ZyXEL VMG4380B10A Users Manual

Chapter 11 Network Address Translation (NAT)

Table 54 Port Forwarding: Add/Edit (continued)

LABEL DESCRIPTION

End Port Enter the last port of the original destination port range.

To forward only one port, enter the port number in the Start Port field above and then
enter it again in this field.

To forward a series of ports, enter the last port number in a series that begins with the port
number in the Start Port field above.

Translation
Start Port

Translation End
Port

Server IP
Address

Protocol Select the protocol supported by this virtual server. Choices are TCP, UDP, or TCP/UDP.

OK Click OK to save your changes.

Cancel Click Cancel to exit this screen without saving.

This shows the port number to which you want the Device to translate the incoming port.
For a range of ports, enter the first number of the range to which you want the incoming
ports translated.

This shows the last port of the translated port range.

Enter the inside IP address of the virtual server here.

11.3 The Applications Screen

This screen provides a summary of all NAT applications and their configuration. In addition, this
screen allows you to create new applications and/or remove existing ones.

To access this screen, click Network Setting > NAT > Applications. The following screen
appears.

Figure 78 Network Setting > NAT > Applications

The following table describes the labels in this screen.

Table 55 Network Setting > NAT > Applications

LABEL DESCRIPTION

Add new
application

Application
Forwarded

WAN Interface This field shows the WAN interface through which the service is forwarded.

Server IP
Address

Modify Click the Delete icon to delete the rule.

Click this to add a new NAT application rule.

This field shows the type of application that the service forwards.

This field displays the destination IP address for the service.

VMG4380-B10A / VMG4325-B10A User’s Guide

181

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

182

11.3.1 Add New Application

This screen lets you create new NAT application rules. Click Add new application in the
Applications screen to open the following screen.

Figure 79 Applications: Add

The following table describes the labels in this screen.

11.4 The Port Triggering Screen

Some services use a dedicated range of ports on the client side and a dedicated range of ports on
the server side. With regular port forwarding you set a forwarding port in NAT to forward a service
(coming in from the server on the WAN) to the IP address of a computer on the client side (LAN).
The problem is that port forwarding only forwards a service to a single LAN IP address. In order to
use the same service on a different LAN computer, you have to manually replace the LAN
computer's IP address in the forwarding port with another LAN computer's IP address.

Trigger port forwarding solves this problem by allowing computers on the LAN to dynamically take
turns using the service. The Device records the IP address of a LAN computer that sends traffic to
the WAN to request a service with a specific port number and protocol (a "trigger" port). When the
Device's WAN port receives a response with a specific port number and protocol ("open" port), the
Device forwards the traffic to the LAN IP address of the computer that sent the request. After that
computer’s connection for that service closes, another computer on the LAN can use the service in
the same manner. This way you do not need to configure a new IP address each time you want a
different LAN computer to use the application.

Table 56 Applications: Add

LABEL DESCRIPTION

WAN Interface Select the WAN interface that you want to apply this NAT rule to.

Server IP
Address

Enter the inside IP address of the application here.

Application
Category

Select the category of the application from the drop-down list box.

Application
Forwarded

Select a service from the drop-down list box and the Device automatically configures the
protocol, start, end, and map port number that define the service.

View Rule Click this to display the configuration of the service that you have chosen in Application

Fowarded.

OK Click OK to save your changes.

Cancel Click Cancel to exit this screen without saving.

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

183

For example:

Figure 80 Trigger Port Forwarding Process: Example

1 Jane requests a file from the Real Audio server (port 7070).

2 Port 7070 is a “trigger” port and causes the Device to record Jane’s computer IP address. The

Device associates Jane's computer IP address with the "open" port range of 6970-7170.

3 The Real Audio server responds using a port number ranging between 6970-7170.

4 The Device forwards the traffic to Jane’s computer IP address.

5 Only Jane can connect to the Real Audio server until the connection is closed or times out. The

Device times out in three minutes with UDP (User Datagram Protocol) or two hours with TCP/IP
(Transfer Control Protocol/Internet Protocol).

Click Network Setting > NAT > Port Triggering to open the following screen. Use this screen to
view your Device’s trigger port settings.

Figure 81 Network Setting > NAT > Port Triggering

The following table describes the labels in this screen.

Table 57 Network Setting > NAT > Port Triggering

LABEL DESCRIPTION

Add new rule Click this to create a new rule.

# This is the index number of the entry.

Status This field displays whether the port triggering rule is active or not. A yellow bulb signifies

that this rule is active. A gray bulb signifies that this rule is not active.

Service Name This field displays the name of the service used by this rule.

WAN Interface This field shows the WAN interface through which the service is forwarded.

Trigger Start
Port

The trigger port is a port (or a range of ports) that causes (or triggers) the Device to record
the IP address of the LAN computer that sent the traffic to a server on the WAN.

This is the first port number that identifies a service.

Trigger End
Port

This is the last port number that identifies a service.

Trigger Proto. This is the trigger transport layer protocol.

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

184

11.4.1 Add/Edit Port Triggering Rule

This screen lets you create new port triggering rules. Click Add new rule in the Port Triggering
screen or click a rule’s Edit icon to open the following screen.

Figure 82 Port Triggering: Add/Edit

The following table describes the labels in this screen.

Open Start Port The open port is a port (or a range of ports) that a server on the WAN uses when it sends

out a particular service. The Device forwards the traffic with this port (or range of ports) to
the client computer on the LAN that requested the service.

This is the first port number that identifies a service.

Open End Port This is the last port number that identifies a service.

Open Proto. This is the open transport layer protocol.

Modify Click the Edit icon to edit this rule.

Click the Delete icon to delete an existing rule.

Table 57 Network Setting > NAT > Port Triggering (continued)

LABEL DESCRIPTION

Table 58 Port Triggering: Configuration Add/Edit

LABEL DESCRIPTION

Active Select the check box to enable this rule.

Service Name Enter a name to identify this rule using keyboard characters (A-Z, a-z, 1-2 and so on).

WAN Interface Select a WAN interface for which you want to configure port triggering rules.

Trigger Start
Port

The trigger port is a port (or a range of ports) that causes (or triggers) the Device to record
the IP address of the LAN computer that sent the traffic to a server on the WAN.

Type a port number or the starting port number in a range of port numbers.

Trigger End
Port

Type a port number or the ending port number in a range of port numbers.

Trigger Protocol Select the transport layer protocol from TCP, UDP, or TCP/UDP.

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

185

11.5 The DMZ Screen

In addition to the servers for specified services, NAT supports a default server IP address. A default
server receives packets from ports that are not specified in the NAT Port Forwarding Setup
screen.

Figure 83 Network Setting > NAT > DMZ

The following table describes the fields in this screen.

Open Start Port The open port is a port (or a range of ports) that a server on the WAN uses when it sends

out a particular service. The Device forwards the traffic with this port (or range of ports) to
the client computer on the LAN that requested the service.

Type a port number or the starting port number in a range of port numbers.

Open End Port Type a port number or the ending port number in a range of port numbers.

Open Protocol Select the transport layer protocol from TCP, UDP, or TCP/UDP.

OK Click OK to save your changes.

Cancel Click Cancel to exit this screen without saving.

Table 58 Port Triggering: Configuration Add/Edit (continued)

LABEL DESCRIPTION

Table 59 Network Setting > NAT > DMZ

LABEL DESCRIPTION

Default Server
Address

Enter the IP address of the default server which receives packets from ports that are not
specified in the NAT Port Forwarding screen.

Note: If you do not assign a Default Server Address, the Device discards all packets

received for ports that are not specified in the NAT Port Forwarding screen.

Apply Click Apply to save your changes.

Cancel Click Cancel to restore your previously saved settings.

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

186

11.6 The ALG Screen

Some NAT routers may include a SIP Application Layer Gateway (ALG). A SIP ALG allows SIP calls
to pass through NAT by examining and translating IP addresses embedded in the data stream.
When the Device registers with the SIP register server, the SIP ALG translates the Device’s private
IP address inside the SIP data stream to a public IP address. You do not need to use STUN or an
outbound proxy if your Device is behind a SIP ALG.

Use this screen to enable and disable the NAT and SIP (VoIP) ALG in the Device. To access this
screen, click Network Setting > NAT > ALG.

Figure 84 Network Setting > NAT > ALG

The following table describes the fields in this screen.

11.7 The Address Mapping Screen

Ordering your rules is important because the Device applies the rules in the order that you specify.
When a rule matches the current packet, the Device takes the corresponding action and the
remaining rules are ignored.

Click Network Setting > NAT > Address Mapping to display the following screen.

Figure 85 Network Setting > NAT > Address Mapping

Table 60 Network Setting > NAT > ALG

LABEL DESCRIPTION

NAT ALG Enable this to make sure applications such as FTP and file transfer in IM applications work

correctly with port-forwarding and address-mapping rules.

SIP ALG

Enable this to make sure SIP (VoIP) works correctly with port-forwarding and address­mapping rules.

Apply Click Apply to save your changes.

Cancel Click Cancel to restore your previously saved settings.

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

187

The following table describes the fields in this screen.

11.7.1 Add/Edit Address Mapping Rule

To add or edit an address mapping rule, click Add new rule or the rule’s edit icon in the Address
Mapping screen to display the screen shown next.

Figure 86 Address Mapping: Add/Edit

Table 61 Network Setting > NAT > Address Mapping

LABEL DESCRIPTION

Add new rule Click this to create a new rule.

Set This is the index number of the address mapping set.

Local Start IP This is the starting Inside Local IP Address (ILA).

Local End IP This is the ending Inside Local IP Address (ILA). If the rule is for all local IP addresses, then

this field displays 0.0.0.0 as the Local Start IP address and 255.255.255.255 as the Local
End IP address. This field is blank for One-to-One mapping types.

Global Start IP This is the starting Inside Global IP Address (IGA). Enter 0.0.0.0 here if you have a dynamic

IP address from your ISP. You can only do this for the Many-to-One mapping type.

Global End IP This is the ending Inside Global IP Address (IGA). This field is blank for One-to-One and

Many-to-One mapping types.

Type This is the address mapping type.

One-to-One: This mode maps one local IP address to one global IP address. Note that port
numbers do not change for the One-to-one NAT mapping type.

Many-to-One: This mode maps multiple local IP addresses to one global IP address. This is
equivalent to SUA (i.e., PAT, port address translation), the Device's Single User Account
feature that previous routers supported only.

Many-to-Many: This mode maps multiple local IP addresses to shared global IP addresses.

Modify Click the Edit icon to go to the screen where you can edit the address mapping rule.

Click the Delete icon to delete an existing address mapping rule. Note that subsequent
address mapping rules move up by one when you take this action.

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

188

The following table describes the fields in this screen.

11.8 Technical Reference

This part contains more information regarding NAT.

11.8.1 NAT Definitions

Inside/outside denotes where a host is located relative to the Device, for example, the computers
of your subscribers are the inside hosts, while the web servers on the Internet are the outside
hosts.

Global/local denotes the IP address of a host in a packet as the packet traverses a router, for
example, the local address refers to the IP address of a host when the packet is in the local
network, while the global address refers to the IP address of the host when the same packet is
traveling in the WAN side.

Table 62 Address Mapping: Add/Edit

LABEL DESCRIPTION

Type Choose the IP/port mapping type from one of the following.

One-to-One: This mode maps one local IP address to one global IP address. Note that port
numbers do not change for the One-to-one NAT mapping type.

Many-to-One: This mode maps multiple local IP addresses to one global IP address. This is
equivalent to SUA (i.e., PAT, port address translation), the Device's Single User Account
feature that previous routers supported only.

Many-to-Many: This mode maps multiple local IP addresses to shared global IP addresses.

Local Start IP

Enter the starting Inside Local IP Address (ILA).

Local End IP Enter the ending Inside Local IP Address (ILA). If the rule is for all local IP addresses, then

this field displays 0.0.0.0 as the Local Start IP address and 255.255.255.255 as the Local
End IP address. This field is blank for One-to-One mapping types.

Global Start IP Enter the starting Inside Global IP Address (IGA). Enter 0.0.0.0 here if you have a dynamic

IP address from your ISP. You can only do this for the Many-to-One mapping type.

Global End IP Enter the ending Inside Global IP Address (IGA). This field is blank for One-to-One and

Many-to-One mapping types.

Set Select the number of the mapping set for which you want to configure.

OK Click OK to save your changes.

Cancel Click Cancel to exit this screen without saving.

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

189

Note that inside/outside refers to the location of a host, while global/local refers to the IP address
of a host used in a packet. Thus, an inside local address (ILA) is the IP address of an inside host in
a packet when the packet is still in the local network, while an inside global address (IGA) is the IP
address of the same inside host when the packet is on the WAN side. The following table
summarizes this information.

NAT never changes the IP address (either local or global) of an outside host.

11.8.2 What NAT Does

In the simplest form, NAT changes the source IP address in a packet received from a subscriber
(the inside local address) to another (the inside global address) before forwarding the packet to the
WAN side. When the response comes back, NAT translates the destination address (the inside
global address) back to the inside local address before forwarding it to the original inside host. Note
that the IP address (either local or global) of an outside host is never changed.

The global IP addresses for the inside hosts can be either static or dynamically assigned by the ISP.
In addition, you can designate servers, for example, a web server and a telnet server, on your local
network and make them accessible to the outside world. If you do not define any servers (for Many­to-One and Many-to-Many Overload mapping), NAT offers the additional benefit of firewall
protection. With no servers defined, your Device filters out all incoming inquiries, thus preventing
intruders from probing your network. For more information on IP address translation, refer to RFC
1631, The IP Network Address Translator (NAT).

Table 63 NAT Definitions

ITEM DESCRIPTION

Inside This refers to the host on the LAN.

Outside This refers to the host on the WAN.

Local This refers to the packet address (source or destination) as the packet travels on the

LAN.

Global This refers to the packet address (source or destination) as the packet travels on the

WAN.

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

190

11.8.3 How NAT Works

Each packet has two addresses – a source address and a destination address. For outgoing packets,
the ILA (Inside Local Address) is the source address on the LAN, and the IGA (Inside Global
Address) is the source address on the WAN. For incoming packets, the ILA is the destination
address on the LAN, and the IGA is the destination address on the WAN. NAT maps private (local)
IP addresses to globally unique ones required for communication with hosts on other networks. It
replaces the original IP source address (and TCP or UDP source port numbers for Many-to-One and
Many-to-Many Overload NAT mapping) in each packet and then forwards it to the Internet. The
Device keeps track of the original addresses and port numbers so incoming reply packets can have
their original values restored. The following figure illustrates this.

Figure 87 How NAT Works

192.168.1.13

192.168.1.10

192.168.1.11

192.168.1.12

SA

192.168.1.10

SA

IGA1

Inside Local
IP Address

192.168.1.10

192.168.1.11

192.168.1.12

192.168.1.13

Inside Global
IP Address
IGA 1
IGA 2
IGA 3
IGA 4

NAT Table

WAN

LAN

Inside Local
Address (ILA)

Inside Global
Address (IGA)

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

191

11.8.4 NAT Application

The following figure illustrates a possible NAT application, where three inside LANs (logical LANs
using IP alias) behind the Device can communicate with three distinct WAN networks.

Figure 88 NAT Application With IP Alias

Port Forwarding: Services and Port Numbers

The most often used port numbers are shown in the following table. Please refer to RFC 1700 for
further information about port numbers. Please also refer to the Supporting CD for more examples
and details on port forwarding and NAT.

Table 64 Services and Port Numbers

SERVICES PORT NUMBER

ECHO 7

FTP (File Transfer Protocol) 21

SMTP (Simple Mail Transfer Protocol) 25

DNS (Domain Name System) 53

Finger 79

HTTP (Hyper Text Transfer protocol or WWW, Web) 80

POP3 (Post Office Protocol) 110

NNTP (Network News Transport Protocol) 119

SNMP (Simple Network Management Protocol) 161

SNMP trap 162

PPTP (Point-to-Point Tunneling Protocol) 1723

Chapter 11 Network Address Translation (NAT)

VMG4380-B10A / VMG4325-B10A User’s Guide

192

Port Forwarding Example

Let's say you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example),
port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a
third (C in the example). You assign the LAN IP addresses and the ISP assigns the WAN IP address.
The NAT network appears as a single host on the Internet.

Figure 89 Multiple Servers Behind NAT Example

D=192.168.1.36

192.168.1.1

IP address assigned by ISP

A=192.168.1.33

B=192.168.1.34

C=192.168.1.35

VMG4380-B10A / VMG4325-B10A User’s Guide 193

CHAPTER 12

Dynamic DNS Setup

12.1 Overview

DNS

DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and
vice versa. The DNS server is extremely important because without it, you must know the IP
address of a machine before you can access it.

In addition to the system DNS server(s), each WAN interface (service) is set to have its own static
or dynamic DNS server list. You can configure a DNS static route to forward DNS queries for certain
domain names through a specific WAN interface to its DNS server(s). The Device uses a system
DNS server (in the order you specify in the Broadband screen) to resolve domain names that do
not match any DNS routing entry. After the Device receives a DNS reply from a DNS server, it
creates a new entry for the resolved IP address in the routing table.

Dynamic DNS

Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic
DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access
your FTP server or Web site on your own computer using a domain name (for instance
myhost.dhs.org, where myhost is a name of your choice) that will never change instead of using an
IP address that changes each time you reconnect. Your friends or relatives will always be able to
call you even if they don't know your IP address.

First of all, you need to have registered a dynamic DNS account with www.dyndns.org. This is for
people with a dynamic IP from their ISP or DHCP server that would still like to have a domain name.
The Dynamic DNS service provider will give you a password or key.

12.1.1 What You Can Do in this Chapter

• Use the DNS Entry screen to view, configure, or remove DNS routes (Section 12.2 on page

194).

• Use the Dynamic DNS screen to enable DDNS and configure the DDNS settings on the Device
(Section 12.3 on page 195).

Chapter 12 Dynamic DNS Setup

VMG4380-B10A / VMG4325-B10A User’s Guide

194

12.1.2 What You Need To Know

DYNDNS Wildcard

Enabling the wildcard feature for your host causes *.yourhost.dyndns.org to be aliased to the same
IP address as yourhost.dyndns.org. This feature is useful if you want to be able to use, for example,
www.yourhost.dyndns.org and still reach your hostname.

If you have a private WAN IP address, then you cannot use Dynamic DNS.

12.2 The DNS Entry Screen

Use this screen to view and configure DNS routes on the Device. Click Network Setting > DNS to
open the DNS Entry screen.

Figure 90 Network Setting > DNS > DNS Entry

The following table describes the fields in this screen.

Table 65 Network Setting > DNS > DNS Entry

LABEL DESCRIPTION

Add new DNS
entry

Click this to create a new DNS entry.

# This is the index number of the entry.

Hostname This indicates the host name or domain name.

IP Address This indicates the IP address assigned to this computer.

Modify Click the Edit icon to edit the rule.

Click the Delete icon to delete an existing rule.

Chapter 12 Dynamic DNS Setup

VMG4380-B10A / VMG4325-B10A User’s Guide

195

12.2.1 Add/Edit DNS Entry

You can manually add or edit the Device’s DNS name and IP address entry. Click Add new DNS
entry in the DNS Entry screen or the Edit icon next to the entry you want to edit. The screen

shown next appears.

Figure 91 DNS Entry: Add/Edit

The following table describes the labels in this screen.

12.3 The Dynamic DNS Screen

Use this screen to change your Device’s DDNS. Click Network Setting > DNS > Dynamic DNS.
The screen appears as shown.

Figure 92 Network Setting > DNS > Dynamic DNS

Table 66 DNS Entry: Add/Edit

LABEL DESCRIPTION

Host Name Enter the host name of the DNS entry.

IP Address Enter the IP address of the DNS entry.

Apply Click Apply to save your changes.

Cancel Click Cancel to exit this screen without saving.

Chapter 12 Dynamic DNS Setup

VMG4380-B10A / VMG4325-B10A User’s Guide

196

The following table describes the fields in this screen.

Table 67 Network Setting > DNS > > Dynamic DNS

LABEL DESCRIPTION

Dynamic DNS Select Enable to use dynamic DNS.

Service
Provider

Select your Dynamic DNS service provider from the drop-down list box.

Hostname Type the domain name assigned to your Device by your Dynamic DNS provider.

You can specify up to two host names in the field separated by a comma (",").

Username Type your user name.

Password Type the password assigned to you.

Email If you select TZO in the Service Provider field, enter the user name you used to register

for this service.

Key If you select TZO in the Service Provider field, enter the password you used to register for

this service.

Apply Click Apply to save your changes.

Cancel Click Cancel to exit this screen without saving.

VMG4380-B10A / VMG4325-B10A User’s Guide 197

CHAPTER 13

Interface Group

13.1 Overview

By default, all LAN and WAN interfaces on the Device are in the same group and can communicate
with each other. Create interface groups to have the Device assign the IP addresses in different
domains to different groups. Each group acts as an independent network on the Device. This lets
devices connected to an interface group’s LAN interfaces communicate through the interface
group’s WAN or LAN interfaces but not other WAN or LAN interfaces.

13.1.1 What You Can Do in this Chapter

The Interface Group screens let you create multiple networks on the Device (Section 13.2 on

page 197).

13.2 The Interface Group Screen

You can manually add a LAN interface to a new group. Alternatively, you can have the Device
automatically add the incoming traffic and the LAN interface on which traffic is received to an
interface group when its DHCP Vendor ID option information matches one listed for the interface
group.

Use the LAN screen to configure the private IP addresses the DHCP server on the Device assigns to
the clients in the default and/or user-defined groups. If you set the Device to assign IP addresses
based on the client’s DHCP Vendor ID option information, you must enable DHCP server and
configure LAN TCP/IP settings for both the default and user-defined groups. See Chapter 8 on page

131 for more information.

Chapter 13 Interface Group

VMG4380-B10A / VMG4325-B10A User’s Guide

198

In the following example, the client that sends packets with the DHCP Vendor ID option set to MSFT

5.0 (meaning it is a Windows 2000 DHCP client) is assigned the IP address 192.168.2.2 and uses

the WAN VDSL_PoE/ppp0.1 interface.

Figure 93 Interface Grouping Application

Click Network Setting > Interface Group to open the following screen.

Figure 94 Network Setting > Interface Group

The following table describes the fields in this screen.

13.2.1 Interface Group Configuration

Click the Add New Interface Group button in the Interface Group screen to open the following
screen. Use this screen to create a new interface group.

Table 68 Network Setting > Interface Group

LABEL DESCRIPTION

Add New
Interface Group

Click this button to create a new interface group.

Group Name This shows the descriptive name of the group.

WAN Interface This shows the WAN interfaces in the group.

LAN Interfaces This shows the LAN interfaces in the group.

Criteria This shows the filtering criteria for the group.

Modify Click the Delete icon to remove the group.

Add Click this button to create a new group.

Default: ETH 2~4

Internet

192.168.1.x/24

192.168.2.x/24

VDSL_PoE/ppp0.1

eth10.0

DHCP Vendor ID option: MSFT 5.0

Chapter 13 Interface Group

VMG4380-B10A / VMG4325-B10A User’s Guide

199

Note: An interface can belong to only one group at a time.

Figure 95 Interface Group Configuration

The following table describes the fields in this screen.

Table 69 Interface Group Configuration

LABEL DESCRIPTION

Group Name Enter a name to identify this group. You can enter up to 30 characters. You can use letters,

numbers, hyphens (-) and underscores (_). Spaces are not allowed.

WAN Interface
used in the
grouping

Select the WAN interface this group uses. The group can have up to one PTM interface and
up to one ATM interface.

Select None to not add a WAN interface to this group.

Grouped LAN
Interfaces

Available LAN
Interfaces

Select one or more LAN interfaces (Ethernet LAN, HPNA or wireless LAN) in the Available
LAN Interfaces list and use the left arrow to move them to the Grouped LAN Interfaces
list to add the interfaces to this group.

To remove a LAN or wireless LAN interface from the Grouped LAN Interfaces, use the
right-facing arrow.

Automatically
Add Clients
With the
following DHCP
Vendor IDs

Click Add to identify LAN hosts to add to the interface group by criteria such as the type of
the hardware or firmware. See Section 13.2.2 on page 200 for more information.

# This shows the index number of the rule.

Filter Criteria This shows the filtering criteria. The LAN interface on which the matched traffic is received

will belong to this group automatically.

WildCard
Support

This shows if wildcard on DHCP option 60 is enabled.

Chapter 13 Interface Group

VMG4380-B10A / VMG4325-B10A User’s Guide

200

13.2.2 Interface Grouping Criteria

Click the Add button in the Interface Grouping Configuration screen to open the following
screen.

Figure 96 Interface Grouping Criteria

The following table describes the fields in this screen.

Remove Click the Remove icon to delete this rule from the Device.

Apply Click Apply to save your changes back to the Device.

Cancel Click Cancel to exit this screen without saving.

Table 69 Interface Group Configuration (continued)

LABEL DESCRIPTION

Table 70 Interface Grouping Criteria

LABEL DESCRIPTION

Source MAC
Address

Enter the source MAC address of the packet.

DHCP Option
60

Select this option and enter the Vendor Class Identifier (Option 60) of the matched traffic,
such as the type of the hardware or firmware.

Enable
wildcard on
DHCP
option 60
option

Select this option to be able to use wildcards in the Vendor Class Identifier configured for
DHCP option 60.

DHCP Option
61

Select this and enter the device identity of the matched traffic.

IAID Enter the Identity Association Identifier (IAID) of the device, for example, the WAN

connection index number.

Chapter 13 Interface Group

VMG4380-B10A / VMG4325-B10A User’s Guide

201

DUID type Select DUID-LLT (DUID Based on Link-layer Address Plus Time) to enter the hardware

type, a time value and the MAC address of the device.

Select DUID-EN (DUID Assigned by Vendor Based upon Enterprise Number) to enter the
vendor’s registered enterprise number.

Select DUID-LL (DUID Based on Link-layer Address) to enter the device’s hardware type
and hardware address (MAC address) in the following fields.

Select Other to enter any string that identifies the device in the DUID field.

DHCP Option
125

Select this and enter vendor specific information of the matched traffic.

Enterprise
Number

Enter the vendor’s 32-bit enterprise number registered with the IANA (Internet Assigned
Numbers Authority).

Manufactur
er OUI

Specify the vendor’s OUI (Organization Unique Identifier). It is usually the first three bytes
of the MAC address.

Product
Class

Enter the product class of the device.

Model
Name

Enter the model name of the device.

Serial
Number

Enter the serial number of the device.

Apply Click Apply to save your changes back to the Device.

Cancel Click Cancel to exit this screen without saving.

Table 70 Interface Grouping Criteria (continued)

LABEL DESCRIPTION

Chapter 13 Interface Group

VMG4380-B10A / VMG4325-B10A User’s Guide

202

VMG4380-B10A / VMG4325-B10A User’s Guide 203

CHAPTER 14

USB Service

14.1 Overview

The Device has a USB port used to share files via a USB memory stick or a USB hard drive. In the
USB Service screens, you can enable file-sharing server, media server, and printer server.

14.1.1 What You Can Do in this Chapter

• Use the File Sharing screen to enable file-sharing server (Section 14.2 on page 204).

• Use the Media Server screen to enable or disable the sharing of media files (Section 14.3 on

page 206).

• Use the Printer Server screen to enable the print server (Section 14.4 on page 207).

14.1.2 What You Need To Know

The following terms and concepts may help as you read this chapter.

14.1.2.1 About File Sharing

Workgroup name

This is the name given to a set of computers that are connected on a network and share resources
such as a printer or files. Windows automatically assigns the workgroup name when you set up a
network.

Shares

When settings are set to default, each USB device connected to the Device is given a folder, called
a “share”. If a USB hard drive connected to the Device has more than one partition, then each
partition will be allocated a share. You can also configure a “share” to be a sub-folder or file on the
USB device.

File Systems

A file system is a way of storing and organizing files on your hard drive and storage device. Often
different operating systems such as Windows or Linux have different file systems. The file sharing
feature on your Device supports File Allocation Table (FAT) and FAT32.

Common Internet File System

The Device uses Common Internet File System (CIFS) protocol for its file sharing functions. CIFS
compatible computers can access the USB file storage devices connected to the Device. CIFS

Chapter 14 USB Service

VMG4380-B10A / VMG4325-B10A User’s Guide

204

protocol is supported on Microsoft Windows, Linux Samba and other operating systems (refer to
your systems specifications for CIFS compatibility).

14.1.2.2 About Printer Server

Print Server

This is a computer or other device which manages one or more printers, and which sends print jobs
to each printer from the computer itself or other devices.

Operating System

An operating system (OS) is the interface which helps you manage a computer. Common examples
are Microsoft Windows, Mac OS or Linux.

TCP/IP

TCP/IP (Transmission Control Protocol/ Internet Protocol) is a set of communications protocols that
most of the Internet runs on.

Port

A port maps a network service such as http to a process running on your computer, such as a
process run by your web browser. When traffic from the Internet is received on your computer, the
port number is used to identify which process running on your computer it is intended for.

Supported OSs

Your operating system must support TCP/IP ports for printing and be compatible with the RAW (port

9100) protocol.

The following OSs support Device’s printer sharing feature.

• Microsoft Windows 95, Windows 98 SE (Second Edition), Windows Me, Windows NT 4.0, Windows
2000, Windows XP or Macintosh OS X.

14.2 The File Sharing Screen

You can share files on a USB memory stick or hard drive connected to your Device with users on
your network.

Chapter 14 USB Service

VMG4380-B10A / VMG4325-B10A User’s Guide

205

The following figure is an overview of the Device’s file server feature. Computers A and B can
access files on a USB device (C) which is connected to the Device.

Figure 97 File Sharing Overview

The Device will not be able to join the workgroup if your local area network has restrictions
set up that do not allow devices to join a workgroup. In this case, contact your network
administrator.

14.2.1 Before You Begin

Make sure the Device is connected to your network and turned on.

1 Connect the USB device to one of the Device’s USB port. Make sure the Device is connected to your

network.

2 The Device detects the USB device and makes its contents available for browsing. If you are

connecting a USB hard drive that comes with an external power supply, make sure it is connected
to an appropriate power source that is on.

Note: If your USB device cannot be detected by the Device, see the troubleshooting for

suggestions.

Use this screen to set up file sharing using the Device. To access this screen, click Network
Setting > USB Service > File Sharing.

Figure 98 Network Setting > USB Service > File Sharing

A

B

C

Chapter 14 USB Service

VMG4380-B10A / VMG4325-B10A User’s Guide

206

Each field is described in the following table.

14.3 The Media Server Screen

The media server feature lets anyone on your network play video, music, and photos from the USB
storage device connected to your Device (without having to copy them to another computer). The
Device can function as a DLNA-compliant media server. The Device streams files to DLNA-compliant
media clients (like Windows Media Player). The Digital Living Network Alliance (DLNA) is a group of
personal computer and electronics companies that works to make products compatible in a home
network.

The Device media server enables you to:

• Publish all shares for everyone to play media files in the USB storage device connected to the
Device.

• Use hardware-based media clients like the DMA-2500 to play the files.

Note: Anyone on your network can play the media files in the published shares. No user

name and password or other form of security is used. The media server is enabled
by default with the video, photo, and music shares published.

To change your Device’s media server settings, click Network Setting > USB Service > Media
Server. The screen appears as shown.

Figure 99 Network Setting > USB Service > Media Server

Table 71 Network Setting > Home Networking > File Sharing

LABEL DESCRIPTION

File Sharing
Services

Select Enable to activate file sharing through the Device.

Host Name Enter the host name on the share.

Apply Click Apply to save your changes.

Cancel Click Cancel to restore your previously saved settings.

Chapter 14 USB Service

VMG4380-B10A / VMG4325-B10A User’s Guide

207

The following table describes the labels in this menu.

14.4 The Printer Server Screen

The Device allows you to share a USB printer on your LAN. You can do this by connecting a USB
printer to one of the USB ports on the Device and then adding the printer on the computers
connected to your network. See Section 4.11 on page 62 for instructions on adding a printer on
your computer.

Figure 100 Sharing a USB Printer

14.4.1 Before You Begin

To configure the print server you need the following:

• Your Device must be connected to your computer and any other devices on your network. The
USB printer must be connected to your Device.

• A USB printer with the driver already installed on your computer.

• See Section 4.11 on page 62 for instructions on adding a printer on your computer.

Note: Your printer’s installation instructions may ask that you connect the printer to your

computer. Connect your printer to the Device instead.

Use this screen to enable or disable sharing of a USB printer via your Device.

Table 72 Network Setting > USB Service > Media Server

LABEL DESCRIPTION

Media Server Select Enable to have the Device function as a DLNA-compliant media server.

Enable the media server to let (DLNA-compliant) media clients on your network play media
files located in the shares.

Apply Click Apply to save your changes.

Cancel Click Cancel to restore your previously saved settings.

Chapter 14 USB Service

VMG4380-B10A / VMG4325-B10A User’s Guide

208

To access this screen, click Network Setting > USB Service > Printer Server.

Figure 101 Network Setting > USB Service > Printer Server

The following table describes the labels in this menu.

Table 73 Network Setting > USB Service > Print Server

LABEL DESCRIPTION

Printer Server Select Enable to have the Device share a USB printer.

Printer Name Enter the name of the printer.

Make and
model

Enter the manufacturer and model number of the printer.

Apply Click Apply to save your changes.

Cancel Click Cancel to restore your previously saved settings.

VMG4380-B10A / VMG4325-B10A User’s Guide 209

CHAPTER 15

Firewall

15.1 Overview

This chapter shows you how to enable and configure the Device’s security settings. Use the firewall
to protect your Device and network from attacks by hackers on the Internet and control access to
it. By default the firewall:

• allows traffic that originates from your LAN computers to go to all other networks.

• blocks traffic that originates on other networks from going to the LAN.

The following figure illustrates the default firewall action. User A can initiate an IM (Instant
Messaging) session from the LAN to the WAN (1). Return traffic for this session is also allowed (2).
However other traffic initiated from the WAN is blocked (3 and 4).

Figure 102 Default Firewall Action

15.1.1 What You Can Do in this Chapter

• Use the General screen to configure the security level of the firewall on the Device (Section 15.2

on page 211).

• Use the Service screen to add or remove predefined Internet services and configure firewall
rules (Section 15.3 on page 211).

• Use the Access Control screen to view and configure incoming/outgoing filtering rules (Section

15.4 on page 213).

• Use the DoS screen to activate protection against Denial of Service (DoS) attacks (Section 15.5

on page 216).

WAN

LAN

3
4

1
2

A

Chapter 15 Firewall

VMG4380-B10A / VMG4325-B10A User’s Guide

210

15.1.2 What You Need to Know

SYN Attack

A SYN attack floods a targeted system with a series of SYN packets. Each packet causes the
targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK that
follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on a backlog queue. SYN­ACKs are moved off the queue only when an ACK comes back or when an internal timer terminates
the three-way handshake. Once the queue is full, the system will ignore all incoming SYN requests,
making the system unavailable for legitimate users.

DoS

Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the
Internet. Their goal is not to steal information, but to disable a device or network so users no longer
have access to network resources. The ZyXEL Device is pre-configured to automatically detect and
thwart all known DoS attacks.

DDoS

A DDoS attack is one in which multiple compromised systems attack a single target, thereby
causing denial of service for users of the targeted system.

LAND Attack

In a LAND attack, hackers flood SYN packets into the network with a spoofed source IP address of
the target system. This makes it appear as if the host computer sent the packets to itself, making
the system unavailable while the target system tries to respond to itself.

Ping of Death

Ping of Death uses a "ping" utility to create and send an IP packet that exceeds the maximum
65,536 bytes of data allowed by the IP specification. This may cause systems to crash, hang or
reboot.

SPI

Stateful Packet Inspection (SPI) tracks each connection crossing the firewall and makes sure it is
valid. Filtering decisions are based not only on rules but also context. For example, traffic from the
WAN may only be allowed to cross the firewall in response to a request from the LAN.