Operating modes and functions
ELSA LANCOM DSL/10 Office
23
The hiding place—IP masquerading (NAT/PAT)
But this provokes objections from the network manager responsible for the security of
data on the company's network: Every workstation computer on the WWW? Surely this
means that anyone can get in from outside?—Not true!
IP masquerading provides a hiding place for every computer while connected with the
Internet. Only the router module of the unit and its IP address are visible on the Internet.
The computers in the LAN then use the router as a gateway so that they themselves
cannot be detected. To do this, the router separates Internet and Intranet, as if by a wall.
Therefore, IP masquerading is also called a “firewall function“.
For further information, see the 'IP routing: IP masquerading' section.
TCP/IP packet filters
You can use your entries in the routing table to determine quite precisely which data
should be transferred. Additionally, you can use the '0.0.0.0' entry in the 'Router-name'
field to reject whole groups of IP addresses.
Occasionally, you may wish to restrict a transmission even further. You can do this using
a characteristic of TCP/IP, which is to send port numbers for destination and source as
well as the source and destination IP addresses with a data packet. The destination port
in a data packet stands for the service to be addressed in the TCP/IP network. The
destination ports are fixed for the various services on the TCP/IP network (see also 'TCP/
IP-ports' in the reference section). The source ports, on the other hand, may be selected
freely within certain ranges.
The router can check the source and destination ports of data packets using the TCP or
UDP protocols. It can then deduce the purpose of the data from these ports. For example,
FTP accesses or telnet sessions can be identified.
Call charge management
The capability of the router to automatically establish connections to all required remote
stations and close them again when no longer required provides users with extremely
convenient access, e.g. to the Internet. However, quite substantial costs may be incurred
by data transfer over paid lines if the router is not configured properly (e.g. in the filter
configuration) or by excessive use of the communications opportunities (e.g. extended
surfing in the Internet).
Time-dependent connection control
The telephone charges can be controlled by limiting the maximum connection time. This
requires setting up a time budget for a specified period. In the router's default state, for
example, connections may only be established for a maximum of 10 hours within 6 days.
