Smart Tips. Enabling WAN Public Access with DDNS and Port Forwarding. Overview. Key Features. Dynamic DNS. Port Forwarding

Transcription

1 Smart Tips Enabling WAN Public Access with DDNS and Port Forwarding This Smart Tip document provides step-by-step guidance for configuring dynamic DDNS (DDNS) and port forwarding on Cisco small business routers for providing secure access to an internal web server and an IP video camera from the public Internet. Overview Cisco Small Business routers provide an advanced Internet-sharing network solution to meet the needs of small businesses. Multiple computers in the small business office can share the Internet connection through connections with its integrated switch ports, attached switches or wireless access points. The router s 10/100 Ethernet WAN interface connects directly to the broadband DSL or to a cable modem with VPN and Firewall capability. However, providing access from the public Internet to network servers, network services, or IP video surveillance cameras on the internal network is challenging due to the following reasons: The internal local area network (LAN) must be fully protected from unauthorized users on the public Internet by a firewall, which prevents inbound connections except for authorized access to specific network resources. Private IP addresses are assigned to the hosts in the internal network to reduce the usage of public IP addresses, of which there is a limited supply. For these hosts to communicate with the public Internet, network address translation (NAT) must translate each private IP address to a public IP address. Many small businesses today use broadband Internet connections. The broadband Internet connection receives a dynamic public IP address from the service provider, which is not static and may change frequently. Combining the router s dynamic DDNS and port forwarding features provides a simple solution that allows controlled, secure access to the router s WAN interface and the internal network from the public Internet. Key Features Dynamic DNS Dynamic DNS (DDNS) is a service that maps Internet domain names to IP addresses. Unlike DNS, which only works with static IP addresses, DDNS is designed to support dynamic IP addresses, such as those assigned by a DHCP service. DDNS is a good fit for small business networks that receive dynamic public addresses from an Internet service provider. Some DDNS providers, such as dyndns.com, provide dynamic DDNS services free of charge. To use it, sign up with a DDNS provider, add the Fully Qualified Domain Name (FQDN) for the router, and configure the Cisco router to automatically update the WAN IP address associated with its FQDN. Now you can access the network resource and WAN router using the FQDN without knowing its current public IP address. Port Forwarding Port forwarding opens a specific TCP or UDP port to a server behind the router firewall, allowing all incoming traffic on that port to be sent directly to the specific server. This feature permits connections between external hosts and services within a private LAN. Figure 1 DDNS and Port Forwarding Network Diagram Internet rtsp://myrv120w.dyndns.org/mobile.sdp WAN Router LAN WAN IP: Dynamic (e.g ) DDNS Host: myrv120w.dyndns.org Internal Server: IP Video Camera: Enabling WAN Public Access with DDNS and Port Page 1

2 Featured Products Cisco RV120W Wireless-N VPN Firewall Router (GUI configuration screens of this router are shown in this document as an example) Cisco RV220W Wireless-N Network Security Firewall Cisco RV042, RV042G, RV082, RV016, RVL200, WRVS4400N, and WRV210 small business routers Cisco RV180/180W Wireless-N Multifunction VPN Firewall Design Tips WAN IP Address The ISP may provide either a dynamically assigned IP address or a statically assigned IP address to the WAN router. For a static IP address, DDNS is not necessary, and using the IP address with port forwarding is sufficient to access the server from the Internet. DDNS An account needs to be created on the DDNS provider such as dyndns.com or tzo.com. Within the account, various DDNS host entries are created. The administrator should create a DDNS host name for the router WAN IP address. The router is configured to update the DDNS entry instantly through HTTP whenever the IP address is changed. Port Forwarding It is important to know the service ports that the server uses. Common service ports such as web service or service are predefined on the router for easy configuration. Any customized service can also be created based on its TCP or UDP ports number. Port forwarding simplifies the configuration when you do not deploy the same service on multiple servers. LAN IP Address It is highly recommended that the internal server or IP camera that uses port forwarding is configured with a local static IP address instead of getting a DHCP address from the router. Using a DHCP address will invalidate the port forwarding rule if the IP address on the internal device changes. The static IP address configured should not be part of the same DHCP address pool. Network Diagram Figure 1 illustrates a sample implementation of DDNS and port forwarding using a Cisco small business router. The WAN router receives its IP address dynamically and has both the firewall and NAT enabled by default. In this example, the WAN router can be accessed by its FQDN (myrv120w.dyndns.org). To make this work, the DDNS host entry myrv120w.dyndns.org is mapped to the dynamic IP address of the router s WAN Interface. Port forwarding is configured as follows: Forward port 80 to port 80 on the web server on the internal LAN ( ) Forward port 1028 to port 80 on an IP video camera Forward RTSP protocol to the video camera RTSP port With this configuration, remote PCs and mobile devices can access internal services using web browsers and applications from the public Internet. Configuring DDNS and Port Forwarding on Cisco Small Business Routers Preconfiguration Checklist Connect the Ethernet cable between the WAN port on the RV router and the Ethernet port on the DSL or cable modem. Turn on the RV router and then connect internal PCs, servers, and IP video cameras to the LAN switch or the switch ports on the RV router. Refer to the Cisco Small Business Smart Tips document regarding connecting a router and switch with VLANs and trunks to complete the LAN settings. Make sure the local PCs and servers protected by the RV router firewall are able to communicate with each other and with the router. Ensure that the internal web server has the IP address of and change the WVC210 IP video camera to use the static IP address Refer to the IP Video Surveillance Smart Setup Guide for guidance configuring the IP address of WVC210 IP video camera. Configuring WAN Access The default WAN setting of the RV router is set to get its IP address dynamically from the ISP. The firewall and NAT are also enabled by default. There is no further configuration needed to enable basic WAN access. Step 1 Go to Networking > WAN > IPv4 WAN Configuration and verify that the Internet address source and DNS servers are set to Get Dynamically from ISP. If the address is assigned statically by the ISP, set the IP address source to Use Static IP Address and enter the specific IP address, subnet mask and default router information provided by the ISP. Enabling WAN Public Access with DDNS and Port Page 2

3 Figure 2 Verifying WAN Configuration Figure 3 Adding a New Hostname on the dyndns.com Website Step 2 Go to Status > System Summary and in the WAN information (IPv4) section, verify that the router receives its IP address, subnet mask, gateway, and DNS information from the ISP and that NAT is enabled. Configure DDNS Settings In this section, we will create the DDNS entry myrv120w.dyndns.org for the WAN router and configure the WAN router to update this DDNS entry automatically with its current WAN IP address whenever it changes. Step 1 Configure the DDNS account. 1. If you don t have a DDNS account, go to to apply for a DDNS account. A valid address is required to activate the account. The basic service is free of charge. 2. Once the account is approved and activated, log in and go to My Services > My Hosts. Click Add Host Service to create a new DDNS host name for the RV router. In this example, the host name myrv120w.dyndns.org is created for the RV router. 3. Enter any IP address, such as , for now, and click Add to Cart to complete the configuration. Step 2 Configure the Cisco router. 1. Log into the RV router and Go to Networking > Dynamic DNS to select DynDNS.com for the DDNS service. 2. Enter myrv120w.dyndns.org for Host and Domain Name and enter the username and password for your dyndns.com account. 3. Check Update every 30 days to configure the router to update the host information on DynDNS.com and keep the subscription active after the 30-day trial. 4. Click Save to cause the router to update the DDNS entry online, immediately, with its current WAN IP address. The DDNS setting page now displays the messages: Operation succeeded and WAN (DDNS Status: DDNS updated with IP address ). Enabling WAN Public Access with DDNS and Port Page 3

4 Figure 4 DDNS Setting Page Figure 5 Custom Services Screen For the DDNS settings to take effect immediately, the router must have an active Internet connection. You can also log into dyndns.com to verify that the host entry has a newly updated IP address. Configuring Port Forwarding In this section, you will configure port forwarding for the internal web server and an internal IP video camera with the IP address Users from the public Internet will then be able to access the web server using and to access the IP video camera web page using or the IP video camera s RTSP stream directly using rtsp://myrv120w.dyndns.org/mobile.sdp. Step 2 Add the first port forwarding rule for internal Web server access. After creating this rule, HTTP traffic (TCP port 80) will be redirected to the HTTP port for the internal web server ( ). 1. Go to Firewall > Port Forwarding and click Add. 2. Select HTTP in Service, change the Action to Always Allow, and select Any from the Source Users pull-down selection list. 3. Enter the internal web server IP address ( ) for Destination IP. 4. Select Same as incoming port for Forward to Port and click Save. A rule should now be displayed in the summary. Step 1 Create a new service to be used for port forwarding. 1. Go to Firewall > Access Control > Custom Service. 2. Click Add to create a service for TCP port Enter TCP_1028 for the name and specify TCP as the Type and set both Start Port and Finish Port to Enabling WAN Public Access with DDNS and Port Page 4

5 Figure 6 Port Forwarding Screen Figure 7 Port Forwarding Entries When defining the rules, the source refers to public Internet users and the destination refers to the small business internal LAN. Validating the Configuration Step 1 From a client PC or laptop connected to the public Internet, direct the web browser to The web browser should display the contents of the internal web site. Step 2 From a client PC or laptop connected to the public Internet, direct the web browser to The web browser should display the web page and video stream for the WVC210 IP video camera. Figure 8 Verifying TCP Port Forwarding Step 3 Repeat the procedure described in Step 2 to create the second rule for viewing the web page of IP video camera,. After creating this rule, TCP traffic to TCP port 1028 will be redirected to the HTTP port for the internal server For this rule, select TCP_1028 in the Service section. 2. Change the Action to Always Allow and select Any from the Source Users pull-down selection list. 3. Enter the IP camera IP address ( ), select Specify Port from the Forward to Port pull-down selection list, enter port 80 for the Port Number, and click Save. Step 4 Repeat the procedure described in Step 2 to create the third rule for forwarding RTSP: TCP service to the same port on the IP video camera ( ). After completing this step, all three rules should be displayed, as shown in Figure 7. Enabling WAN Public Access with DDNS and Port Page 5

6 Step 3 From a smart phone or laptop connected to the public Internet, launch a media player such as VLC player on the PC to view the RTSP stream directly from the WVC IP Video Camera using the link RTSP://myrv120w.dyndns.org/mobile.sdp. Figure 9 To verify RTSP forwarding, Mobile Streaming should be already be enabled on the WVC210 IP video camera. Verifying RSTP Forwarding Other Related Features Demilitarized Zone Other Related Features The Cisco RV router also supports a demilitarized zone (DMZ) option. A DMZ is a subnetwork that is accessible from the public Internet but which resides behind the firewall. The DMZ function redirects packets going to a specific WAN port IP address to a particular IP address in the LAN. Firewall rules can be configured to permit access to specific services and ports on the DMZ from either the LAN or from the public internet. In the event of an attack on any of the DMZ nodes, the LAN is not necessarily affected. The DMZ can also be used with DDNS in a scenario where a single server offering multiple services on the small business network needs to be accessible from the public Internet. One-to-One NAT The Cisco RV router also supports one-to-one NAT, which is a way to make systems behind a firewall with private IP address appear to have public IP addresses. One-to-one NAT can be used when the ISP provides a pool of static public IP addresses. It maps the private address of each server behind the firewall to a unique public IP address. It becomes a simple solution when small business has T1 or business class broadband connection. Usually those services will have much higher cost. However one-to-one NAT is necessary when multiple servers use the same port, such as multiple web servers using port 80. Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R) 2012 Cisco Systems, Inc. All rights reserved. Enabling WAN Public Access with DDNS and Port Page 6