There are many ways to share a connection and consequently just about as many ways to open holes in a NAT-based firewall.\u00a0 Because of this,\u00a0this section is not an exact how-to guide,\u00a0but instead is a reference that is intended to save time when you are trying to get your special application to work.<\/p>\n
Let’s start with a look at the features and limitations of some popular sharing products.<\/p>\n
Sygate<\/a>\u00a0will handle many applications that are “special” to other sharing methods, right “out-of-the-box”.\u00a0\u00a0 It also handles\u00a0triggered maps<\/a>,\u00a0port ranges, and allows you to specify TCP or UDP protocols.\u00a0 Although a 3 user license costs $40, it’s cheap compared to the time you can spend tearing your hair out getting some other programs to work.\u00a0 You can download a free demo by\u00a0clicking here.<\/a><\/p>\n If\u00a0ICS<\/a>\u00a0is your chosen instrument of torture, you can make mapping ports easier by using\u00a0Harley Acheson’s ICS Configuration, which you can get\u00a0here<\/a>.\u00a0 Also check out the\u00a0ICS Configuration port map page<\/a>\u00a0for ready-to-use map files. ICS can handle port ranges and multiple protocols, but does not support triggered maps.<\/p>\n Note that some of the\u00a0very\u00a0inexpensive routers do not support port\u00a0range\u00a0mapping or triggered maps. They also tend to have a limited number (10-12) of single port mappings and you can’t specify TCP or UDP.\u00a0 So if your favorite application needs mapped port ranges, you’ll have to choose another router or use the router’s “DMZ” or “Exposed Computer” option for\u00a0one\u00a0computer.\u00a0\u00a0Go back to\u00a0this section<\/a>\u00a0for a list of routers that support triggered maps.<\/p>\n If all this just sounds like too much of a hassle, you might want to skip trying to find out what holes to open and\u00a0just place one computer outside the firewall.\u00a0 Most NAT routers will allow you to do this through a feature usually called “Exposed Computer” or “DMZ Computer”.\u00a0 Of course, that computer is completely exposed to the Internet, so you’d better lock it down real tight!<\/p>\n How to Do it<\/p>\n Before we get going, here’s the warning, one more time. The\u00a0Special Application Ports section<\/a>\u00a0below contains a list of applications with information on the ports that they use.\u00a0 This list is mostly an edited version of\u00a0Sygate’s Apprule.cfg file<\/a>, with the Sygate specific terminology removed.<\/p>\n In the list, you’ll see\u00a0OUT,\u00a0IN,\u00a0TCP,\u00a0UDP\u00a0and\u00a0numbers.\u00a0 Here’s what they mean:<\/p>\n OUT IN TCP<\/a> UD<\/a>P<\/a> Number Tips to create your mapped ports<\/p>\n Example 1 Example 2 Your method may vary… Go right to the Port lists There are many ways to share a connection and consequently just about as many ways to open holes in a NAT-based firewall.\u00a0 Because of this,\u00a0this section is not an exact how-to guide,\u00a0but instead is a reference that is intended to save time when you are trying to get your special application to work. Let’s start with a look at the features and limitations of some popular sharing products. Sygate\u00a0will handle many applications that are “special” to other sharing methods, right “out-of-the-box”.\u00a0\u00a0 It also handles\u00a0triggered maps,\u00a0port ranges, and allows you to <\/p>\n","protected":false},"author":2,"featured_media":5600,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts\/694"}],"collection":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/comments?post=694"}],"version-history":[{"count":0,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/posts\/694\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/media\/5600"}],"wp:attachment":[{"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/media?parent=694"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/categories?post=694"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.practicallynetworked.com\/wp-json\/wp\/v2\/tags?post=694"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
If you’re using\u00a0Linux “Masq” or “Masquerade”\u00a0to share your connection,\u00a0this site<\/a>\u00a0has lots of helpful info.<\/p>\n
\n
Opening holes in your firewall,\u00a0 can compromise your LAN’s security if done incorrectly. Please\u00a0read this information on Security<\/a>\u00a0before proceeding.<\/p>\n
\nThis is useful for programs and routers that support\u00a0triggered maps<\/a>, such as\u00a0Sygate<\/a>.
\n– Triggered maps are not active until a Client computer sends a packet that matches the protocol and port that are specified in the trigger.
\n– Triggered maps allow you to have more than one machine use a port mapping,\u00a0although only one machine at a time can use the mapping. Triggered maps do not include an IP address of the “Target” client (the machine that uses the mapping).<\/p>\n
\nThis is the “hole” that the application needs in the firewall.\u00a0 You always need to enter this information.<\/p>\n
\nMeans\u00a0Transmission Control Protocol,\u00a0and is one way that applications communicate on the Internet.<\/p>\n
\nMeans\u00a0User Datagram Protocol,\u00a0and is another way that applications communicate on the Internet.<\/p>\n
\nIs the number of the special\u00a0ports<\/a>(s) used by the application. There’s a reference list of port definitions\u00a0here<\/a>\u00a0if you’re curious (WARNING: it’s ONE\u00a0looonng\u00a0page).<\/p><\/blockquote>\n\n
\nIf you use a DHCP server to assign your Client computer IP addresses, your Port maps will stop working when your Clients obtain different IP addresses from the DHCP server.
\n(Of course, if you assign a fixed IP address, make sure you enter the proper Gateway and DNS information into the Client’s TCP\/IP properties.)
\n(NOTE: If you are using a NAT router that supports triggered maps, you can ignore this step.)<\/li>\n
\nIf you see a single number, like this:
\nIN\u00a0\u00a0\u00a0\u00a0\u00a0 TCP\u00a0\u00a0\u00a0\u00a0 113
\nthat’s a single port.
\nIf you see two numbers like this:
\nIN\u00a0\u00a0\u00a0\u00a0\u00a0 TCP\u00a0\u00a0\u00a0\u00a0 113\u00a0120
\nit means you need to map a port\u00a0range\u00a0from port 113 to 120.<\/li>\n
\nIf it doesn’t allow you to specify TCP or UDP, then enter separate mappings for both the TCP and UDP table entries, but only if they are different port numbers.<\/p>\n
\nThe application port information looks like this:
\nIN\u00a0\u00a0\u00a0\u00a0\u00a0 UDP\u00a0\u00a0\u00a0\u00a0 1140\u00a0\u00a0\u00a0 1234
\nIN\u00a0\u00a0\u00a0\u00a0\u00a0 TCP\u00a0\u00a0\u00a0\u00a0 1140\u00a0\u00a0\u00a0 1234
\nYour router doesn’t let you specify TCP or UDP, so you make one mapping for port range 1140 to 1234.<\/p>\n
\nThe application port information looks like this:
\nIN\u00a0\u00a0\u00a0\u00a0\u00a0 UDP\u00a0\u00a0\u00a0\u00a0 51200\u00a0\u00a0 51201
\nIN\u00a0\u00a0\u00a0\u00a0\u00a0 TCP\u00a0\u00a0\u00a0\u00a0 51210
\nYour router doesn’t let you specify TCP or UDP, but the port ranges are different, so you make two mappings: one for port range 51200 to 51201; the other for port 51210.<\/li>\n
\n(most don’t) first\u00a0don’t\u00a0enter the\u00a0OUT\u00a0information.\u00a0\u00a0However, if the application doesn’t work, try adding the\u00a0OUT\u00a0 information to your mapping.<\/li>\n
\nconsult the application’s Help files or Web site FAQ.\u00a0 The information is usually in a section about Firewalls, or Proxies.<\/li>\n
\nDon’t use the private, non-routable address that your router assigns (example: 192.168.0.X).\u00a0 The ISP-assigned address might be assigned dynamically and could change from time to time, which can make it difficult to connect to your special application.\u00a0 You can use a\u00a0Dynamic DNS service<\/a>\u00a0to prevent this.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"