Netgear N600 Wireless Router User Manual

							Virtual Private Networking121
 N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700
Local LAN IP Address
 
The remote VPN 
endpoint has to have 
these IP addresses 
entered as its remote 
addresses.
Subnet Mask
Enter the network mask.
Single PC - no 
Subnet Select this option if there is no LAN (only a single PC) at the 
remote endpoint. If this option is selected, no additional data is 
required. 
Single/Start IP 
Address •  
The IP address for a single address, or the starting address for 
an address range used on the LAN. If you want to make a single 
server on your LAN available to remote users, use a single 
address settings. 
•  Any . The remote VPN endpoint can be at any IP address.
Finish IP 
Address For an address range, enter the finish IP address. This has to be 
an address range used on your LAN. 
Subnet Mask Enter the network mask. 
Remote LAN IP Address
 
The remote VPN 
endpoint has to have 
these IP addresses 
entered as its local 
addresses. IP Address
Single PC - no Subnet . Select this option if there is no LAN (only 
a single PC) at the remote endpoint. If this option is selected, no 
additional data is required. The typical application is a PC running 
the VPN client at the remote end.
Single/Start IP 
Address • 
Enter an IP address on the remote LAN. You can use this 
setting to access a server. 
•  For a range of addresses, enter the starting IP address. This 
has to be an address range used on the remote LAN. 
•  Any . Any outgoing traffic from specified Local IP  computers 
triggers an attempted VPN connection to the remote VPN 
endpoint. Be sure you want this option before selecting it.
Finish IP 
Address Enter the finish IP address for a range of addresses. This must be 
an address range used on the remote LAN. 
Subnet Mask Enter the network mask. 
ESP Configuration
 
ESP (encapsulating 
security payload) 
provides security for the 
payload (data) sent 
through the VPN tunnel. SPI
Enter the required security policy indexes (SPIs). Each policy has 
to have unique SPIs. These settings have to match the remote 
VPN endpoint. The  in setting here has to match the out setting on 
the remote VPN endpoint, and the  out setting here has to match 
the  in setting on the remote VPN endpoint.
Encryption Select an encryption algorithm, and enter the key in the field 
provided. For 3DES, the keys should be 24 ASCII characters, and 
for DES, the keys should be 8 ASCII characters. 
• DES . The Data Encryption Standard (DES) processes input 
data that is 64 bits wide, encrypting these values using a 56-bit 
key. Faster but less secure than 3DES. 
•  3DES. (Triple DES) achieves a higher level of security by 
encrypting the data three times using DES with three different, 
unrelated keys. 
Authentication Select an authentication method.
Table 21.  VPN Manual Policy fields and settings  (Continued)
Fields and SettingsDescription 
						

							122
8
8.   Advanced Settings
Configuring for unique situations
This chapter describes the advanced features of your wireless modem rout\
er. The information is for users with a solid understanding of networking concepts who want to \
set the router up for 
unique situations such as when remote access from the Internet by IP or \
domain name is 
needed.
This chapter contains the following sections: •     WAN Setup 
•     Dynamic DNS 
•     LAN Setup 
•     Set Up Quality of Service (QoS) 
•     Advanced Wireless Settings 
•     Building Wireless Bridging and Repeating Networks 
•     Remote Management 
•     Static Routes 
•     Universal Plug and Play 
•     Advanced USB Settings 
•     Traffic Meter  
						

							Advanced Settings123
 N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700
WAN Setup
Select Advanced > WAN Setup
 to display the following screen:
Figure 47. WAN Setup screen
WAN Preference
Configure whether the wireless modem router uses only one WAN port exclu\
sively (either 
ADSL WAN or Ethernet WAN) or detects automatically the WAN port to use.\
Disable Port Scan and DOS Protection
The firewall protects your LAN against port scans and denial of service \
(DOS) attacks. This 
protection should be disabled only in special circumstances.
Default DMZ Server
The default demilitarized zone (DMZ) server feature is helpful when yo\
u use online games 
and video conferencing applications that are incompatible with NAT. The \
wireless modem 
router is programmed to recognize some of these applications and to work\
 correctly with 
them, but there are other applications that might not function well. In \
some cases, one local 
computer can run the application correctly if that computer’s IP addr\
ess is entered as the 
default DMZ server.
Note:  For security reasons, you should avoid using the default DMZ server 
feature. When a computer is designated as the default DMZ server, 
it loses much of the protection of the firewall and is exposed to many 
exploits from the Internet. If compromised, the computer can be 
used to attack your network. 
						

							Advanced Settings124
N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700 
Incoming traffic from the Internet is usually discarded by the wireless \
modem router unless 
the traffic is a response to one of your local computers or a service th\
at you have configured 
in the Ports screen. Instead of discarding this traffic, you can have it\
 forwarded to one 
computer on your network. This computer is called the default DMZ server\
.
To assign a computer or server to be a default DMZ server: 
1. 
In the  WAN Setup screen, select the  Default DMZ Server check box.
Figure 48.  Default DMZ Server setting
2. Type the IP address for that server and click Apply . 
Respond to Ping on Internet Port
If you want the wireless modem router to respond to a ping from the Inte\
rnet, select this 
check box. This should be used only as a diagnostic tool, because it all\
ows your wireless 
modem router to be discovered, which can be a security problem. Do not s\
elect this check 
box unless you have a specific reason to do so.
MTU Size (in bytes)
The normal maximum transmission unit (MTU) value for most Ethernet net\
works is 1500 
bytes, 1492 bytes for PPPoE connections, and 1458 for PPPoA connections.\
 For some ISPs 
you might need to reduce the MTU. But this is rarely required, and shoul\
d not be done unless 
you are sure it is necessary for your ISP connection.
NAT Filtering
This option determines how the router deals with inbound traffic. The Se\
cured option 
provides a secured firewall to protect the PCs on LAN from attacks from \
the Internet, but it 
might cause some Internet games, point-to-point applications, and multim\
edia applications 
no work. The Open option, on the other hand, provides a much less secure\
d firewall, while it 
allows almost all Internet applications to work. 
						

							Advanced Settings125
 N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700
Disable SIP ALG
The Session Initiation Protocol (SIP) Application Level Gateway (ALG)\
 is enabled by default 
to optimize VoIP phone calls that use the SIP. The Disable SIP ALG check\
 box allows you to 
disable the SIP ALG. Disabling the SIP ALG might be useful when running \
certain 
applications.
Dynamic DNS
If your network has a permanently assigned IP address, you can register \
a domain name and 
have that name linked with your IP address by public Domain Name Servers\
 (DNS). 
However, if your Internet account uses a dynamically assigned IP address\
, you do not know 
in advance what your IP address is, and the address can change frequentl\
y. In this case, use 
a commercial Dynamic DNS service that lets you register your domain to i\
ts IP address and 
forwards traffic directed at your domain to your frequently changing IP \
address. 
The router has a client that can connect to a Dynamic DNS service provid\
er. Once you have 
configured your ISP account information in the router, whenever your ISP\
-assigned IP 
address changes, your router contacts your Dynamic DNS service provider,\
 logs in to your 
account, and registers your new IP address.
To enable dynamic DNS:
1. 
Select  Advanced > Dynamic DNS to display the following screen.
Figure 49.  Dynamic DNS screen
2. Access the website of one of the Dynamic DNS service providers whose nam\
es appear in 
the  Service Provider drop-down list, and register for an account. For example, for 
dyndns.org, go to www.dyndns.org.
3.  Select the Use a Dynamic DNS Service  check box. 
4.  Select the name of your Dynamic DNS service provider. 
5.  Type the host name that your Dynamic DNS service provider gave you. The \
Dynamic DNS 
service provider might call this the domain name. If your URL is myName.\
dyndns.org, then 
your host name is myName.
6.  Type the user name for your Dynamic DNS account. 
7.  Type the password (or key) for your Dynamic DNS account.  
						

							Advanced Settings126
N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700 
8. 
If your Dynamic DNS provider allows the use of wildcards in resolving yo\
ur URL, you can 
select the Use Wildcards check box to activate this feature. For example, the wildcard 
feature causes *.yourhost.dyndns.org to be aliased to the same IP addres\
s as 
yourhost.dyndns.org.
9.  Click  Apply to save your settings.
Note:  If your ISP assigns a private WAN IP address such as 192.168.x.x 
or 10.x.x.x, the Dynamic DNS service will not work because private 
addresses are not routed on the Internet.
LAN Setup
The LAN Setup screen allows configuration of LAN IP services such as DHC\
P and Routing 
Information Protocol (RIP). The wireless modem router is shipped preco\
nfigured to use 
private IP addresses on the LAN side and to act as a DHCP server. The wi\
reless modem 
router’s default LAN IP configuration is as follows:
•     LAN IP address. 192.168.0.1
•     Subnet mask . 255.255.255.0
These addresses are part of the private address range designated by the \
Internet 
Engineering Task Force (IETF  http://www.ietf.org/) for use in private networks, and should be 
suitable in most applications. If your network has a requirement to use \
a different IP 
addressing scheme, you can make those changes in the LAN IP Setup screen\
.
Note:  If you change the LAN IP address of the wireless modem router 
while connected through the browser, you are disconnected. To 
reconnect, open a new connection to the new IP address and log in. 
						

							Advanced Settings127
 N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700
To set up a LAN:
1. 
Select  Advanced >  LAN Setup.
Figure 50.  LAN Setup screen
2. Enter the LAN Setup configuration and click  Apply to save your changes.
Note:  The default DHCP and TCP/IP values work for most users.
•     Device Name. This is an abbreviated name of the wireless modem router. You see  this name for the router in Network Explorer on Windows systems.
•     Use Auto IP . Select this check box if you want the wireless modem router to set up \
the LAN IP addresses automatically.
•     IP Address. The LAN IP address of the wireless modem router.
•     IP Subnet Mask . The LAN subnet mask of the wireless modem router. Combined 
with the IP address, the IP subnet mask allows a device to know which ot\
her 
addresses are local to it, and which have to be reached through a gatewa\
y or wireless 
modem router.
•     Use Router as DHCP Server. By default, the wireless modem router functions as a  Dynamic Host Configuration Protocol (DHCP) server, allowing it to assi\
gn IP, DNS 
server, and default gateway addresses to all computers connected to the \
wireless 
modem router’s LAN. The assigned default gateway address is the LAN a\
ddress of 
the router. IP addresses are assigned to the attached PCs from a pool of\
 addresses 
specified in this screen. Each pool address is tested before it is assig\
ned to avoid 
duplicate addresses on the LAN.
For most applications, the default DHCP and TCP/IP settings of the route\
r are 
satisfactory.
•     Reserved IP Addresses Setup. When you specify a reserved IP address for a  computer on the LAN, that computer always receives the same IP address e\
ach time 
it accesses the router’s DHCP server. Reserved IP addresses should be\
 assigned to 
servers that require permanent IP settings.  
						

							Advanced Settings128
N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700 
To reserve an IP address:
1. 
Select  Advanced > LAN Setup and click the Add button.
2. In the IP Address  field, type the IP address to assign to the computer or server. Choose \
an 
IP
  address from the router’s LAN subnet, such as 192.168.0.x. 
3.  Type the MAC address of the computer or server. 
Tip:  If the computer is already present on your network, copy its MAC  address from the Attached Devices screen and paste it here.
4.  Click  Apply to enter the reserved address into the table. 
Note:  The reserved address is not assigned until the next time the 
computer contacts the router’s DHCP server. Reboot the computer 
or access its IP configuration to force a DHCP release and renew.
To edit or delete a reserved address entry: 
1. Select the radio button next to the reserved address that you want to ed\
it or delete. 
2.  Click  Edit or  Delete.
Set Up Quality of Service (QoS)
Quality of Service (QoS) is an advanced feature that can be used to pr\
ioritize some types of 
traffic ahead of others. The modem router can provide QoS prioritization\
 over the wireless 
link and on the Internet connection.
The modem router supports Wi-Fi Multimedia Quality of Service (WMM QoS)\
 to prioritize 
wireless voice and video traffic over the wireless link. WMM QoS provide\
s prioritization of 
wireless data packets from different applications based on four access c\
ategories: voice, 
video, best effort, and background. For an application to receive the be\
nefits of WMM QoS, 
both it and the client running that application 
has to be WMM enabled. Legacy applications 
that do not support WMM, and applications that do not require QoS, are a\
ssigned to the best 
effort category, which receives a lower priority than voice and video. 
						

							Advanced Settings129
 N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700
Configure QoS for Internet Access
To specify prioritization of traffic, you have to add or create a policy\
 for the type of traffic. 
To configure QoS for Internet access:
1. 
From the main menu, under Advanced, select  QoS Setup.
2. Click  Setup QoS rule. The QoS Priority Rule list displays:
3. To change a rule, select its radio button.
4.  Scroll down to the bottom of the screen: 
						

							Advanced Settings130
N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700 
5. 
To edit a rule, click  Edit. To add a custom rule, click Add Priority Rule .
6.  Click  Apply  to save this rule to the QoS Policy list and return to the QoS Setup scr\
een.
7.  In the QoS Setup screen, click  Apply.
Advanced Wireless Settings
To configure the advanced wireless settings:
1. Select  Advanced > Wireless Settings to display the following screen:
Figure 51.  Advanced Wireless Settings screen
Note:  The WPS Settings section is not displayed if you selected WEP as 
the security option.
2.  If you make changes, click Apply . Note that the WLAN settings come from the settings you 
made in the  Wireless Settings Screen on page  42.