Netgear Router WGR614 User Manual

							Reference Manual for Cable/DSL Wireless Router WGR614 
Network, Routing, Firewall, and Basics B-5
 
As a shorter alternative to dotted-decimal notation, the netmask may also be expressed in terms of 
the number of ones from the left. This number is appended to the IP address, following a backward 
slash (/), as “/n.” In the example, the address could be written as 192.168.170.237/24, indicating 
that the netmask is 24 ones followed by 8 zeros. 
Subnet Addressing
By looking at the addressing structures, you can see that even with a Class C address, there are a 
large number of hosts per network. Such a structure is an inefficient use of addresses if each end of 
a routed link requires a different network number. It is unlikely that the smaller office LANs would 
have that many devices. You can resolve this problem by using a technique known as subnet 
addressing. 
Subnet addressing allows us to split one IP network address into smaller multiple physical 
networks known as subnetworks. Some of the node numbers are used as a subnet number instead. 
A Class B address gives us 16 bits of node numbers translating to 64,000 nodes. Most 
organizations do not use 64,000 nodes, so there are free bits that can be reassigned. Subnet 
addressing makes use of those bits that are free, as shown below.
Figure 7-2:  Example of Subnetting a Class B Address
A Class B address can be effectively translated into multiple Class C addresses. For example, the 
IP
 address of 172.16.0.0 is assigned, but node addresses are limited to 255 maximum, allowing 
eight extra bits to use as a subnet address. The IP address of 172.16.97.235 would be interpreted as 
IP
 network address 172.16, subnet number 97, and node number 235. In addition to extending 
the
 number of addresses available, subnet addressing provides other benefits. Subnet addressing 
allows a network manager to construct an address scheme for the network by using different 
subnets for other geographical locations in the network or for other departments in the 
organization.
7262
Class B
Network Subnet Node 
						

							Reference Manual for Cable/DSL Wireless Router WGR614 
B-6 Network, Routing, Firewall, and Basics
 
Although the preceding example uses the entire third octet for a subnet address, note that you are 
not restricted to octet boundaries in subnetting. To create more network numbers, you need only 
shift some bits from the host address to the network address. For instance, to partition a Class C 
network number (192.68.135.0) into two, you shift one bit from the host address to the network 
address. The new netmask (or subnet mask) is 255.255.255.128. The first subnet has network 
number 192.68.135.0 with hosts 192.68.135.1 to 129.68.135.126, and the second subnet has 
network number 192.68.135.128 with hosts 192.68.135.129 to 192.68.135.254.
The following table lists the additional subnet mask bits in dotted-decimal notation. To use the 
table, write down the original class netmask and replace the 0 value octets with the dotted-decimal 
value of the additional subnet bits. For example, to partition your Class C network with subnet 
mask 255.255.255.0 into 16 subnets (4 bits), the new subnet mask becomes 255.255.255.240.
The following table displays several common netmask values in both the dotted-decimal and the 
masklength
 formats.
Note: The number 192.68.135.127 is not assigned because it is the broadcast address 
of the first subnet. The number 192.68.135.128 is not assigned because it is the network 
address of the second subnet.
Table 7-1. Netmask Notation Translation Table for One Octet
Number of Bits Dotted-Decimal Value
1 128
2 192
3 224
4 240
5 248
6 252
7 254
8 255
Table 7-2. Netmask Formats
Dotted-Decimal Masklength
255.0.0.0 /8
255.255.0.0 /16 
						

							Reference Manual for Cable/DSL Wireless Router WGR614 
Network, Routing, Firewall, and Basics B-7
 
Configure all hosts on a LAN segment to use the same netmask for the following reasons:
• So that hosts recognize local IP broadcast packets
When a device broadcasts to its segment neighbors, it uses a destination address of the local 
network address with all ones for the host address. In order for this scheme to work, all devices 
on the segment must agree on which bits comprise the host address. 
• So that a local router or bridge recognizes which addresses are local and which are remote
Private IP Addresses
If your local network is isolated from the Internet (for example, when using NAT), you can assign 
any IP addresses to the hosts without problems. However, the IANA has reserved the following 
three blocks of IP addresses specifically for private networks:
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
Choose your private network number from this range. The DHCP server of the WGR614 router is 
preconfigured to automatically assign private addresses.
Regardless of your particular situation, do not create an arbitrary IP address; always follow the 
guidelines explained here. For more information about address assignment, refer to RFC 1597, 
Address Allocation for Private Internets, and RFC 1466, Guidelines for Management of IP 
Address Space. The Internet Engineering Task Force (IETF) publishes RFCs on its Web site at 
www.ietf.org.
255.255.255.0 /24
255.255.255.128 /25
255.255.255.192 /26
255.255.255.224 /27
255.255.255.240 /28
255.255.255.248 /29
255.255.255.252 /30
255.255.255.254 /31
255.255.255.255 /32
Table 7-2. Netmask Formats 
						

							Reference Manual for Cable/DSL Wireless Router WGR614 
B-8 Network, Routing, Firewall, and Basics
 
Single IP Address Operation Using NAT
In the past, if multiple PCs on a LAN needed to access the Internet simultaneously, you had to 
obtain a range of IP addresses from the ISP. This type of Internet account is more costly than a 
single-address account typically used by a single user with a modem, rather than a router. The 
WGR614 router employs an address-sharing method called Network Address Translation (NAT). 
This method allows several networked PCs to share an Internet account using only a single IP 
address, which may be statically or dynamically assigned by your ISP.
The router accomplishes this address sharing by translating the internal LAN IP addresses to a 
single address that is globally unique on the Internet. The internal LAN IP addresses can be either 
private addresses or registered addresses. For more information about IP address translation, refer 
to RFC 1631, The IP Network Address Translator (NAT).
The following figure illustrates a single IP address operation.
 
Figure 7-3:  Single IP Address Operation Using NAT
7786EA
192.168.0.2
192.168.0.3
192.168.0.4
192.168.0.5192.168.0.1 172.21.15.105Private IP addresses
assigned by user
Internet IP addresses
assigned by ISP 
						

							Reference Manual for Cable/DSL Wireless Router WGR614 
Network, Routing, Firewall, and Basics B-9
 
This scheme offers the additional benefit of firewall-like protection because the internal LAN 
addresses are not available to the Internet through the translated connection. All incoming 
inquiries are filtered out by the router. This filtering can prevent intruders from probing your 
system. However, using port forwarding, you can allow one PC (for example, a Web server) on 
your local network to be accessible to outside users.
MAC Addresses and Address Resolution Protocol
An IP address alone cannot be used to deliver data from one LAN device to another. To send data 
between LAN devices, you must convert the IP address of the destination device to its media 
access control (MAC) address. Each device on an Ethernet network has a unique MAC address, 
which is a 48-bit number assigned to each device by the manufacturer. The technique that 
associates the IP address with a MAC address is known as address resolution. Internet Protocol 
uses the Address Resolution Protocol (ARP) to resolve MAC addresses.
If a device sends data to another station on the network and the destination MAC address is not yet 
recorded, ARP is used. An ARP request is broadcast onto the network. All stations on the network 
receive and read the request. The destination IP address for the chosen station is included as part of 
the message so that only the station with this IP address responds to the ARP request. All other 
stations discard the request. 
Related Documents
The station with the correct IP address responds with its own MAC address directly to the sending 
device. The receiving station provides the transmitting station with the required destination MAC 
address. The IP address data and MAC address data for each station are held in an ARP table. The 
next time data is sent, the address can be obtained from the address information in the table.
For more information about address assignment, refer to the IETF documents RFC 1597, Address 
Allocation for Private Internets, and RFC 1466, Guidelines for Management of IP Address Space.
For more information about IP address translation, refer to RFC 1631, The IP Network Address 
Translator (NAT). 
						

							Reference Manual for Cable/DSL Wireless Router WGR614 
B-10 Network, Routing, Firewall, and Basics
 
Domain Name Server
Many of the resources on the Internet can be addressed by simple descriptive names such as 
www.NETGEAR.com. This addressing is very helpful at the application level, but the descriptive 
name must be translated to an IP address in order for a user to actually contact the resource. Just as 
a telephone directory maps names to phone numbers, or as an ARP table maps IP addresses to 
MAC addresses, a domain name system (DNS) server maps descriptive names of network 
resources to IP addresses.
When a PC accesses a resource by its descriptive name, it first contacts a DNS server to obtain the 
IP address of the resource. The PC sends the desired message using the IP address. Many large 
organizations, such as ISPs, maintain their own DNS servers and allow their customers to use the 
servers to look up addresses.
IP Configuration by DHCP
When an IP-based local area network is installed, each PC must be configured with an IP address. 
If the PCs need to access the Internet, they should also be configured with a gateway address and 
one or more DNS server addresses. As an alternative to manual configuration, there is a method by 
which each PC on the network can automatically obtain this configuration information. A device 
on the network may act as a Dynamic Host Configuration Protocol (DHCP) server. The DHCP 
server stores a list or pool of IP addresses, along with other information (such as gateway and DNS 
addresses) that it may assign to the other devices on the network. The WGR614 router has the 
capacity to act as a DHCP server.
The WGR614 router also functions as a DHCP client when connecting to the ISP. The firewall can 
automatically obtain an IP address, subnet mask, DNS server addresses, and a gateway address if 
the ISP provides this information by DHCP.
Internet Security and Firewalls
When your LAN connects to the Internet through a router, an opportunity is created for outsiders 
to access or disrupt your network. A NAT router provides some protection because by the very 
nature of the process, the network behind the router is shielded from access by outsiders on the 
Internet. However, there are methods by which a determined hacker can possibly obtain 
information about your network or at the least can disrupt your Internet access. A greater degree of 
protection is provided by a firewall router. 
						

							Reference Manual for Cable/DSL Wireless Router WGR614 
Network, Routing, Firewall, and Basics B-11
 
What is a Firewall?
A firewall is a device that protects one network from another, while allowing communication 
between the two. A firewall incorporates the functions of the NAT router, while adding features for 
dealing with a hacker intrusion or attack. Several known types of intrusion or attack can be 
recognized when they occur. When an incident is detected, the firewall can log details of the 
attempt, and can optionally send email to an administrator notifying them of the incident. Using 
information from the log, the administrator can take action with the ISP of the hacker. In some 
types of intrusions, the firewall can fend off the hacker by discarding all further packets from the 
hacker’s IP address for a period of time.
Stateful Packet Inspection
Unlike simple Internet sharing routers, a firewall uses a process called stateful packet inspection to 
ensure secure firewall filtering to protect your network from attacks and intrusions. Since 
user-level applications such as FTP and Web browsers can create complex patterns of network 
traffic, it is necessary for the firewall to analyze groups of network connection states. Using 
Stateful Packet Inspection, an incoming packet is intercepted at the network layer and then 
analyzed for state-related information associated with all network connections. A central cache 
within the firewall keeps track of the state information associated with all network connections. 
All traffic passing through the firewall is analyzed against the state of these connections in order to 
determine whether or not it will be allowed to pass through or rejected.
Denial of Service Attack
A hacker may be able to prevent your network from operating or communicating by launching a 
Denial of Service (DoS) attack. The method used for such an attack can be as simple as merely 
flooding your site with more requests than it can handle. A more sophisticated attack may attempt 
to exploit some weakness in the operating system used by your router or gateway. Some operating 
systems can be disrupted by simply sending a packet with incorrect length information. 
						

							Reference Manual for Cable/DSL Wireless Router WGR614 
B-12 Network, Routing, Firewall, and Basics
 
Ethernet Cabling
Although Ethernet networks originally used thick or thin coaxial cable, most installations currently 
use unshielded twisted pair (UTP) cabling. The UTP cable contains eight conductors, arranged in 
four twisted pairs, and terminated with an RJ45 type connector. A normal straight-through UTP 
Ethernet cable follows the EIA568B standard wiring and pinout as described in 
Ta b l e 7-1.
Uplink Switches, Crossover Cables, and MDI/MDIX Switching
In the wiring table above, the concept of transmit and receive are from the perspective of the PC, 
which is wired as Media Dependant Interface (MDI). In this wiring, the PC transmits on pins 1 and 
2. At the hub, the perspective is reversed, and the hub receives on pins 1 and 2. This wiring is 
referred to as Media Dependant Interface - Crossover (MDI-X). 
When connecting a PC to a PC, or a hub port to another hub port, the transmit pair must be 
exchanged with the receive pair. This exchange is done by one of two mechanisms. Most hubs 
provide an Uplink switch which will exchange the pairs on one port, allowing that port to be 
connected to another hub using a normal Ethernet cable. The second method is to use a crossover 
cable, which is a special cable in which the transmit and receive pairs are exchanged at one of the 
two cable connectors. Crossover cables are often unmarked as such, and must be identified by 
comparing the two connectors. Since the cable connectors are clear plastic, it is easy to place them 
side by side and view the order of the wire colors on each. On a straight-through cable, the color 
order will be the same on both connectors. On a crossover cable, the orange and blue pairs will be 
exchanged from one connector to the other.
Table 7-1. UTP Ethernet cable wiring, straight-through
Pin Wire color Signal
1 Orange/White Transmit (Tx) +
2 Orange Transmit (Tx) -
3 Green/White Receive (Rx) +
4Blue
5 Blue/White
6 Green Receive (Rx) -
7 Brown/White
8Brown 
						

							Reference Manual for Cable/DSL Wireless Router WGR614 
Network, Routing, Firewall, and Basics B-13
 
The WGR614 router incorporates Auto UplinkTM technology (also called MDI/MDIX). Each 
LOCAL Ethernet port will automatically sense whether the Ethernet cable plugged into the port 
should have a normal connection (e.g. connecting to a PC) or an uplink connection (e.g. 
connecting to a router, switch, or hub). That port will then configure itself to the correct 
configuration. This feature also eliminates the need to worry about crossover cables, as Auto 
Uplink
TM will accommodate either type of cable to make the right connection.
Cable Quality
A twisted pair Ethernet network operating at 10 Mbits/second (10BASE-T) will often tolerate low 
quality cables, but at 100 Mbits/second (10BASE-Tx) the cable must be rated as Category 5, or 
Cat 5 or Cat V, by the 
Electronic Industry Association (EIA). This rating will be printed on the 
cable jacket. A Category 5 cable will meet specified requirements regarding loss and crosstalk. In 
addition, there are restrictions on maximum cable length for both 10 and 100 Mbits/second 
networks. 
						

							Reference Manual for Cable/DSL Wireless Router WGR614 
B-14 Network, Routing, Firewall, and Basics