Netgear Router WGT624 V3 User Manual

							Network, Routing, Firewall, and Basics B-1
202-10090-01, April 2005
Appendix B
Network, Routing, Firewall, and Basics
This chapter provides an overview of IP networks, routing, and networking.
Related Publications
As you read this document, you may be directed to various RFC documents for further 
information. An RFC is a Request For Comment (RFC) published by the Internet Engineering 
Task Force (IETF), an open organization that defines the architecture and operation of the Internet. 
The RFC documents outline and define the standard protocols and procedures for the Internet. The 
documents are listed on the World Wide Web at www.ietf.org and are mirrored and indexed at 
many other sites worldwide.
Basic Router Concepts
Large amounts of bandwidth can be provided easily and relatively inexpensively in a local area 
network (LAN). However, providing high bandwidth between a local network and the Internet can 
be very expensive. Because of this expense, Internet access is usually provided by a slower-speed 
wide-area network (WAN) link such as a cable or DSL modem. In order to make the best use of the 
slower WAN link, a mechanism must be in place for selecting and transmitting only the data traffic 
meant for the Internet. The function of selecting and forwarding this data is performed by a router.
What is a Router?
A router is a device that forwards traffic between networks based on network layer information in 
the data and on routing tables maintained by the router. In these routing tables, a router builds up a 
logical picture of the overall network by gathering and exchanging information with other routers 
in the network. Using this information, the router chooses the best path for forwarding network 
traffic.
Routers vary in performance and scale, number of routing protocols supported, and types of 
physical WAN connection they support. The WGT624 v3 108 Mbps Wireless Firewall Router is a 
small office router that routes the IP protocol over a single-user broadband connection. 
						

							Reference Manual for the 108 Mbps Wireless Firewall Router WGT624 v3
B-2 Network, Routing, Firewall, and Basics
202-10090-01, April 2005
Routing Information Protocol
One of the protocols used by a router to build and maintain a picture of the network is the Routing 
Information Protocol (RIP). Using RIP, routers periodically update one another and check for 
changes to add to the routing table.
The WGT624 v3 wireless router supports both the older RIP-1 and the newer RIP-2 protocols. 
Among other improvements, RIP-2 supports subnet and multicast protocols. RIP is not required 
for most home applications. 
IP Addresses and the Internet
Because TCP/IP networks are interconnected across the world, every machine on the Internet must 
have a unique address to make sure that transmitted data reaches the correct destination. Blocks of 
addresses are assigned to organizations by the Internet Assigned Numbers Authority (IANA). 
Individual users and small organizations may obtain their addresses either from the IANA or from 
an Internet service provider (ISP). You can contact IANA at www.iana.org.
The Internet Protocol (IP) uses a 32-bit address structure. The address is usually written in dot 
notation (also called dotted-decimal notation), in which each group of eight bits is written in 
decimal form, separated by decimal points.
For example, the following binary address: 
11000011  00100010  00001100  00000111 
is normally written as: 
195.34.12.7
The latter version is easier to remember and easier to enter into your computer.
In addition, the 32 bits of the address are subdivided into two parts. The first part of the address 
identifies the network, and the second part identifies the host node or station on the network. The 
dividing point may vary depending on the address range and the application.
There are five standard classes of IP addresses. These address classes have different ways of 
determining the network and host sections of the address, allowing for different numbers of hosts 
on a network. Each address type begins with a unique bit pattern, which is used by the TCP/IP 
software to identify the address class. After the address class has been determined, the software 
can correctly identify the host section of the address. The follow figure shows the three main 
address classes, including network and host sections of the address for each address type. 
						

							Reference Manual for the 108 Mbps Wireless Firewall Router WGT624 v3
Network, Routing, Firewall, and Basics B-3
202-10090-01, April 2005 Figure 7-1:  Three Main Address Classes
The five address classes are:
• Class A 
Class A addresses can have up to 16,777,214 hosts on a single network. They use an eight-bit 
network number and a 24-bit node number. Class A addresses are in this range: 
1.x.x.x to 126.x.x.x. 
• Class B 
Class B addresses can have up to 65,354 hosts on a network. A Class B address uses a 16-bit 
network number and a 16-bit node number. Class B addresses are in this range: 
128.1.x.x to 191.254.x.x. 
• Class C 
Class C addresses can have 254 hosts on a network. Class C addresses use 24 bits for the 
network address and eight bits for the node. They are in this range:
192.0.1.x to 223.255.254.x. 
• Class D 
Class D addresses are used for multicasts (messages sent to many hosts). Class D addresses are 
in this range:
224.0.0.0 to 239.255.255.255. 
• Class E 
Class E addresses are for experimental use. 
7261
Class A
Network Node
Class B
Class CNetwork Node
Network Node 
						

							Reference Manual for the 108 Mbps Wireless Firewall Router WGT624 v3
B-4 Network, Routing, Firewall, and Basics
202-10090-01, April 2005
This addressing structure allows IP addresses to uniquely identify each physical network and each 
node on each physical network.
For each unique value of the network portion of the address, the base address of the range (host 
address of all zeros) is known as the network address and is not usually assigned to a host. Also, 
the top address of the range (host address of all ones) is not assigned, but is used as the broadcast 
address for simultaneously sending a packet to all hosts with the same network address.
Netmask
In each of the address classes previously described, the size of the two parts (network address and 
host address) is implied by the class. This partitioning scheme can also be expressed by a netmask 
associated with the IP address. A netmask is a 32-bit quantity that, when logically combined (using 
an AND operator) with an IP address, yields the network address. For instance, the netmasks for 
Class A, B, and C addresses are 255.0.0.0, 255.255.0.0, and 255.255.255.0, respectively.
For example, the address 192.168.170.237 is a Class C IP address whose network portion is the 
upper 24 bits. When combined (using an AND operator) with the Class C netmask, as shown here, 
only the network portion of the address remains:
11000000  10101000  10101010  11101101 (192.168.170.237)
combined with:
11111111  11111111  11111111  00000000 (255.255.255.0)
Equals:
11000000  10101000  10101010  00000000 (192.168.170.0)
As a shorter alternative to dotted-decimal notation, the netmask may also be expressed in terms of 
the number of ones from the left. This number is appended to the IP address, following a backward 
slash (/), as “/n.” In the example, the address could be written as 192.168.170.237/24, indicating 
that the netmask is 24 ones followed by 8 zeros. 
Subnet Addressing
By looking at the addressing structures, you can see that even with a Class C address, there are a 
large number of hosts per network. Such a structure is an inefficient use of addresses if each end of 
a routed link requires a different network number. It is unlikely that the smaller office LANs would 
have that many devices. You can resolve this problem by using a technique known as subnet 
addressing.  
						

							Reference Manual for the 108 Mbps Wireless Firewall Router WGT624 v3
Network, Routing, Firewall, and Basics B-5
202-10090-01, April 2005
Subnet addressing allows us to split one IP network address into smaller multiple physical 
networks known as subnetworks. Some of the node numbers are used as a subnet number instead. 
A Class B address gives us 16 bits of node numbers translating to 64,000 nodes. Most 
organizations do not use 64,000 nodes, so there are free bits that can be reassigned. Subnet 
addressing makes use of those bits that are free, as shown below.
Figure 7-2:  Example of Subnetting a Class B Address
A Class B address can be effectively translated into multiple Class C addresses. For example, the 
IP address of 172.16.0.0 is assigned, but node addresses are limited to 255 maximum, allowing 
eight extra bits to use as a subnet address. The IP address of 172.16.97.235 would be interpreted as 
IP network address 172.16, subnet number 97, and node number 235. In addition to extending 
the number of addresses available, subnet addressing provides other benefits. Subnet addressing 
allows a network manager to construct an address scheme for the network by using different 
subnets for other geographical locations in the network or for other departments in the 
organization.
Although the preceding example uses the entire third octet for a subnet address, note that you are 
not restricted to octet boundaries in subnetting. To create more network numbers, you need only 
shift some bits from the host address to the network address. For instance, to partition a Class C 
network number (192.68.135.0) into two, you shift one bit from the host address to the network 
address. The new netmask (or subnet mask) is 255.255.255.128. The first subnet has network 
number 192.68.135.0 with hosts 192.68.135.1 to 129.68.135.126, and the second subnet has 
network number 192.68.135.128 with hosts 192.68.135.129 to 192.68.135.254.
Note: The number 192.68.135.127 is not assigned because it is the broadcast address 
of the first subnet. The number 192.68.135.128 is not assigned because it is the network 
address of the second subnet.
7262
Class B
Network Subnet Node 
						

							Reference Manual for the 108 Mbps Wireless Firewall Router WGT624 v3
B-6 Network, Routing, Firewall, and Basics
202-10090-01, April 2005
The following table lists the additional subnet mask bits in dotted-decimal notation. To use the 
table, write down the original class netmask and replace the 0 value octets with the dotted-decimal 
value of the additional subnet bits. For example, to partition your Class C network with subnet 
mask 255.255.255.0 into 16 subnets (4 bits), the new subnet mask becomes 255.255.255.240.
The following table displays several common netmask values in both the dotted-decimal and the 
masklength formats.
Configure all hosts on a LAN segment to use the same netmask for the following reasons:
Table 7-1. Netmask Notation Translation Table for One Octet
Number of Bits Dotted-Decimal Value
1 128
2 192
3 224
4 240
5 248
6 252
7 254
8 255
Table 7-2. Netmask Formats
Dotted-Decimal Masklength
255.0.0.0 /8
255.255.0.0 /16
255.255.255.0 /24
255.255.255.128 /25
255.255.255.192 /26
255.255.255.224 /27
255.255.255.240 /28
255.255.255.248 /29
255.255.255.252 /30
255.255.255.254 /31
255.255.255.255 /32 
						

							Reference Manual for the 108 Mbps Wireless Firewall Router WGT624 v3
Network, Routing, Firewall, and Basics B-7
202-10090-01, April 2005
• So that hosts recognize local IP broadcast packets
When a device broadcasts to its segment neighbors, it uses a destination address of the local 
network address with all ones for the host address. In order for this scheme to work, all devices 
on the segment must agree on which bits comprise the host address. 
• So that a local router or bridge recognizes which addresses are local and which are remote
Private IP Addresses
If your local network is isolated from the Internet (for example, when using NAT), you can assign 
any IP addresses to the hosts without problems. However, the IANA has reserved the following 
three blocks of IP addresses specifically for private networks:
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
Choose your private network number from this range. The DHCP server of the WGT624 v3 
wireless router is preconfigured to automatically assign private addresses.
Regardless of your particular situation, do not create an arbitrary IP address; always follow the 
guidelines explained here. For more information about address assignment, refer to RFC 1597, 
Address Allocation for Private Internets, and RFC 1466, Guidelines for Management of IP 
Address Space. The Internet Engineering Task Force (IETF) publishes RFCs on its web site at 
www.ietf.org.
Single IP Address Operation Using NAT
In the past, if multiple PCs on a LAN needed to access the Internet simultaneously, you had to 
obtain a range of IP addresses from the ISP. This type of Internet account is more costly than a 
single-address account typically used by a single user with a modem, rather than a router. The 
WGT624 v3 wireless router employs an address-sharing method called Network Address 
Translation (NAT). This method allows several networked PCs to share an Internet account using 
only a single IP address, which may be statically or dynamically assigned by your ISP.
The router accomplishes this address sharing by translating the internal LAN IP addresses to a 
single address that is globally unique on the Internet. The internal LAN IP addresses can be either 
private addresses or registered addresses. For more information about IP address translation, refer 
to RFC 1631, The IP Network Address Translator (NAT). 
						

							Reference Manual for the 108 Mbps Wireless Firewall Router WGT624 v3
B-8 Network, Routing, Firewall, and Basics
202-10090-01, April 2005
The following figure illustrates a single IP address operation.
 
Figure 7-3:  Single IP Address Operation Using NAT
This scheme offers the additional benefit of firewall-like protection because the internal LAN 
addresses are not available to the Internet through the translated connection. All incoming 
inquiries are filtered out by the router. This filtering can prevent intruders from probing your 
system. However, using port forwarding, you can allow one PC (for example, a web server) on 
your local network to be accessible to outside users.
MAC Addresses and Address Resolution Protocol
An IP address alone cannot be used to deliver data from one LAN device to another. To send data 
between LAN devices, you must convert the IP address of the destination device to its media 
access control (MAC) address. Each device on an Ethernet network has a unique MAC address, 
which is a 48-bit number assigned to each device by the manufacturer. The technique that 
associates the IP address with a MAC address is known as address resolution. Internet Protocol 
uses the Address Resolution Protocol (ARP) to resolve MAC addresses.
192.168.0.2
192.168.0.3
192.168.0.4
192.168.0.5192.168.0.1 172.21.15.105Private IP addresses
assigned by user
Internet IP addresses
assigned by ISP 
						

							Reference Manual for the 108 Mbps Wireless Firewall Router WGT624 v3
Network, Routing, Firewall, and Basics B-9
202-10090-01, April 2005
If a device sends data to another station on the network and the destination MAC address is not yet 
recorded, ARP is used. An ARP request is broadcast onto the network. All stations on the network 
receive and read the request. The destination IP address for the chosen station is included as part of 
the message so that only the station with this IP address responds to the ARP request. All other 
stations discard the request. 
Related Documents
The station with the correct IP address responds with its own MAC address directly to the sending 
device. The receiving station provides the transmitting station with the required destination MAC 
address. The IP address data and MAC address data for each station are held in an ARP table. The 
next time data is sent, the address can be obtained from the address information in the table.
For more information about address assignment, refer to the IETF documents RFC 1597, Address 
Allocation for Private Internets, and RFC 1466, Guidelines for Management of IP Address Space.
For more information about IP address translation, refer to RFC 1631, The IP Network Address 
Translator (NAT).
Domain Name Server
Many of the resources on the Internet can be addressed by simple descriptive names such as 
www.NETGEAR.com. This addressing is very helpful at the application level, but the descriptive 
name must be translated to an IP address in order for a user to actually contact the resource. Just as 
a telephone directory maps names to phone numbers, or as an ARP table maps IP addresses to 
MAC addresses, a domain name system (DNS) server maps descriptive names of network 
resources to IP addresses.
When a PC accesses a resource by its descriptive name, it first contacts a DNS server to obtain the 
IP address of the resource. The PC sends the desired message using the IP address. Many large 
organizations, such as ISPs, maintain their own DNS servers and allow their customers to use the 
servers to look up addresses. 
						

							Reference Manual for the 108 Mbps Wireless Firewall Router WGT624 v3
B-10 Network, Routing, Firewall, and Basics
202-10090-01, April 2005
IP Configuration by DHCP
When an IP-based local area network is installed, each PC must be configured with an IP address. 
If the PCs need to access the Internet, they should also be configured with a gateway address and 
one or more DNS server addresses. As an alternative to manual configuration, there is a method by 
which each PC on the network can automatically obtain this configuration information. A device 
on the network may act as a Dynamic Host Configuration Protocol (DHCP) server. The DHCP 
server stores a list or pool of IP addresses, along with other information (such as gateway and DNS 
addresses) that it may assign to the other devices on the network. The WGT624 v3 wireless router 
has the capacity to act as a DHCP server.
The WGT624 v3 wireless router also functions as a DHCP client when connecting to the ISP. The 
firewall can automatically obtain an IP address, subnet mask, DNS server addresses, and a 
gateway address if the ISP provides this information by DHCP.
Internet Security and Firewalls
When your LAN connects to the Internet through a router, an opportunity is created for outsiders 
to access or disrupt your network. A NAT router provides some protection because by the very 
nature of the process, the network behind the router is shielded from access by outsiders on the 
Internet. However, there are methods by which a determined hacker can possibly obtain 
information about your network or at the least can disrupt your Internet access. A greater degree of 
protection is provided by a firewall router.
What is a Firewall?
A firewall is a device that protects one network from another, while allowing communication 
between the two. A firewall incorporates the functions of the NAT router, while adding features for 
dealing with a hacker intrusion or attack. Several known types of intrusion or attack can be 
recognized when they occur. When an incident is detected, the firewall can log details of the 
attempt, and can optionally send email to an administrator notifying them of the incident. Using 
information from the log, the administrator can take action with the ISP of the hacker. In some 
types of intrusions, the firewall can fend off the hacker by discarding all further packets from the 
hacker’s IP address for a period of time.