Confused - Port forwarding/triggering

Posts: 9 · Last edited by cyberkazoo on Sun Dec 28, 2003 12:07 am; edited 1 time in total

Would anyone be kind enough to help me out on this?

I have my network setup this way:
internet -- Comcast Cable Modem (my own, Toshiba PCX2500, from my old ISP before I moved here, it's approved, though) -- Motorola VT1005v -- Linksys Wireless Router (BEFW11S4) -- My Laptop

I set them up *wired* first, via ethernet, so both router and VT has MAC address of this ethernet port on my laptop. After I got those working, I use my laptop wireless w/ no problem. Maybe I'm blessed on the bandwidth or something (3M down/256k up) ... I haven't noticed any disconnection or anything yet, so I don't plan to change the wiring, just this port issue.

Now, my question is, I've read a lot of posts about port forwarding (which is available both on VT and router)/triggering (which is available on my router). With my setting, am I supposed to bo it on both VT *and* router or just one of them?

Any advice and thoughts are welcome. Thanks in advance!

-K

Posts: 83 · Vonage Forum Senior Joined: Nov 16, 2003 Posts: 83

This stuff tends to get covered over and over but here is a starting point.

If your VT1005 is behind your firewall, unless you have a UPnP router, you will have to do port forwarding as outlined on the Vonage web site. If your VT1005 is in front of your router (god forbid) you only have to do port forwarding if you are running a server of some kind or another (mail, ftp, web, etc.).

Sources of info:

Google
This fourm (do a search)
http://www.dslreports.com (in the Voip forum)

What is it exactly you think you want to do?

Posts: 220 · Vonage Forum Master Joined: Aug 19, 2003 Posts: 220

Maniac:

I wonder about the "God forbid" comment. I've got the Moto coming on the 30th, but to put it behind the router kills the QOS. If Vonage and moto say it can stand in front, what's the danger to me? My firewall will stop any attempts to ping beyond the Moto to the next level of routers, won't it? I can't see getting the Moto and sticking it behind the other routers if it kills QOS, since that's one of the main reasons we want it. What can a hacker do with an MTA alone? (honest question; I have no clue.)

thanks, Laurel

Posts: 9 · Posted: Sat Dec 27, 2003 11:14 pm Post subject: I know...

Thanks guys...

Maniac8888: I was wondering if port forwarding/triggering makes it any more secure in my situation (in front of my router). I'm trying to figure out if anyone got to have it behind the firewall *and* keep QoS option. I guess I'm asking too much, huh? Cool

Laureltn: I think main reasony why people put it behind the firewall is because some people got ping-ed so much Moto/Cisco goes down, which shuts down whatever they have beyond that point (router, pcs, etc.)

But unfortunately, my firewall is on the computer, and firewall isn't buit-in to my router, I think.... so they're all exposed either way anyway. Right?

** edit **
Sorry... one correction: my router *does* have NAT firewall, according to the manual.

-K

Posts: 220 · Vonage Forum Master Joined: Aug 19, 2003 Posts: 220

cyberkazoo:

I read on ONE of the boards someplace that apparently a few of the ports that were open for pinging initially have been closed. Don't know if that will make a difference or not, but can't win if you don't play, eh? I have them shipping it at 4:00 p.m. on 12/30 so it will arrive New Years Eve. Figure we can set it up and break it and fix it a million times before the 5th of January and find a situation that will work.

Good luck to you! I just don't want to go back to port forwarding and static IPs and all that if I can avoid it. I had to do that when the Linksys was in front of the ATA. When we got the Netgear and put IT in front of the ATA and the Linksys, it worked great and we didn't have to forward anything. I just hope I don't regret the switch!

Posts: 83 · Vonage Forum Senior Joined: Nov 16, 2003 Posts: 83

Ok, here is the deal on the Motorola from my experience and testing (YMMV).

1. The VT1005 comes with some, what I consider to be, serious security isses. There are several ports that are left open that the VT1005 does not use. These ports must be forwarded to a non-existant IP address through the Motorola set-up screen. If these issues have been fixed through a software update by Vonage, great. I cannot substantiate that and I haven't seen any poste about (certainly doesn't mean they don't exist).

2. The VT1005 appears to be prone to lock-ups when it sustains only a small amout of port scans. As nearly as I can tell by using a sniffer in front of the VT1005, it loks up in the range of 60-70 port scans/hour and it locks-up every time in the 8-10 hour range (I have no way to simulate port scans so I just rely on my normal network traffic). I assume this is probably a buffer overrun in the VT1005. In this scenario, of course it brings the whole network down with it.

3. The VT1005 is only a mediocore router at best. I need to have functionality that just isn't there and Number 2, above is a "show stopper" for me.

4. The QoS benefit only makes a real defference with those users that have limited upload bandwidth (<128). Frankly, I can't tell the difference in voice quality having the VT1005 in front of the router or where it now resides, behind the router.

Your requirements may be totally different that mine and you may not care about some of these issues.

BTW, if you have a UPnP router, the VT1005 will plug right in. No port forwarding or triggering are necessary.

Posts: 220 · Vonage Forum Master Joined: Aug 19, 2003 Posts: 220

Maniac:

Stinks to be you since I've picked you as my tutor. Lol

Why is this bad, what's quoted below? If the port is open and unused, even if some nasty person tries to burrow their way through, won't they hit the firewall in the NEXT level of router, which is between the MTA and our network? If not, I guess I can figure this nonexistent IP forwarding thing out, but I just want to know why!

Quote:

1. The VT1005 comes with some, what I consider to be, serious security isses. There are several ports that are left open that the VT1005 does not use. These ports must be forwarded to a non-existant IP address through the Motorola set-up screen. If these issues have been fixed through a software update by Vonage, great. I cannot substantiate that and I haven't seen any poste about (certainly doesn't mean they don't exist).

I understand the locking up stuff. This would be a bad thing and I won't be able to stand that either. If it behaves that way, behind the router it goes, period.

The QOS, maybe it won't matter around here. The Cisco has plagued us with the random beeping. First it was only to the person calling in. Now, as of the last few weeks and a new firmware update to try to fix it, we have it on our end too. Along with the beeping on our end, we suddenly got sporadic "hissing" I guess I'd call it on our end. Definitely not as good as it was when we first started out on the Cisco. So maybe we don't need QOS. Maybe it's not the ATA at all. Guess we'll find out in a few days, eh? Shocked

I sadly admit I have no clue if our two routers are UPnP. The netgear was purchased to put it in front of the linksys and we've had the Linksys for about a year, since I got my wireless card for my laptop. We're pretty much self-taught on this stuff by trial and error. We don't have anything fancy going on, but with two kids I want the phone to be reliable because even the 14-year-old shouldn't be resetting the system. Hopefully, like I said, we'll have the down time of the holiday to get it working.

thanks, Maniac8888! Happy New Year!

Laurel

Posts: 83 · Vonage Forum Senior Joined: Nov 16, 2003 Posts: 83

Laureltn:

Tutor is my middle name. Don't worry. Let's see if I can walk you down the path here.

1. If there are open ports, one leaves themselves to those kinds of people that would want to exploit your network. With an open port, you flag yourself as a person that has potential network vulnerabilities. In time, you will get so many port floods (to not only open but closed ports), it will hang any "Best Buy" type routers. This has been a serious problem with the VT1005. Perhaps this has been fixed. I don't know since I put it behind my router about 6 weeks ago.

Do be absolutely sure, do a port scan at http://www.dslreports.com or one of the other sites that perform this service.

2. I can't speak to the Cisco 186 as I never had one. Keep in mind that all Voip services are bandwidth intensive. Download speeds will equate to quality of the incoming conversation, upload speeds will equate to the quality of how you sound to the person on the other end of the phone. Voip is a relatively new technology. As such, it is prone to some trial and error. I might recommend you go over to http://www.dslreports.com and look in the Voip forum. There is a lot of help there.

Hope this helps.

Posts: 9 · Posted: Sun Dec 28, 2003 9:22 pm Post subject: Another surprise

Thanks Maniac:

Guess what, it turned out that my router is also UPnP capable! I bought it so cheap I didn't even think it came with those features. I had no idea until you mentioned it. Thanks bunch... good news if I don't have to mess with ports, but I'll definitely try port scanning. Depending on the results, I'll put it behind the firewall.

I tend to run streaming video/audio all the time at home (whenever I'm home that is, thought it's not much)... so I'd like my connection to be as consistant as possible.

Another question: I've read that connection tends to be slower if it has to go through the firewall. Is it true? If so, wouldn't there be any difference in the call quality, though (I know you see no difference, but I'm just curious, theoritically)?

Posts: 2 · New Forum Member Joined: Dec 19, 2003 Posts: 2

I can't find anything that would suggest that the VT1005 supports UPnP. My router is a home made Linux beast. When I saw the discussion here about UPnP support, I installed Linux-IGD into the router to try it out. Other applications (MSN Messenger) detect the UPnP support and map ports accordingly, but the VT1005 does not.
--Josh