Netgear R6100 Ac1200 Dual Band Wifi Router User Manual

							Security61
 R6100 WiFi Router
The Block Services Setup screen displays:
5.
From the Service Type list, select the application or service to allow or block. 
The list displays several common services, but you are not limited to th\
ese choices. To  add any additional services or applications that do not already appear
 , select User 
Defined.
6. If you know that the application uses either 
 TCP or UDP, select the appropriate protocol. If 
you are not sure, select  TCP/UDB (both).
7. Enter the starting and ending port numbers. 
If the application uses a single port number, enter that number in both fields.
8. Select the radio button for the IP address configuration you want to blo\
ck, and enter the IP 
addresses. 
You can block the specified service for a single computer, a range of computers with  consecutive IP addresses, or all computers on your network.
9. Click the  Add button.
Your changes are saved. 
Port Triggering to Open Incoming Ports
Some application servers (such as FTP and IRC servers) send replies to\
 multiple port 
numbers. Using the port triggering function of your router, you can tell the router to open 
more incoming ports when a particular outgoing port originates a session\
.
An example is Internet Relay Chat (IRC). Your computer connects to an IRC server at  destination port 6667. 
 The IRC server not only responds to your originating source port, but 
also sends an “identify” message to your computer on port 113. Using port triggering, you can 
tell the router, “When you initiate a session with destination port 6667, you have t\
o also allow 
incoming traffic on port 113 to reach the originating computer.” Using steps similar to the 
preceding example, the following sequence shows the effects of the port triggering rule you 
have defined:
1. Y
ou open an IRC client program to start a chat session on your computer.  
						

							Security
62 R6100 WiFi Router 
2.Your IRC client composes a request message to an IRC server using a destination port 
number of 6667, the standard port number for an IRC server process. Your computer then 
sends this request message to your router.
3.Your router creates an entry in its internal session table describing this communication 
session between your computer and the IRC server. Your router stores the original 
information, performs Network Address Translation (NAT) on the source address and port, 
and sends this request message through the Internet to the IRC server. 
4.Noting your port triggering rule and having observed the destination port number of 6667, 
your router creates an additional session entry to send any incoming port 113 traffic to your 
computer.
5.The IRC server sends a return message to your router using the NAT-assigned source port 
(for example, port 33333) as the destination port. The IRC server also sends an “identify” 
message to your router with destination port 113.
6.Upon receiving the incoming message to destination port 33333, your router checks its 
session table for an active session for port number 33333. Finding an active session, the 
router restores the original address information replaced by NAT and sends this reply 
message to your computer.
7.Upon receiving the incoming message to destination port 113, your router checks its session 
table and finds an active session for port 113, associated with your computer. The router 
replaces the message’s destination IP address with your computer’s IP address and 
forwards the message to your computer.
8.When you finish your chat session, your router eventually senses a period of inactivity in the 
communications. The router then removes the session information from its session table, 
and incoming traffic is no longer accepted on port numbers 33333 or 113.
To configure port triggering, you need to know which inbound ports the application needs. 
Also, you need to know the number of the outbound port that will trigger the opening of the 
inbound ports. You can usually determine this information by contacting the publisher of the 
application or the relevant user groups or news groups.
Only one computer at a time can use the triggered application.
Port Forwarding to Permit External Host 
Communications
In both of the preceding examples, your computer initiates an application session with a 
server computer on the Internet. However, you might need to allow a client computer on the 
Internet to initiate a connection to a server computer on your network. Normally, your router 
ignores any inbound traffic that is not a response to your own outbound traffic. You can 
configure exceptions to this default rule by using the port forwarding feature. 
A typical application of port forwarding can be shown by reversing the client-server 
relationship from the previous web server example. In this case, a remote computer’s 
browser needs to access a web server running on a computer in your local network. Using 
port forwarding, you can tell the router, “When you receive incoming traffic on port 80 (the 
standard port number for a web server process), forward it to the local computer at  
						

							Security
63  R6100 WiFi Router
192.168.1.123.” The following sequence shows the effects of the port forwarding rule you 
have defined:
1.The user of a remote computer opens a browser and requests a web page from 
www.example.com, which resolves to the public IP address of your router. The remote 
computer composes a web page request message with the following destination 
information: 
•Destination address. The IP address of www.example.com, which is the address of 
your router.
•Destination port number. 80, which is the standard port number for a web server 
process.
The remote computer then sends this request message through the Internet to your 
router.
2.Your router receives the request message and looks in its rules table for any rules covering 
the disposition of incoming port 80 traffic. Your port forwarding rule specifies that incoming 
port 80 traffic should be forwarded to local IP address 192.168.1.123. Therefore, your router 
modifies the destination information in the request message:
The destination address is replaced with 192.168.1.123.
Your router then sends this request message to your local network.
3.Your web server at 192.168.1.123 receives the request and composes a return message 
with the requested web page data. Your web server then sends this reply message to your 
router.
4.Your router performs Network Address Translation (NAT) on the source IP address, and 
sends this request message through the Internet to the remote computer, which displays the 
web page from www.example.com.
To configure port forwarding, you need to know which inbound ports the application needs. 
You usually can determine this information by contacting the publisher of the application or 
the relevant user groups or news groups.
How Port Forwarding Differs from Port Triggering
The following points summarize the differences between port forwarding and port triggering:
•Port triggering can be used by any computer on your network, although only one 
computer can use it at a time.
•Port forwarding is configured for a single computer on your network.
•With port triggering, the router does not need to know the computer’s IP address in 
advance. The IP address is captured automatically.
•Port forwarding requires that you specify the computer’s IP address during configuration, 
and the IP address can never change.
•Port triggering requires specific outbound traffic to open the inbound ports, and the 
triggered ports are closed after a period of no activity.
•Port forwarding is always active and does not need to be triggered. 
						

							Security64
R6100 WiFi Router 
Set Up Port Forwarding to Local Servers
The port forwarding feature lets you allow certain types of incoming tra\
ffic to reach servers on 
your local network. For example, you might want to make a local web serv\
er, FTP server, or 
game server visible and available to the Internet.
Use the Port Forwarding/Port Triggering screen to configure the router to forward specific 
incoming protocols to computers on your local network. In addition to se\
rvers for specific 
applications, you can also specify a default DMZ server to which all oth\
er incoming protocols 
are forwarded.
Before you start, determine which type of service, application, or game \
you want to provide, 
and the local IP address of the computer that will provide the service. \
 The server computer 
has to always have the same IP address.
To ensure that your server computer always has the same IP address, use t\
he reserved IP  address feature of your product. See Address Reservation  on page
  38.
To forward specific incoming protocols:
1.Select  ADV
 ANCED > Advanced Setup > Port Forwarding/Port Triggering.
2.Leave the  Port Forwarding radio button selected as the service type.
3. In the Service Name list, select the service name.
If the service does not appear in the list, see  Add a Custom Service on page
  64.
4. Fill in the Server IP 
 Address field.
5. Click the  Add button.
The service appears in the list on the Port Forwarding screen.
Add a Custom Service
To define a service, game, or application that does not appear in the Ser\
vice Name list, first 
determine which port number or range of numbers the application uses. You can usually 
determine this information by contacting the publisher of the applicatio\
n or user groups or 
news groups. When you have the port number information, follow these ste\
ps.
To add a custom service:
1. Select  ADV
 ANCED > Advanced Setup > Port Forwarding/Port Triggering. 
						

							Security65
 R6100 WiFi Router
2.
Select the Port Forwarding radio button as the service type.
3. Click the  Add Custom Service button.
4.In the Service Name field, enter a descriptive name. 
5. In the Protocol field, select the protocol. If you are unsure, select  TCP/UDP.
6. In the External port range field, specify the port or port range. 
7. Either select the  Use the same port range for internal port check box or fill in the Internal 
IP address field.
8. Click the  Apply button. 
The service appears in the list in the Port Forwarding/Port Triggering screen.
Edit or Delete a Port Forwarding Entry
To edit or delete a port forwarding entry:
1. Select  ADV
 ANCED > Advanced Setup > Port Forwarding/Port Triggering .
2. Select the Port Forwarding radio button as the service type
3. In the table, select the radio button next to the service name.
4. Click the  Edit Service or  Delete Service button.
Application Example: Make a Local Web Server Public
If you host a web server on your local network, you can use port forward\
ing to allow web 
requests from anyone on the Internet to reach your web server. 
To make a local web server public:
1.Assign your web server either a fixed IP address or a dynamic IP address\
 using DHCP 
address reservation. 
In this example, your router always gives your web server an IP address \
of 192.168.1.33. 
2. In the Port Forwarding/Port 
 Triggering screen, configure the router to forward the HTTP 
service to the local address of your web server at  192.168.1.33. 
HTTP (port 80) is the standard protocol for web servers. 
						

							Security66
R6100 WiFi Router 
3.
(Optional) Register a host name with a Dynamic DNS service, and config\
ure your router to 
use the name. 
To access your web server from the Internet, a remote user has to know th\
e IP address  that your ISP assigned. However
 , if you use a Dynamic DNS service, the remote user can 
reach your server by a user-friendly Internet name, such as mynetgear.dyndns.org.
Set Up Port Triggering
Port triggering is a dynamic extension of port forwarding that is useful\
 in these cases:
• More than one local computer needs port forwarding for the same applicat\
ion (but not 
simultaneously).
• An application needs to open incoming ports that are dif
 ferent from the outgoing port.
When port triggering is enabled, the router monitors outbound traffic looking for a specified 
outbound “trigger” port. When the router detects outbound traf
 fic on that port, it remembers 
the IP address of the local computer that sent the data. The router then temporarily opens the 
specified incoming port or ports and forwards incoming traffic on the triggered ports to the 
triggering computer. 
Port forwarding creates a static mapping of a port number or range to a \
single local computer. 
Port triggering can dynamically open ports to any computer that needs th\
em and can close 
the ports when they are no longer needed.
If you use applications such as multiplayer gaming, peer-to-peer connect\
ions, real-time 
communications such as instant messaging, or remote assistance (a featu\
re in Windows XP), 
you should also enable Universal Plug and Play (UPnP).
To configure port triggering, you need to know which inbound ports the ap\
plication needs,  and the number of the outbound port that will trigger the opening of the\
 inbound ports. 
 You 
can usually determine this information by contacting the publisher of th\
e application or user 
groups or news groups.
To enable port triggering: 
1. Select  ADV
 ANCED > Advanced Setup > Port Forwarding/Port Triggering.
2. Select the  Port T
 riggering radio button.
3.Clear the Disable Port Triggering check box. 
						

							Security67
 R6100 WiFi Router
If the Disable Port Triggering check box is selected after you configure port triggering, 
port triggering is disabled. However, any port triggering configuration information that you 
specified is saved even though it is not used.
4. In the Port 
 Triggering Timeout field, enter a value up to 9999 minutes. 
This value controls the inactivity timer for the designated inbound port\
s. The inbound  ports close when the inactivity time expires. 
 This is required because the router cannot be 
sure when the application has terminated.
To add a port triggering service:
1. On the Port Forwarding/Port 
 Triggering screen, click the Add Service button.
2.In the Service Name field, type a descriptive service name. 
3. In the Service User list, select  Any, or select Single address and enter the IP address of 
one computer
 .
• Any  (the default), allows any computer on the Internet to use this servic\
e. 
• Single address restricts the service to a particular computer
 . 
4. Select the service type, either  TCP or UDP or  TCP/UDP (both). If you are not sure, select 
TCP/UDP
 .
5. In the 
Triggering Port field, enter the number of the outbound traffic port that will cause the 
inbound ports to be opened. 
6. Enter the inbound connection port information in the Connection 
 Type, Starting Port, and 
Ending Port fields.
7. Click the  Apply button.
The service appears in the Port Triggering Portmap Table. 
8. Make sure that you enable port triggering so that the service that you a\
dded will be used. 
						

							Security68
R6100 WiFi Router 
Schedule Blocking
You can specify the days and time that you want to block Internet access.\
To schedule blocking:
1.
Select  ADV
 ANCED > Security > Schedule.
2.Set up the schedule for blocking keywords and services.
• Days to Block. Select days on which you want to apply blocking by selecting the 
appropriate check boxes, or select the Every Day  check box to select the check 
boxes for all days. 
• T
ime of Day to Block . Select a start and end time in 24-hour format, or select the  All 
Day check box for 24-hour blocking. 
3. Select your time zone from the list. If you use daylight savings time, s\
elect the 
Automatically adjust for daylight savings time  check box. 
4. Click the  Apply button. 
Your settings are saved. 
						

							Security69
 R6100 WiFi Router
Security Event Email Notifications
To receive logs and alerts by email, provide your email information in th\
e E-mail screen, and 
specify which alerts you want to receive and how often. 
To set up email notifications:
1. Select  ADV
 ANCED > Security >  E-mail.
2. Select the Turn Email Notification On  check box.
3. In the 
Your Outgoing Mail Server field, enter the name of your ISP’s outgoing (SMTP) mail 
server (such as mail.myISP.com). 
You might be able to find this information in the configuration screen of\
 your email  program. If you leave this field blank, log and alert messages are not s\
ent.
4. Enter the email address to which logs and alerts are sent in the Send to\
 
 This Email Address 
field. 
This email address is also used for the From address. If you leave this \
field blank, log and  alert messages are not sent.
5. If your outgoing email server requires authentication, select the  My Mail Server requires 
authentication  check box. Fill in the User Name and Password fields for the outgoing e\
mail 
server

.
6. (Optional) Select the Send Alerts 
 Immediately check box.
Email alerts are sent immediately when someone attempts to visit a block\
ed site.
7. (Optional) Fill in the fields in the Send logs according to this sched\
ule section of the screen.
Logs are sent automatically. If the log fills up before the specified time, the log is emailed. 
After the log is sent, the log is cleared from the router memory
 . If the router cannot email 
the log file, the log buffer might fill up. In this case, the router overwrites the log and 
discards its contents.
8. Click the  Apply button.
Your settings are saved. 
						

							70
7
7.   Administration
Manage your network
This chapter describes the router settings for administering and maintaining your router and 
home network. 
This chapter includes the following sections:
•Upgrade the Router Firmware 
•View Router Status 
•Specify Logs Settings 
•Manage the Configuration File 
•Change the Password 
•Password Recovery 
For information about upgrading or checking the status of your router over the Internet, see 
Remote Management on page 92. For information about monitoring Internet traffic, see Traffic 
Meter on page 104.