Sunday, August 19, 2007

Two router setups




Friday, August 17, 2007

The port forwarding checklist

O.K. So you have to forward a port to a computer in your LAN because you want to run an internet server. You configure the router but it does not work. This checklist goes through some of the major points what may be wrong:

Find out the correct port numbers and protocols: Check the documentation of the software or search the internet for the ports you have to forward. Port numbers are from 1-65535. The normal protocol choices are TCP or UDP.

Verify the server uses those ports: Make sure the server is running on the computer. Now open a command prompt window and enter netstat -an. Look at the TCP lines with "LISTENING" state and also at the UDP lines. In those lines look for the entries which have your port number in the local address column after the ":". If you look for port 12345 the local address could be or Be sure to find all lines for your port number and protocol.

If you find your port with local address or the IP address of the computer in front (e.g. then a server is listening correctly. If you only find then the server is only listening on the local "loopback interface". This interface is only accessible on the computer. The forwarding will not work. In that case find out how to change the interface on which your software is listening.

If you don't find the port at all it is either not listening at all or it is listening on a different port. Find your running server entering "tasklist" into the command prompt window. Find the server checking the image name in the first column. Make a note of the PID in the second column from that line. Now enter "netstat -ano" and search for this PID in the last column of the netstat output. The lines with this PID in the last columns are those ports on which your server is currently listening.

Check the firewall: Make sure you have opened the ports in the firewall on the computer. You have to open it for all computers (i.e. the whole internet) and not only for the local subnet or similar.

Check the IP address of the server: The destination IP address of the port forwarding is the IP address of the server inside your LAN. Enter ipconfig /all to find out. It is highly recommended to use a static IP address on that computer because otherwise the IP address may change over reboots and each time you have to adjust the forwarding in the router. If the entry for your network connection in ipconfig /all shows DHCP enabled then you don't have a static IP address on the computer. Take a note of the IP address of the computer, e.g.

Make sure the server is operational: Try to connect to the server from inside your LAN using the IP address you have found in the previous step. E.g. point your client software to and port 12345. Make sure it works. Otherwise your server may not be operational.

Enter and enable the forwardings: Be sure to enter the correct information into the port forwarding form on the router. Choose the correct protocol, i.e. TCP oder UDP. If you have the option to forward both at the same time, you may choose that option. Forward all the ports that you need as target IP address for the forwarding enter the IP address you have found before of the server, e.g. Don't forget to enable the forwarding if the router has the option to enable/disable specific entries and don't forget to save the settings on that page.

Do not enable port triggering or smiliar: You want to forward some specific ports. Port triggering does dynamically forward some ports based on some traffic on some other ports. Thus configuring port forwarding and port triggering for the same ports may or may not work. The port triggering function may influence the effect of the port forwarding.

Access the server from inside your LAN: find the IP address of the router on the internet port. Usually you find it somewhere on the status page of the router configuration. (It is not the LAN IP address of the router, which usually is a private IP address and ends in .1, e.g. Point your client software to the IP address on the status page and make sure it works.

Make sure the router has a direct connection to the internet: Open the website . It shows you the public IP address from which the request came. This IP address must be the IP address you have found before in the status page of your router on the internet port. If it is different, your router is not directly connected to the internet but there is another router in front of the router which also does network address translation (NAT). You have to configure port forwarding on this other router as well. Most of the time, this other router is embedded into your modem. If you connect through an apartment building connection there is another router inside your building. Some ISPs also use NAT. In the two latter cases there is probably little or nothing you can do to get the server into the internet.

Access the server from the internet: You have to access the public IP address of your router which you saw in the status page of the router and which you could also find with in the previous step. You cannot access the server on its private IP address or similar. If your ISP frequently changes the public IP address on your internet connection you may consider to configure the "DDNS" function in your router if it has one. With DDNS the router registers its IP address with a service like You can then access your server using a simple hostname instead of the IP address.

Still not working? If everything so far is correct and the way it should be but you cannot access the server it may be that your ISP blocks it. Some ISPs don't allow clients to run internet servers on the connections. Some other ISPs block specific ports which are known to cause problems or are well-known to spread malware. You may ask your ISP about whether they block the port you are trying to use.

Wednesday, August 15, 2007

Necessary steps to secure a wireless router

If you setup a wireless router there are a few things you should configure on the router to make it secure. Unfortunately many routers come with a very insecure wireless setup which basically allows anyone in your proximity to use your internet connection, to access your LAN and your computers. It is important to make the following changes or verify them:

  1. Change the wireless network name (SSID) from the default to something unique. Linksys routers come with SSID "linksys". Netgear comes with SSID "NETGEAR". It is important to change it to something unique. This allows you to easier identify your wireless network and it prevents your wireless computers from accidentally connecting to your neighbor's router if he runs the same brand router with the default SSID.
  2. Enable wireless security/encryption. Use WPA2 or WPA whenever possible. Usually there are several variants of WPA2 and WPA available. Some are for enterprise setups which include a RADIUS server. What you usually want is an easier personal setup with a pre-shared key (PSK). Choose WPA2 over WPA if possible. Choose encryption AES and TKIP if you can. This allows you to accept connections from WPA2 and WPA compatible clients. TKIP is used for WPA and AES for WPA2. Do not choose WEP for security unless you have to do this because you must connect a wireless device which only supports WEP. WEP can be cracked within a few minutes!
  3. For WPA2 and WPA enter a strong pre-shared key/passphrase. The security of your wireless network depends on the quality of your pre-shared key. It can be up to 63 characters long. Usually, you only have to enter it once on the computers and you can copy it from the router through a wired connection if necessary.
  4. Change the default router configuration password (don't confuse this with the passphrase for the wireless connection). The router comes with a default password which is published in the manual and elsewhere. Anyone who knows the password for the router configuration can make changes to the router including stealing your wireless key. Therefore you must change the password!
  5. Make sure the firewall on the router is enabled. The router firewall protects the router from attacks. Never turn it off. It will most likely expose the router web interface to the internet and you don't want that to happen.

Friday, August 10, 2007

How to open a command prompt window?






The modem check

For a successful router setup it is often good to know what kind of modem you have. Many ISPs provide you with a modem through which you can connect to the internet. Some of those modems are not simple modems but are in fact full routers. Cascading routers, however, is not without pitfalls and for the initial setup of the router it is important to understand how the modem operates. You can do a simple check to find out:

  1. Connect your computer directly to the modem.
  2. Verify you have a working internet connection.
  3. Open a command prompt window.
  4. Enter "ipconfig /all"
  5. Open your browser and go to and take a note of your IP address as seen from the internet.

Now compare the IP address shown in the "ipconfig" with the IP address shown in the internet. If both are equal your modem is (most likely) set up as a simple modem. Your computer has a direct connection to the internet through the modem.

If the IP addresses differ your modem (or wherever you have connected your computer to get the internet connection) is a router with address translation, too. Most often, you'll see a IP address like 192.168.*.* in the ipconfig. Your computer is not directly connected to the internet but another device is establishing the connection for you. For a successful router setup you should take a note of the default gatway address which you can see in the "ipconfig /all" output.

Connecting two routers wired to create a single LAN


The setup:


2. Configure the router at


4. Turn off the DHCP server on the second router.

5. Save the setting.

6. Unplug the computer from the second router.



What do you have now?













Router Setup

A blog which collects hints and tips for successful router setup for your home LAN. I have written many of them before in the Linksys Community Forums. Although I often use Linksys defaults (e.g. for the router address) they apply to many other brand consumer routers as well.