to send and
receive RIP packets:

• Both. The VPN firewall broadcasts its routing table and also processes RIP information

received from other routers.

• Out Only. The VPN firewall broadcasts its routing table periodically but does not accept

RIP information from other routers.

3-14 LAN Configuration

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

• In Only. The VPN firewall accepts RIP information from other routers, but does not

broadcast its routing table.

• None. The VPN firewall neither broadcasts its route table nor does it accept any RIP

packets from other routers. This effectively disables RIP.

4. Select the RIP Version from the pull-down menu:

• Disabled. The default section disables RIP versions.

• RIP-1. A class-based routing that does not include subnet information. This is the most

commonly supported version.

• RIP-2. This includes all the functionality of RIPv1 plus it supports subnet information.

Though the data is sent in RIP-2 format for both RIP-2B and RIP-2M, the modes in which
packets are sent are different.

– RIP-2B. Sends the routing data in RIP-2 format and uses subnet broadcasting.
– RIP-2M. Sends the routing data in RIP-2 format and uses multicasting.

5. Authentication for RIP2B/2M required? If you selected RIP-2B or RIP-2M, check the Yes
radio box to enable authentication, and enter the MD-5 keys to authenticate between devices in
the First Key Parameters and Second Key Parameters sections on the screen.

6. Click Apply to save your settings.

LAN Configuration 3-15

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

3-16 LAN Configuration

v1.0, January 2010

Chapter 4

Firewall Protection and Content Filtering

The ProSafe VPN Firewall 50 FVS338 provides you with Web content filtering options such as
block sites and keyword blocking. This chapter includes the following sections:

• “About Firewall Security and Content Filtering” on this page

• “Using Rules to Block or Allow Specific Kinds of Traffic” on page 4-2

• “Configuring Other Firewall Features” on page 4-15

• “Creating Services, QoS Profiles, and Bandwidth Profiles” on page 4-20

• “Setting a Schedule to Block or Allow Specific Traffic” on page 4-25

• “Blocking Internet Sites (Content Filtering)” on page 4-26

• “Configuring Source MAC Filtering” on page 4-29

• “Configuring IP/MAC Address Binding” on page 4-31

• “Configuring Port Triggering” on page 4-33

• “E-Mail Notifications of Event Logs and Alerts” on page 4-36

• “Administrator Tips” on page 4-36

About Firewall Security and Content Filtering

The VPN firewall provides you with Web content filtering options, plus browsing activity
reporting and instant alerts via e-mail. Parents and network administrators can establish restricted
access policies based on time-of-day, Web addresses and Web address keywords. You can also
block Internet access by applications and services, such as chat or games.

A firewall is a special category of router that protects one network (the “trusted” network, such as
your LAN) from another (the untrusted network, such as the Internet), while allowing
communication between the two. You can further segment keyword blocking to certain known
groups (see “Managing Groups and Hosts” on page 3-6 to set up LAN Groups).

A firewall incorporates the functions of a NAT (Network Address Translation) router, while
adding features for dealing with a hacker intrusion or attack, and for controlling the types of traffic
that can flow between the two networks. Unlike simple Internet sharing NAT routers, a firewall
uses a process called stateful packet inspection to protect your network from attacks and

4-1

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

intrusions. NAT performs a very limited stateful inspection in that it considers whether the
incoming packet is in response to an outgoing request, but true Stateful Packet Inspection goes far
beyond NAT.

Using Rules to Block or Allow Specific Kinds of Traffic

This section includes the following topics:

• “Services-Based Rules” on this page

• “Viewing the Firewall Rules” on page 4-7

• “Order of Precedence for Firewall Rules” on page 4-8

• “Setting the Default Outbound Policy” on page 4-8

• “Setting the Default Outbound Policy” on page 4-8

• “Modifying Rules” on page 4-10

• “Inbound Rules Examples” on page 4-11

• “Outbound Rules Example: Blocking Instant Messenger” on page 4-14

Firewall rules are used to block or allow specific traffic passing through from one side to the other.
You can configure up to 600 rules on the FVS338. Inbound rules (W AN to LAN) restrict access by
outsiders to private resources, selectively allowing only specific outside users to access specific
resources. Outbound rules (LAN to WAN) de termine what outside resources local users can have
access to.

A firewall has two default rules, one for inbound traffic and one for outbound. The default rules of
the VPN firewall are:

• Inbound. Block all access from outside except responses to requests from the LAN side.

• Outbound. Allow all access from the LAN side to the outside.

User-defined firewall rules for blocking or allowing traffic on the VPN firewall can be applied to
inbound or outbound traffic.

Services-Based Rules

The rules to block traffic are based on the traffic’s category of service.

• Inbound Rules (port forwarding). Inbound traffic is normally blo cked by the c unl ess the
traffic is in response to a request from the LAN side. The VPN firewall can be configured to
allow this otherwise blocked traffic.

4-2 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

• Outbound Rules (service blocking). Outbound traffic is normally allowed unless the VPN
firewall is configured to disallow it.

• Customized Services. Additional services can be added to the list of services in the factory
default list. These added services can then have rules defined for them to either allow or block
that traffic (see “Adding Customized Services” on page 4-20).

• Quality of Service (QoS). Each service at its own native priority that impacts its quality of
performance and tolerance for jitter or delays. You can change this QoS priority if desired to
change the traffic mix through the system (see “Specifying Quality of Service (QoS)

Priorities” on page 4-22).

Outbound Rules (Service Blocking)

The VPN firewall allows you to block the use of certain Internet services by PCs on your network.
This is called service blocking or port filtering.

Note: See “Configuring Source MAC Filtering” on page 4-29 for yet another way to

block outbound traffic from selected PCs that would otherwise be allowed by the
VPN firewall.

Table 4-1. Outbound Rules

Item Description

Services Select the desired service or application to be covered by this rule. If the desired service

or application does not appear in the list, you must define it using the Services screen
(see “Adding Customized Services” on page 4-20).

Action Select the desired action for outgoing connections covered by this rule:

• BLOCK always

• BLOCK by schedule, otherwise Allow

• ALLOW always

• ALLOW by schedule, otherwise Block
Note: Any outbound traffic that is not blocked by rules you create will be allowed by the
default rule.
ALLOW rules are only useful if the traffic is already covered by a BLOCK rule. That is,
you wish to allow a subset of traffic that is currently blocked by another rule.

Select Schedule Select the desired time schedule (Schedule1, Schedule2, or Schedule3) that will be

used by this rule.

• This pull-down menu gets activated only when “BLOCK by schedule, otherwise Allow”
or “ALLOW by schedule, otherwise Block” is selected as Action.

• Use the Schedule screen to configure the time schedules (see “Setting a Schedule to

Block or Allow Specific Traffic” on page 4-25).

Firewall Protection and Content Filtering 4-3

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Table 4-1. Outbound Rules (continued)

Item Description

LAN Users These settings determine which computers on your network are affected by this rule.

Select the desired options:

• Any – All PCs and devices on your LAN.

• Single address - Enter the required address and the rule will be applied to that
particular PC.

• Address range – If this option is selected, you must enter the start and finish fields.

• Groups – Select the Group you wish this rule to apply to. You can use the Network
Database screen to assign PCs to Groups. See “Managing Groups and Hosts” on

page 3-6.

WAN Users These settings determine which Internet locations are covered by the rule, based on

their IP address. Select the desired option:

• Any – All Internet IP address are covered by this rule.

• Single address – Enter the required address in the start fields.

• Address range – If this option is selected, you must enter the start and finish fields.

QoS Priority Specifies the priority of a service which, in turn, determines the quality of that service for

the traffic passing through the firewall. By default, the priority shown is that of the
selected service. The user can change it accordingly. If the user does not make a
selection (leaves it as Normal-Service), then the native priority of the service will be
applied to the policy. See “Specifying Quality of Service (QoS) Priorities” on page 4-22.

Log This determines whether packets covered by this rule are logged. Select the desired

action:

• Always – always log traffic considered by this rule, whether it matches or not. This is
useful when debugging your rules.

• Never – never log traffic considered by this rule, whether it matches or not.

Bandwidth
Profile

NAT IP Specifies whether the source IP address of the outgoing packets should be the WAN

NAT Single IP Is
On (interface)

Specifies the name of a bandwidth limiting profile. Using a bandwidth profile, bandwidth
consumed by different connections can be limited. If multiple connections correspond to
the same firewall rule, they will share the same bandwidth limiting. See “Creating

Bandwidth Profiles” on page 4-23 .

interface address or a specified address, which should belong to the WAN subnet.
Specifies to which WAN interface the NAT IP address belongs. All outgoing packets will

be routed through the specified WAN interface only.

Inbound Rules (Port Forwarding)

Because the VPN firewall uses Network Address Translation (NAT), your network presents only
one IP address to the Internet and outside users cannot directly address any of your local
computers. However, by defining an inbo und rule you can make a local server (for example, a Web

4-4 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

server or game server) visible and available to the Internet. The rule tells the VPN firewall to direct
inbound traffic for a particular service to one local server based on the destination port number.
This is also known as port forwarding.

Whether or not DHCP is enabled and how the PCs will access the server’s LAN address impact the
inbound rules. For example:

• If your external IP address is assigned dynamically by your ISP (DHCP enabled), the IP
address may change periodically as the DHCP lease expires. Consider using dynamic DNS so
that external users can always find your network (see “Configuring Dynamic DNS (Optional)”

on page 2-14).

• If the IP address of the local server PC is assigned by DHCP, it may change when the PC is
rebooted. To avoid this, use the Reserved IP address feature to keep the PC’s IP address
constant (see “Setting Up DHCP Address Reservation” on page 3-9).

• Local PCs must access the local server using the local LAN address of the PC. Attempts by
local PCs to access the server using the external WAN IP address will fail.

Note: See “Configuring Port Triggering” on page 4-33 for yet another way to allow

certain types of inbound traffic that would otherwise be blocked by the VPN
firewall.

Table 4-2. Inbound Rules Fields

Item Description

Services Select the desired service or application to be covered by this rule. If the desired

service or application does not appear in the list, you must define it using the
Services screen (see “Adding Customized Services” on page 4-20).

Action Select the desired action for packets covered by this rule:

• BLOCK always

• BLOCK by schedule, otherwise Allow

• ALLOW always

• ALLOW by schedule, otherwise Block
Note: Any inbound traffic which is not allowed by rules you create will be blocked by
the Default rule.

Select Schedule Select the desired time schedule (Schedule1, Schedule2, or Schedule3) that will be

used by this rule.

• This pull-down menu gets activated only when “BLOCK by schedule, otherwise
Allow” or “ALLOW by schedule, otherwise Block” is selected as Action.

• Use the Schedule screen to configure the time schedules.

Firewall Protection and Content Filtering 4-5

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Table 4-2. Inbound Rules Fields

Item Description

Send to LAN Server This field appears only with NAT routing (not classical routing). This LAN address or

range of LAN addresses determines which computer or computers on your network
are hosting this service rule. (You can also translate these addresses to a port
number.)

Translate to Port
Number

WAN Destination IP
Address

LAN Users These settings determine which computers on your network are affected by this rule.

WAN Users These settings determine which Internet locations are covered by the rule, based on

Log This determines whether packets covered by this rule are logged. Select the desired

Bandwidth Profile This setting determines the priority of a service, which in turn, determines the quality

Check this box and enter a port number to assign the LAN server to a different
service port number. Inbound traffic to the service port will have the destination port
number modified to the port number configured here.

These settings determine the destination IP address applicable to incoming traffic.
This is the public IP address that will map to the internal server; it can either be the
address of the broadband or dialup port, or of another public IP address

Select the desired options:

• Any – All PCs and devices on your LAN.

• Single address - Enter the required address and the rule will be applied to that
particular PC.

• Address range – If this option is selected, you must enter the start and finish fields.

• Groups – Select the group you wish this rule to apply to. You can use the Network
Database screen to assign PCs to groups. See “Managing Groups and Hosts” on

page 3-6.

their IP address. Select the desired option:

• Any – All Internet IP address are covered by this rule.

• Single address – Enter the required address in the start fields.

• Address range – If this option is selected, you must enter the start and finish fields.

action:

• Always – always log traffic considered by this rule, whether it matches or not. This
is useful when debugging your rules.

• Never – never log traffic considered by this rule, whether it matches or not.

of that service for the traffic passing through the VPN firewall. By default, the priority
shown is that of the selected service. The user can change it accordingly. If the user
does not make a selection (that is, leaves it as None), then the native priority of the
service will be applied to the policy. See “Creating Bandwidth Profiles” on page 4-23.

.

4-6 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Note: Some residential broadband ISP accounts do not allow you to run any server

processes (such as a Web or FTP server) from your location. Your ISP may
periodically check for servers and may suspend your account if it discovers any
active services at your location. If you are unsure, refer to the Acceptable Use
Policy of your ISP.

Remember that allowing inbound services opens holes in your VPN firewall. Only enable those
ports that are necessary for your network. It is also advisable to turn on the server application
security and invoke the user password or privilege levels, if provided.

Viewing the Firewall Rules

To view the firewall rules, select Security from the main menu and Firewall from the submenu.
The LAN WAN Rules screen will display (Figure 4-1 shows some examples).

Figure 4-1

Firewall Protection and Content Filtering 4-7

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Order of Precedence for Firewall Rules

As you define new rules, they are added to the tables on the LAN WAN Rules screen, as shown in

Figure 4-1 on page 4-7

For any traffic attempting to pass through the VPN firewall, the packet information is subjected to
the rules in the order shown in the Outbound Services and Inbound Services rules tables,
beginning at the top and proceeding to the default rules at the bottom. In some cases, the order of
precedence of two or more rules may be important in determining the disposition of a packet. For
example, you should place the most strict rules at the top (those with the most specific services or
addresses). The Up and Down buttons allow you to relocate a defined rule to a new position in the
table.

Setting the Default Outbound Policy

The default outbound policy is to allow all traffic from and to the Internet to pass through. Firewall
rules can then be applied to block specific types of traffic from either going out from the LAN to
the Internet (Outbound) or coming in from the Internet to the LAN (Inbound). The default policy
can be changed to block all outbound traffic and enable only specific services to pass through the
VPN firewall.

To change the default outbound policy:

1. Select Security from the main menu and Firewall Ru les from the submenu. The LAN WAN

Rules screen will display (see Figure 4-1 on page 4-7).

2. Change the Default Outbound Policy by selecting Block Always from the pull-down menu.

3. Click Apply.

Creating a LAN WAN Outbound Services Rule

You may define additional rules that will specify exceptions to the default rules. By adding custom
rules, you can block or allow access based on the service or application, source or destination IP
addresses, and time of day.

You can also tailor these rules to your specific needs (see “Administrator Tips” on page 4-36).

Note: This feature is for advanced administrators only! Incorrect configuration will cause

serious problems.

4-8 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

To create a new outbound service rule:

1. In the LAN WAN Rules screen, click add under the Outbound Services table. The Add LAN

WAN Outbound Service screen will display.

Figure 4-2

2. Configure the settings as explained in Table 4-1 on page 4-3.

3. Click Apply to save your changes and reset the fields on this screen. The new rule will be
listed on the Outbound Services table on the LAN WAN Rules screen.

Creating a LAN WAN Inbound Services Rule

The Inbound Services table lists all existing rules for inbound traffic. If you have not defined any
rules, no rules will be listed. By default, all inbound traffic is blocked. Remember that allowing
inbound services opens holes in your firewall. Only enable those ports that are necessary for your
network.

To create a new inbound service rule in the LAN WAN Rules screen:

1. In the LAN WAN Rules screen, click add under the Inbound Services table. The Add LAN
WAN Inbound Service screen will display.

Firewall Protection and Content Filtering 4-9

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Figure 4-3

2. Configure the settings as explained in Table 4-2 on page 4-5.

3. Click Apply to save your settings. The new rule will be added to the Inbound Services table

on the LAN WAN Rules screen.

Modifying Rules

To make changes to an existing outbound or inbound service rule on the the LAN WAN Rules
screen, in the Action column to the right of to the rule, click on of the following table buttons:

• edit. Allows you to make any changes to the rule definition of an existing rule. Depending on
your selection, either the Edit LAN WAN Outbound Service screen (identical to Figure 4-2 on

page 4-9) or Edit LAN WAN Inbound Service screen (identical to Figure 4-3 on page 4-10)

displays, containing the data for the selected rule.

• up. Moves the rule up one position in the table rank.

• down. Moves the rule down one position in the table rank.

To enable, disable, or delete one or more rules:

1. Select the checkbox to the left of the rule that you want to delete or disable or click the select
all table button to select all rules.

4-10 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

2. Click one of the following table buttons:

• enable. Enables the rule or rules. The “!” status icon changes from a grey circle to a green

circle, indicating that the rule is or rules are enabled. (By default, when a rule is added to
the table, it is automatically enabled.)

• disable. Disables the rule or rules. The “!” status icon changes from a green circle to a

grey circle, indicating that the rule is or rules are disabled.

• delete. Deletes the rule or rules.

Inbound Rules Examples

LAN WAN Inbound Rule: Hosting a Local Public Web Server

If you host a public W e b server on your local network, you can define a rule to allow inbound Web
(HTTP) requests from any outside IP address to the IP address of your Web server at any time of
day. In the example shown in Figure 4-4, unrestricted access is provided from the Internet to the
local Web server at LAN IP address 192.168.1.99.

Figure 4-4

Firewall Protection and Content Filtering 4-11

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

LAN WAN Inbound Rule: Allowing Videoconference from Restricted Addresses

If you want to allow incoming videoconferencing to be initiated from a restricted range of outside
IP addresses, such as from a branch office, you can create an inbound rule. In the example shown
in Figure 4-5, CU-SeeMe connections are allowed only from a specified range of external IP
addresses. Connections are blocked during the period specified by Schedule 1.

Figure 4-5

LAN WAN Inbound Rule: Setting Up One-to-One NAT Mapping

If you arrange with your ISP to have more than one public IP address for your use, you can use the
additional public IP addresses to map to servers on your LAN. One of these public IP addresses
will be used as the primary IP address of the VPN firewall. This address will be used to provide
Internet access to your LAN PCs through NAT. The other addresses are available to map to your
servers.

In the example shown in Figure 4-6 on page 4-13, we have configured multi-NAT to support
multiple public IP addresses on one WAN interface. The inbound rule instructs the VPN firewall
to host an additional public IP address (10.1.0.5) and to associate this address with the W eb server
on the LAN (at 192.168.0.1). We also instruct the VPN firewall to translate the incoming HTTP
port number (port 80) to a different port number (port 8080).

4-12 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

The following addressing scheme is used in this example:

• VPN firewall:
– WAN primary public IP address: 10.1.0.1
– WAN additional public IP address: 10.1.0.5
– LAN IP address 192.168.1.1

• Web server PC on the VPN firewall’s LAN
– LAN IP address: 192.168.1.75
– Port number for Web service: 8080

Figure 4-6

T o test the connection from a PC on the WAN side, type http://10.1.0.5. The home page of the
Web server should appear.

LAN WAN Inbound Rule: Specifying an Exposed Host

Specifying an exposed host allows you to set up a computer or server that is available to anyone on
the Internet for services that you have not yet defined.

To expose one of the PCs on your LAN as this host:

1. Create an inbound rule that allows all protocols.

Firewall Protection and Content Filtering 4-13

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

1. Select All protocols and ALLOW Always (or Allow by Schedule)

2. Place rule below all other inbound rules

2. Place the rule below all other inbound rules.

Figure 4-7 shows the bottom part of the LAN WAN Rules screen with an example of the Inbound

Services table.

Note: For security, NETGEAR strongly recommends that you avoid creating an exposed

host. When a computer is designated as the exposed host, it loses much of the
protection of the firewall and is exposed to many exploits from the Internet. If
compromised, the computer can be used to attack your network.

Figure 4-7

Outbound Rules Example: Blocking Instant Messenger

Outbound rules let you prevent users from using applications such as Instant Messenger, Real
Audio, or other non-essential sites.

If you want to block Instant Messenger usage by employees during working hours, you can create
an outbound rule to block that application from any internal IP address to any external address
according to the schedule that you have created on the Schedule screen. You can also have the
VPN firewall log any attempt to use Instant Messenger during that blocked period. See Figure 4-8

on page 4-15.

4-14 Firewall Protection and Content Filtering

v1.0, January 2010

.

Figure 4-8

ProSafe VPN Firewall 50 FVS338 Reference Manual

Configuring Other Firewall Features

You can configure attack checks, set session limits, and manage the Application Level Gateway
(ALG) for SIP sessions.

Attack Checks

The Attack Checks screen allows you to specify whether or not the VPN firewall should be
protected against common attacks in the LAN and WAN networks.

To enable the appropriate Attack Checks for your environment:

1. Select Security from the main menu and Firewall from the submenu. The LAN WAN Rules
screen displays.

2. Click the Attack Checks tab. The Attack Checks screen will display (see Figure 4-9 on page

4-16).

Firewall Protection and Content Filtering 4-15

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Figure 4-9

3. Check the boxes for the attack checks that you wish to monitor. The various types of attack
checks are listed and defined below.

4. Click Apply to save your settings.

The various types of attack checks listed on the Attack Checks screen are:

• WAN Security Checks

– Respond To Ping On Internet Ports. By default, the VPN firewall responds to an ICMP

Echo (ping) packet coming from the Internet or WAN side. Responding to a ping can be a
useful diagnostic tool when there are connectivity problems. If the ping option is enabled,
you can allow either any IP address or a specific IP address only to respond to a ping. You
can disable the ping option to prevent hackers from easily discovering the VPN firewall
via a ping.

– Enable Stealth Mode. If stealth mode, the VPN firewall will not respond to port scans

from the WAN, thus making it less susceptible to discovery and attacks.

– Block TCP Flood. A SYN flood is a form of denial of service attack in which an attacker

sends a succession of SYN requests to a target system. When the system responds, the
attacker does not complete the connections, thus leaving the connection half-open and
flooding the server with SYN messages. No legitimate connections can then be made.

4-16 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

When blocking is enabled,, the VPN firewall will drop all invalid TCP packets and will be
protected from a SYN flood attack.

• LAN Security Checks.

– A UDP flood is a form of denial of service attack that can be initiated when one machine

sends a large number of UDP packets to random ports on a remote host. As a result, the
distant host will (1) check for the application listening at that port, (2) verify that no
application is listening at that port, and then (3) reply with an ICMP Destination
Unreachable packet.

When the victimized system is flooded, it is forced to send many ICMP packets,
eventually making it unreachable by other clients. The attacker may also spoof the IP
address of the UDP packets, ensuring that the excessive ICMP return packets do not reach
him, thus making the attacker’s network location anonymous.

If enabled, the VPN firewall will not accept more than 20 simultaneo us , ac tiv e UD P
connections from a single computer on the LAN.

– Disable Ping Reply on LAN Ports. T o prevent the VPN firewall from responding to Ping

requests from the LAN, click this checkbox.

• VPN Pass through. When the VPN firewall is in NAT mode, all packets going to the remote
VPN gateway are first filtered through NAT and then encrypted per the VPN policy.

For example, if a VPN Client or Gateway on the LAN side of this VPN firewall wants to
connect to another VPN endpoint on the WAN (placing this VPN firewall between two VPN
end points), encrypted packets will be sent to this VPN firewall. Since this VPN firewall filters
the encrypted packets through NAT, the packets will become invalid unless VPN Pass through
is enabled.

IPSec, PPTP, and L2TP represent different types of VPN tunnels that can pass through the
VPN firewall. T o allow the VPN traffic to pass through without filtering, enable those options
for the type of tunnel(s) that will pass through the VPN firewall. By default, IPSec, PPTP, and
L2TP are selected.

Configuring Session Limits

To prevent one user or group from using excessive system resources, you can limit the total
number of IP sessions allowed through the VPN firewall for an individual or group. You can
specify the maximum number of sessions by either a percentage of maximum sessions or an
absolute number of maximum sessions. Session limiting is disabled by default.

Firewall Protection and Content Filtering 4-17

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

To configure session limits:

1. Select Security from the main menu and Firewall from the submenu. The LAN WAN Rules
screen displays.

2. Click the Session Limit tab. The Session Limits screen will display.

Figure 4-10

To enable session limits:

3. Click the Yes radio button under Do you want to enable Session Limit?

4. From the User Limit Parameter drop-down menu, define the maximum number of sessions

per IP either as a percentage of maximum sessions or as an absolute value.
The percentage is computed on the total connection capacity of the device.

5. Enter the User Limit. If the User Limit Parameter is set to Percentage of Max Sessions, the
limit is the maximum number of sessions allowed from a single source machine as a
percentage of the total connection capacity. (Session Limit is a machine-based value.)
Otherwise, when the User Limit Parameter is set to Number of Sessions, the limit is an
absolute value.

Note: Some protocols (such as FTP or RSTP) create two sessions per connection

which should be considered when configuring session limiting.

4-18 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

The Total Number of Packets Dropped due to Session Limit field shows total number of
packets dropped when session limit is reached.

6. In the Session Timeout section, modify the TCP, UDP and ICMP timeout values as you
require. A session will expire if no data for the session is received for the duration of the
timeout value. The default timeout values are 1200 seconds for TCP sessions, 180 seconds for
UDP sessions, and 8 seconds for ICMP sessions.

7. Click Apply to save your settings.

Managing the Application Level Gateway for SIP Sessions

The Application Level Gateway (ALG) facilitates multimedia sessions such as voice over IP
(VoIP) sessions that use the Session Initiation Protocol (SIP) across the firewall and provides
support for multiple SIP clients. ALG support for SIP is disabled by default.

To enable ALG for SIP:

1. Select Security from the main menu and Firewall Ru les from the submenu. The LAN WAN
Rules screen will display.

2. Click the Advanced tab. The Advanced screen will display.

Figure 4-11

3. Select the Enable SIP ALG checkbox.

4. Click Apply to save your settings.

Firewall Protection and Content Filtering 4-19

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Creating Services, QoS Profiles, and Bandwidth Profiles

When you create inbound and outbound firewall rules, you use firewall objects such as services,
QoS profiles, bandwidth profiles, and schedules to narrow down the firewall rules:

• Services. A service narrows down the firewall rule to an application and a port number. For
information about adding services, see “Adding Customized Services” on page 4-20.

• QoS profiles. A quality of service (QoS) profile defines the relative priority of an IP packet
for traffic that matches the firewall rule. For information about creating QoS profiles, see

“Specifying Quality of Service (QoS) Priorities” on page 4-22.

• Bandwidth Profiles. A bandwidth profile allocates and limits traffic bandwidth for the LAN
users to which a firewall rule is applied. For information about creating bandwidth profiles,
see “Creating Bandwidth Profiles” on page 4-23.

Note: A schedule narrows down the period during which a firewall rule is applied. For

information about specifying schedules, see “Setting a Schedule to Block or Allow

Specific Traffic” on page 4-25.

Adding Customized Services

Services are functions performed by server computers at the request of client computers. You can
configure up to 125 custom services.

For example, Web servers serve Web pages, time servers serve time and date information, and
game hosts serve data about other players’ moves. When a computer on the Internet sends a
request for service to a server computer, the requested service is identified by a service or port
number. This number appears as the destination port number in the transmitted IP packets. For
example, a packet that is sent with destination port number 80 is an HTTP (Web server) request.

The service numbers for many common protocols are defined by the Internet Engineering Task
Force (IETF) and published in RFC1700, “Assigned Internet Protocol Numbers.” Service numbers
for other applications are typically chosen from the range 1024 to 65535 by the authors of the
application.

Although the VPN firewall already holds a list of many service port numbers, you are not limited
to these choices. Use the Services screen to add additional services and applications to the list for
use in defining firewall rules. The Services screen shows a list of services that you have defined, as
shown in Figure 4-12 on page 4-21.

4-20 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

To define a new service, first you must determine which port number or range of numbers is used
by the application. This information can usually be determined by contacting the publisher of the
application or from user groups of newsgroups. When you have the port number information, you
can enter it on the Services screen.

To add a service:

1. Select Security from the main menu and Services from the submenu. The Services screen will
display.

Figure 4-12

2. In the Add Custom Service table, enter a descriptive name for the service (this is for your
convenience).

3. Select the Layer 3 Protocol that the service uses as its transport protocol. It can be TCP, UDP
or ICMP.

4. Enter the first TCP or UDP port of the range that the service uses. If the service uses only one
port, then the Start Port and the Finish Port will be the same.

5. Enter the last port of the range that the service uses. If the service only uses a single port
number, enter the same number in both fields.

6. Click Add. The new custom service will be added to the Custom Services Table.

Firewall Protection and Content Filtering 4-21

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Modifying a Service

To edit the parameters of a service:

1. In the Custom Services T able, click the edit icon adjacent to the service you want to edit. The
Edit Service screen will display.

2. Modify the parameters you wish to change.

3. Click Apply to confirm your changes. The modified service will display in the Custom
Services Table.

Specifying Quality of Service (QoS) Priorities

The Quality of Service (QoS) Priorities setting determines the priority of a service, which in turn,
determines the quality of that service for the traffic passing through the firewall. The user can
change this priority:

• On the Services screen in the Customer Services Table for customized services (see

Figure 4-12 on page 4-21).

• On the LAN WAN Outbound Services screen (see Figure 4-8 on page 4-15).

The QoS priority definition for a service determines the queue that is used for the traffic passing
through the VPN firewall. A priority is assigned to IP packets using this service. Priorities are
defined by the “Type of Service (ToS) in the Internet Protocol Suite” standards, RFC 1349. A ToS
priority for traffic passing through the VPN firewall is one of the following:

• Normal-Service. No special priority given to the traffic. The IP packets for services with this
priority are marked with a ToS value of 0.

• Minimize-Cost. Used when data has to be transferred over a link that has a lower “cost”. The
IP packets for services with this priority are marked with a ToS value of 1.

• Maximize-Reliability. Used when data needs to travel to the destination over a reliable link
and with little or no retransmission. The IP packets for services with this priority are marked
with a ToS value of 2.

• Maximize-Throughput. Used when the volume of data transferred during an interval is
important even if the latency over the link is high. The IP packets for services with this priority
are marked with a ToS value of 4.

• Minimize-Delay. Used when the time required (latency) for the packet to reach the destination
must be low. The IP packets for services with this priority are marked with a ToS value of 8.

4-22 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Creating Bandwidth Profiles

Bandwidth limiting determines the way in which the data is communicated with your host. The
purpose of bandwidth limiting is to provide a solution for limiting the traffic, thus preventing the
LAN users from consuming all the bandwidth on your WAN link.

For example, when a new connection is established by a device, the device will locate the firewall
rule corresponding to the following connections:

• If the rule has a bandwidth profile specification, then the device will create a bandwidth class
in the kernel.

• If multiple connections correspond to the same firewall rule, they will share the same class.

An exception occurs in the case of an individual type bandwidth profile if the classes are per
source IP. The source IP is the IP of the first packet of the connection.

The class is deleted when all the connections using the class expire.
To add a bandwidth profile:

1. Select Security from the main menu and Bandwidth Profile from the submenu. The
Bandwidth Profile screen will display.

Figure 4-13

2. Click add to add a new Bandwidth Profile. The Add New Bandwidth Profile screen will
display (see Figure 4-14 on page 4-24).

Firewall Protection and Content Filtering 4-23

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Figure 4-14

3. Enter the following data:
a. Enter a Profile Name. This name will become available in the firewall rules definition

menus.

b. From the Direction pull-down box, select whether the profile will apply to outbound,

inbound, or both outbound and inbound traffic.

c. Depending on the direction that you selected, enter the minimum and maximum

bandwidths to be allowed:

• Enter the Outbound Minimum Bandwidth and Outbound Maximum Bandwidth

in Kbps.

• Enter the Inbound Minimum Bandwidth and Inbound Maximum Bandwidth in

Kbps.

The minimum bandwidth can range from 0 Kbps to the maximum bandw idth that you
specify. The maximum bandwidth can range from 100 Kbps to 100,000 Kbps.

d. From the Type pull-down box, select whether the profile will apply to a group or

individual.

e. From the WAN pull-down box, specify the WAN interface (if in Load Balancing Mode)

for the profile.

4. Click Apply. The new bandwidth profile will be added to the List of Bandwidth Profiles
table.

4-24 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

To edit a bandwidth profile:

1. Click the edit link adjacent to the profile you want to edit. The Edit Bandwidth Profile screen
is displayed. (This screen shows the same fields as the Add New Bandwidth Profile screen.)

2. Modify the settings that you wish to change.

3. Click Apply. Your modified profile will display in the Bandwidth Profile table.

To remove an entry from the table, select the profile and click delete.
To remove all the profiles, click select all and then click delete.

Setting a Schedule to Block or Allow Specific Traffic

Schedules define the time frames under which firewall rules may be applied.
Three schedules, Schedule 1, Schedule 2 and Schedule 3 can be defined, and any one of these can

be selected when defining firewall rules.
To invoke rules based on a schedule, follow these steps:

1. Select Security from the main menu and Schedule from the submenu. The Schedule 1 screen
will display.

Figure 4-15

Firewall Protection and Content Filtering 4-25

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

2. Check the radio button for All Days or Specific Days. If you chose Specific Days, check the
radio button for each day you want the schedule to be in effect.

3. Check the radio button to schedule the time of day: All Day, or Specific Times. If you chose
Specific Times, enter the Start Time and End Time fields (Hour, Minute, AM/PM), which

will limit access during certain times for the selected days.

4. Click Apply to save your settings to Schedule 1.

Repeat these steps to set to a schedule for Schedule 2 and Schedule 3.

Blocking Internet Sites (Content Filtering)

If you want restrict internal LAN users from access to certain sites on the Internet, you can use the
VPN firewall’s Content Filtering and Web Components filtering. By default, these features are
disabled; all requested traffic from any website is allowed. If you enable one or more of these
features and users try to access a blocked site, they will see a “Blocked by NETGEAR” message.

Several types of blocking are available:

• Web Components blocking. You can block the following Web component types: Proxy, Java,
ActiveX, and Cookies. Some of these components are can be used by malicious websites to
infect computers that access them. Even sites on the Trusted Domains list will be subject to
Web Components blocking when the blocking of a particular Web component is enabled.

– Proxy. A proxy server (or simply, proxy) allows computers to route connections to other

computers through the proxy, thus circumventing certain firewall rules. For example, if
connections to a specific IP address are blocked by a firewall rule, the requests can be
routed through a proxy that is not blocked by the rule, rendering the restriction ineffective.
Enabling this feature blocks proxy servers.

– Java. Blocks java applets from being downloaded from pages that contain them. Java

applets are small programs embedded in web pages that enable dynamic functionality of
the page. A malicious applet can be used to compromise or infect computers. Enabling this
setting blocks Java applets from being downloaded.

– ActiveX. Similar to Java applets, ActiveX controls install on a Windows computer

running Internet Explorer. A malicious ActiveX control can be used to compromise or
infect computers. Enabling this setting blocks ActiveX applets from being downloaded.

4-26 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

– Cookies. Cookies are used to store session information by websites that usually require

login. However, several websites use cookies to store tracking information and browsing
habits. Enabling this option filters out cookies from being created by a website.

Note: Many websites require that cookies be accepted in order for the site to be

accessed properly. Blocking cookies may interfere with useful functions
provided by these websites.

• Keyword Blocking (Domain Name Blocking). You can specify up to 32 words that, should
they appear in the website name (URL) or in a newsgroup name, will cause that site or
newsgroup to be blocked by the VPN firewall.

You can apply the keywords to one or more groups. Requests from the PCs in the groups for
which keyword blocking has been enabled will be blocked. Blocking does not occur for the
PCs that are in the groups for which keyword blocking has not been enabled.

You can bypass keyword blocking for trusted domains by adding the exact matching domain
to the list of Trusted Domains. Access to the domains or keywords on this list by PCs, even
those in the groups for which keyword blocking has been enabled, will still be allowed without
any blocking.

Keyword Blocking application examples:

• If the keyword “XXX” is specified, the URL <http://www.badstuff.com/xxx.html> is blocked,
as is the newsgroup alt.pictures.XXX.

• If the keyword “.com” is specified, only websites with other domain suffixes (such as .edu
or.go v) can be viewed.

• If you wish to block all Internet browsing access, enter the keyword “.”.

To enable Content Filtering:

1. Select Security from the main menu and Block Sites from the submenu. The Block Sites
screen will display (see Figure 4-16 on page 4-28).

Firewall Protection and Content Filtering 4-27

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Figure 4-16

4-28 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

2. Check the Yes radio button to enable content filtering.

3. Click Apply to activate the screen controls.

4. Check the radio boxes of any web components that you wish to block.

5. Check the radio buttons of the groups to which you wish to apply keyword blocking. Click
enable to activate keyword blocking (or disable to deactivate keyword blocking).

6. Build your list of blocked keywords or domain names in the Blocked Keyword fields. After

each entry, click add. The keyword or domain name will be added to the Blocked Keywords
table. (You can also edit an entry by clicking edit in the Action column adjacent to the entry.)

7. Build a list of trusted domains in the Trusted Domains fields. After each entry, click Add.
The trusted domain will appear in the T rusted Domains table. (You can also edit any entry by
clicking edit in the Action column adjacent to the entry.)

Configuring Source MAC Filtering

Source MAC filtering allows you to filter out traffic coming from certain known machines or
devices.

• By default, the source MAC address filter is disabled. All the traffic received from PCs with
any MAC address is allowed by default.

• When enabled, traffic will be dropped coming from any computers or devices whose MAC
addresses are listed in Available MAC Addresses to be Blocked table.

Note: For additional ways of restricting outbound traffic, see “Creating a LAN WAN

Outbound Services Rule” on page 4-8.

To enable MAC filtering and add MAC addresses to be blocked:

1. Select Security from the main menu and Source MAC Filter from the submenu. The Source
MAC Filter screen will display (see Figure 4-17 on page 4-30).

Firewall Protection and Content Filtering 4-29

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Figure 4-17

2. Check the Yes radio box in the MAC Filtering Enable section.

3. Select the action to be taken on outbound traffic from the listed MAC addresses:

• Block this list and permit all other MAC addresses.

• Permit this list and block all other MAC addresses.

4. Enter a MAC Address in the Add Source MAC Address checkbox and click add. The MAC
address will appear in the MAC Addresses table. Repeat this process to add additional MAC
addresses.

A valid MAC address is six colon-separated pairs of hexadecimal digits (0 to 9 and a to f). For
example: 01:23:45:ab:cd:ef.

5. When you have completed adding MAC addresses, click Apply to save your settings.

You can edit the MAC address by clicking edit in the Action column adjacent to the MAC
Address.

To remove an entry from the table, select the MAC address entry and click delete.
To select all the list of MAC addresses, click select all. A checkmark will appear in the box to the

left of each MAC address in the MAC Addresses table

4-30 Firewall Protection and Content Filtering

v1.0, January 2010

.

ProSafe VPN Firewall 50 FVS338 Reference Manual

Configuring IP/MAC Address Binding

IP/MAC binding allows you to bind an IP address to a MAC address and the other way around.
Some devices are configured with static addresses. To prevent users from changing their static IP
addresses, IP/MAC binding must be enabled on the VPN firewall. If the VPN firewall detects
packets with a matching IP address, but with the inconsistent MAC address (or the other way
around), it will drop these packets. If users have enabled the logging option for IP/MAC binding,
these packets will be logged before they are dropped. The VPN firewallwill then display the total
number of dropped packets that violated either the IP-to-MAC binding or the MAC-to-IP binding.

Following is an example:
Assume that three computers on the LAN are set up as follows:

• Host1: MAC address (00:01:02:03:04:05) and IP address (192.168.10.10)

• Host2: MAC address (00:01:02:03:04:06) and IP address (192.168.10.11)

• Host3: MAC address (00:01:02:03:04:07) and IP address (192.168.10.12)

If all the above host entries are added to the IP/MAC Binding table, the following scenarios
indicate the possible outcome.

• Host1: Matching IP and MAC address in the IP/MAC Bindings table.

• Host2: Matching IP address but inconsistent MAC address in the IP/MAC Bindings table.

• Host3: Matching MAC address but inconsistent IP address in the IP/MAC Bindings table.

The VPN firewall will block the traffic coming from Host2 and Host3, but allow the traf fic coming
from Host1 to any external network. The total count of dropped packets will be displayed.

Firewall Protection and Content Filtering 4-31

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

To enable IP/MAC Binding and add IP and MAC address for binding:

1. Select Security from the main menu and IP/MAC Binding from the submenu. The IP/MAC
Binding screen will display.

Figure 4-18

2. Select the Yes radio box and click Apply. Make sure that you have enabled the e-maling of
logs (see “Activating Notification of Events and Alerts” on page 6-23).

3. Add an IP/MAC Bind rule by entering:
a. Name. Specify an easily identifiable name for this rule.
b. MAC Address. Specify the MAC Address for this rule.
c. IP Addresses. Specify the IP Address for this rule.
d. Log Dropped Packets. Select the logging option for this rule from the pull-down menu.

4. Click add. The new IP/MAC rule will be appear the IP/MAC Bindings table.

The IP/MAC Binding Table lists the currently defined IP/MAC Bind rules:

• Name. Displays the user-defined name for this rule.

• MAC Addresses. Displays the MAC Addresses for this rule.

• IP Addresses. Displays the IP Addresses for this rule.

• Log Dropped Packets. Displays the logging option for this rule.

4-32 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

To edit an IP/MAC Bind rule, click edit adjacent to the entry. The following fields of an existing
IP/MAC Bind rule can be modified:

• MAC Address. Specify the MAC Address for this rule.

• IP Addresses. Specify the IP Address for this rule.

• Log Dropped Packets. Specify the logging option for this rule.

To remove an entry from the table, select the IP/MAC Bind entry and click delete.
To see the counter that shows the packets that were dropped because of IP-MAC binding

violations and to set the poll interval, click the Set Poll Interval link at the top of the IP/MAC
Binding screen.

Configuring Port Triggering

Port triggering allows some applications to function correctly that would otherwise be partially
blocked by the VPN firewall when it functions in NAT mode. Some applications require that when
external devices connect to them, they receive data on a specific port or range of ports. The VPN
firewall must send all incoming data for that application only on the required port or range of
ports. Using this feature requires that you know the port numbers used by the application.

Port triggering allows computers on the private network (LAN) to request that one or more ports
be forwarded to them. Unlike basic port forwarding which forwards ports to only one
preconfigured IP address, port triggering waits for an outbound request from the private network
on one of the defined outgoing ports. It then automatically sets up forwarding to the IP address that
sent the request. When the application ceases to transmit data over the port, the VPN firewall waits
for a timeout interval and then closes the port or range of ports, making them available to other
computers on the private network.

Once configured, port triggering operates as follows:

1. A PC makes an outgoing connection using a port number defined in the Port T riggering table.

2. The VPN firewall records this connection, opens the additional incoming port or ports
associated with this entry in the Port Triggering table, and associates them with the PC.

3. The remote system receives the PCs request and responds using the different port numbers that
you have now opened.

4. The VPN firewall matches the response to the previous request, and forwards the response to
the PC.

Without port triggering, this response would be treated as a new connection request rather than a
response. As such, it would be handled in accordance with the port forwarding rules:

Firewall Protection and Content Filtering 4-33

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Note these restrictions with port triggering:

• Only one PC can use a port triggering application at any time.

• After a PC has finished using a port triggering application, there is a Time-out period before
the application can be used by another PC. This is required because this VPN firewall cannot
be sure when the application has terminated.

Note: For additional ways of allowing inbound traffic, see “Creating a LAN WAN

Inbound Services Rule” on page 4-9.

To add a port triggering rule:

1. Select Security from the main menu and Port Triggering from the submenu. The Port
Triggering screen will display.

Figure 4-19

2. Enter a user-defined name for this rule in the Name field.

3. From the Enable pull-down menu, indicate if the rule is enabled or disabled.

4. From the Protocol pull-down menu, select either TCP or UDP protocol.

5. In the Outgoing (Trigger) Port Range fields;
a. Enter the Start Port range (1 - 65534).
b. Enter the End Port range (1 - 65534).

4-34 Firewall Protection and Content Filtering

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

6. In the Incoming (Response) Port Range fields:
a. Enter the Start Port range (1 - 65534).
b. Enter the End Port range (1 - 65534).

7. Click add. The port triggering Rule will be added to the Port Triggering Rules table.

To edit or modify a rule:

1. Click edit in the Action column opposite the rule you wish to edit. The Edit Port Triggering
Rule screen will display.

Figure 4-20

2. Modify any of the fields for this rule.

3. Click Apply to save your modifications. Your changes will appear in the Port Triggering
Rules table.

To check the status of the port triggering rules, click the Status link on the Port Triggering screen.

Figure 4-21

Firewall Protection and Content Filtering 4-35

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

E-Mail Notifications of Event Logs and Alerts

The firewall logs can be configured to log and then e-mail denial of access, general attack
information, and other information to a specified e-mail address. For example, your VPN firewall
will log security-related events such as: accepted and dropped packets on different segments of
your LAN; denied incoming and outgoing service requests; hacker probes and login attempts; and
other general information based on the settings that you enter on the Firewall Logs & E-mail
screen. In addition, if you have set up content filtering on the Block Sites screen (see “Blocking

Internet Sites (Content Filtering)” on page 4-26), a log will be generated when someone on your

network tries to access a blocked site.
To configure e-mail or syslog notification, or to view the logs, see “Activating Notification of

Events and Alerts” on page 6-23.

Administrator Tips

Consider the following operational items:

• As an option, you can enable remote management if you have to manage distant sites from a
central location (see “Enabling Remote Management Access” on page 6-14).

• Although setting firewall rules (see “Using Rules to Block or Allow Specific Kinds of Traf fic”

on page 4-2) is the basic way of managing the traffic through your system, you can further

refine your control with the following features of the VPN firewall:
– Groups and hosts (see “Managing Groups and Hosts” on page 3-6)
– Services (see “Services-Based Rules” on page 4-2)
– Schedules (see “Setting a Schedule to Block or Allow Specific Traffic” on page 4-25)
– Block sites (see “Blocking Internet Sites (Content Filtering)” on page 4-26)
– Source MAC filtering (see “Configuring Source MAC Filtering” on page 4-29)
– Port triggering (see “Configuring Port Triggering” on page 4-33)

4-36 Firewall Protection and Content Filtering

v1.0, January 2010

Chapter 5

Rest of

Firewall

Functions

Firewall
WAN Port
Functions

Firewall

Rollover

Control

Firewall

WAN 1 Port

WAN 2 Port

Internet

Same FQDN required for both WAN ports

WAN Auto-Rollover: FQDN Required for VPN

Virtual Private Networking

This chapter describes how to use the Virtual Private Networking (VPN) features of the ProSafe
VPN Firewall 50 FVS338. This chapter includes the following sections:

• “Considerations for Dual WAN Port Systems” on this page

• “Using the VPN Wizard for Client and Gateway Configurations” on page 5-2

• “Testing the Connections and Viewing Status Information” on page 5-12

• “Managing VPN Policies” on page 5-15

• “Managing Certificates” on page 5-19

• “Extended Authentication (XAUTH) Configuration” on page 5-26

• “Assigning IP Addresses to Remote Users (ModeConfig)” on page 5-32

• “Configuring Keepalives and Dead Peer Detection” on page 5-42

• “Configuring NetBIOS Bridging with VPN” on page 5-44

Considerations for Dual WAN Port Systems

If both of the WAN ports of the VPN firewall are configured, you can enable Auto-Rollover mode
for increased system reliability. Selecting Auto-Rollover mode impacts how the VPN features
must be configured.

The use of fully qualified domain names in VPN policies is mandatory when the WAN ports are in
rollover mode.

The diagram and table below shows how the WAN mode selection relates to VPN configuration.

Figure 5-1

v1.0, January 2010

5-1

ProSafe VPN Firewall 50 FVS338 Reference Manual

Table 5-1 summarizes the WAN addressing requirements for Auto-Rollover mode.

Table 5-1. IP Addressing for VPNs in Dual WAN Port Systems

Configuration WAN IP address Rollover Mode

VPN Road Warrior (client-to-gateway) Fixed or DHCP FQDN required
VPN Gateway-to-Gateway Fixed or DHCP FQDN required
VPN Telecommuter (client-to-gateway NAT router) Fixed or DHCP FQDN required

a. All tunnels must be re-established after a rollover using the new WAN IP address.

a

Using the VPN Wizard for Client and Gateway Configurations

You use the VPN Wizard to configure multiple gateway or client VPN tunnel policies.
The section below provides wizard and NETGEAR VPN Client configuration procedures for the

following scenarios:

• Using the wizard to configure a VPN tunnel between 2 VPN gateways

• Using the wizard to configure a VPN tunnel between a VPN gateway and a VPN client
Configuring a VPN tunnel connection requires that all settings and parameters on both sides of the

VPN tunnel match or mirror each other precisely, which can be a daunting task. The VPN Wizard
efficiently guides you through the setup procedure with a series of questions that will determine
the IPsec keys and VPN policies it sets up. The VPN Wizard will also set the parameters for the
network connection: Security Association, traffic selectors, authentication algorithm, and
encryption. The parameters used by the VPN wizard are based on the recommendations of the
VPN Consortium (VPNC), an organization that promotes multi-vendor VPN interoperability.

Creating Gateway to Gateway VPN Tu nnels with the Wizard

Figure 5-2

5-2 Virtual Private Networking

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Follow these steps to set up a gateway VPN tunnel using the VPN Wizard.

1. Select VPN from the main menu and VPN Wizard from the submenu. The VPN Wizard
screen will display. To view the wizard default settings, click the VPN Wizard Default
Values link. You can modify these settings after completing the wizard.

Figure 5-3

2. Select Gateway as your connection type.

3. Create a Connection Name. Enter a descriptive name for the connection. This name used to

help you manage the VPN settings; is not supplied to the remote VPN endpoint.

4. Enter a Pre-shared Key. The key must be entered both here and on the remote VPN gateway,
or the remote VPN client. This key must be a minimum of 8 characters and should not exceed
49 characters.

Virtual Private Networking 5-3

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

5. Choose which WAN port (broadband or dialup) to use as the VPN tunnel end point.

Note: If you are using a dual WAN rollover configuration, after completing the

wizard, you must manually update the VPN policy to enable VPN rollover.
This allows the VPN tunnel to roll over when the WAN Mode is set to Auto
Rollover. The wizard will not set up the VPN policy with rollover enabled.

6. Enter the Remote and Local WAN IP Addresses or Internet Names of the gateways which
will connect.

• Both the remote WAN address and your local WAN address are required.

Tip: T o assure tunnels stay active, after completing the wizard, manually edit the

VPN policy to enable keepalive which periodically sends ping packets to
the host on the peer side of the network to keep the tunnel alive.

• The remote WAN IP address must be a public address or the Internet name of the remote

gateway . The Internet name is the Fully Quali fied Domain Name (FQDN) as registered in
a Dynamic DNS service. Both local and remote endpoints should be defined as either
FQDN or IP addresses. A combination of IP address and FQDN is not allowed.

Tip: For DHCP WAN configurations, first, set up the tunnel with IP addresses.

Once you validate the connection, use the wizard to create new policies
using FQDN for the WAN addresses.

7. Enter the local LAN IP and Subnet Mask of the remote gateway in the Remote LAN IP
Address and Subnet Mask fields.

Note: The Remote LAN IP address must be in a different subnet than the Local LAN

IP address. For example, if the local subnet is 192.168.1.x, then the remote
subnet could be 192.168.10.x. but could not be 19 2.168.1.x. If this informatio n
is incorrect, the tunnel will fail to connect.

5-4 Virtual Private Networking

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

8. Click Apply to save your settings: the VPN Policies screen shows that the policy is now
enabled.

Figure 5-4

9. If you are connecting to another NETGEAR VPN firewall, use the VPN Wizard to configure
the second VPN firewall to connect to the one you just configured.

To display the status of your VPN connections, select VPN from the main menu and Connection
Status from the submenu. The Connection Status screen will display.

Figure 5-5

The tunnel will automatically establish when both the local and target gateway policies are
appropriately configured and enabled.

Note: When using FQDN, if the dynamic DNS service is slow to update their servers

when your DHCP WAN address changes, the VPN tunnel will fail because the
FQDN does not resolve to your new address. If you have the option to
configure the update interval, set it to an appropriately short time.

Virtual Private Networking 5-5

v1.0, January 2010

ProSafe VPN Firewall 50 FVS338 Reference Manual

Creating a Client to Gateway VPN Tunnel

Figure 5-6

Follow these steps to configure the a VPN client tunnel:

• Configure the client policies on the gateway (see “Use the VPN Wizard Configure the

Gateway for a Client Tunnel” on this page).

• Configure the VPN client to connect to the gateway (see “Use the NETGEAR VPN Client

Security Policy Editor to Create a Secure Connection” on page 5-8).

Use the VPN Wizard Configure the Gateway for a Client Tunnel

Follow these steps to set up a client VPN tunnel using the VPN Wizard.

1. Select VPN from the main menu and VPN Wizard from the submenu. The VPN Wizard
screen will display (see Figure 5-7 on page 5-7). To view the wizard default settings, click the
VPN Wizard Default Value s link.

5-6 Virtual Private Networking

v1.0, January 2010