5 Configure with NetCom Manager
5.6.5 DMZ and Virtual Servers
Why is it recommended not to use the DMZ function of the Router? There are two reasons. The
first one is simple, only one device in the LAN can be defined as the DMZ target. The DMZ is
implemented as "Send all IP data targeted for the Router to the DMZ station, unless there is a
specific rule for a different target". When a second NetCom
+
shall be installed on the LAN, the
Virtual Servers have to be configured anyway.
The second reason is the security. Using the “DMZ” option the Firewall in the Router becomes
transparent. All data from outside is transferred to the LAN, including all malicious data. In
general this is not an especially smart idea.
5.6.6 Firewalls in Foreign Networks
There are many situations where it is not possible to configure the firewall between the Internet
and the network where NetCom
+
is installed. For example this may be a company network, where
it is not allowed to open the firewall for external access to internal stations. Or it may be part of
a GSM network, where the provider uses private IP Addresses to connect customers equipment.
Given such a configuration the NetCom
+
has access to the Internet by establishing the connections
on its own. This restricts the operation modes of the serial ports (see
6.2.2.2 on page 76
) to
“TCP Raw Client” and “IP Modem”, where the NetCom
+
operates as a client. Here the NetCom
+
establishes a connection to an external server, which is out-going from the network of installation.
The user has to provide the external server, accessible via the Internet.
Another way to work around the restrictions is the encrypted VPN (chapter
10 on page 111
). Also
here the user provides a server to manage the OpenVPN connections, and the users PC connects to
this server. Once this is established there is the independent and not filtered network of the VPN,
where all operation modes of the NetCom
+
are available without limitations.
5.7 Dynamic IP Address and OpenVPN™
The option of Encryption uses a Virtual Private Network (VPN) based on a single TCP connection
between the NetCom
+
and a client computer. Regardless of strong encryption or even no encryption
at all, here the key point is the single TCP connection. It is more simple to provide a Firewall
configuration for a single connection, so the Router Firewall is more easy to set up.
The network link established by OpenVPN™ requires to have a target address and a port number.
Since the basic TCP connection is activated by the openvpn.exe program, there is the freedom of
using a DNS name for the target device.
With a Dynamic IP Address for the NetCom
+
site, one of the several Internet services for Dynamic
DNS (DynDNS) may help. It is even relatively simple to construct an own version. Using this
service the openvpn.exe program gets the IP Address of the Firewall Router, and will establish the
link. When the IP Address changes (after 24 hours), the connection first gets lost. OpenVPN™
will continuously attempt to connect again. When the new IP Address is known via DynDNS,
the network link is re-established. The NetCom
+
is available again, because the IP Address on
the OpenVPN™ link did
not
change. Even when a serial port has been open, the function may
continue seamlessly.
September 2016
NetCom Plus User Manual
58
Summary of Contents for NetCom Plus 111
Page 133: ......
