Quick Reference Guide

ProSafe VPN Firewall 200 FVX538 Reference Manual
Firewall Protection and Content Filtering 4-5
v1.0, January 2010
Inbound Rules (Port Forwarding)
Because the VPN firewall uses Network Address Translation (NAT), your network presents only
one IP address to the Internet and outside users cannot directly address any of your local
computers. However, by defining an inbound rule you can make a local server (for example, a Web
server or game server) visible and available to the Internet. The rule tells the VPN firewall to direct
inbound traffic for a particular service to one local server based on the destination port number.
This is also known as port forwarding.
Whether or not DHCP is enabled, how the PCs will access the server’s LAN address impacts the
inbound rules. For example:
• If your external IP address is assigned dynamically by your ISP (DHCP enabled), the IP
address may change periodically as the DHCP lease expires. Consider using dynamic DNS so
that external users can always find your network (see “Configuring Dynamic DNS (Optional)”
on page 2-14).
• If the IP address of the local server PC is assigned by DHCP, it may change when the PC is
rebooted. To avoid this, use the Reserved IP address feature to keep the PC’s IP address
constant (see “Setting Up DHCP Address Reservation” on page 3-9).
• Local PCs must access the local server using the PCs’ local LAN address. Attempts by local
PCs to access the server using the external WAN IP address will fail.
Bandwidth
Profile
Bandwidth Limiting determines the way in which the data is sent to/from your host. The
purpose of bandwidth limiting is to provide a solution for limiting the outgoing/incoming
traffic, thus preventing the LAN users for consuming all the bandwidth of our internet link.
Bandwidth Limiting for outbound traffic will be done on the available WAN interface in the
single port and Auto-Failover modes. The limiting will be done on the user-specified
interface in Load Balancing mode. The bandwidth limiting for inbound traffic will be done
on the LAN interface for all WAN modes. Bandwidth Limiting will not apply to the DMZ
interface. See “Creating Bandwidth Profiles” on page 4-27.
NAT IP Specifies whether the source IP address of the outgoing packets should be the WAN
interface address or a specified address, which should belong to the WAN subnet.
NAT Single IP Is
On (interface)
Specifies to which WAN interface the NAT IP address belongs. All outgoing packets will
be routed through the specified WAN interface only.
Note: See “Configuring Port Triggering” on page 4-37 for yet another way to allow
certain types of inbound traffic that would otherwise be blocked by the VPN
firewall.
Table 4-2. Outbound Rules (continued)
Item Description