AudioCodes mediapack MP-500, Руководство пользователя

Страница: 80 / 574

SIP User's Manual 80 Document #: LTRT-12801
MP-500 MSBG
3.4.3.3.4 Configuring a DMZ Host
The DMZ (Demilitarized) Host feature allows a single local computer to be exposed to the
Internet. You can designate a DMZ host for the following scenario examples:
„ You wish to use a special-purpose Internet service, such as an on-line game or video
conferencing program that is not present in the Port Forwarding list and for which no
port range information is available.
„
You are not concerned with security and wish to expose one computer to all services
without restriction.
Warning: A DMZ host is not protected by the firewall and may be vulnerable to attack.
Designating a DMZ host may also put other computers in the home network
at risk. When designating a DMZ host, you must consider the security
implications and protect it if necessary.
For an incoming request for access to a service in the home network, such as a Web
server, the device forwards this request to the DMZ host (if one is designated) unless the
service is being provided by another PC in the home network (assigned in Port
Forwarding), in which case that PC receives the request instead.
¾
To designate a local computer as a DMZ Host:
1. Click the DMZ Host item ( Configuration tab > Data Settings menu > Firewall
submenu > DMZ Host page item); the following page appears:
Figure 3-56: Defining a DMZ Host
2. Select the check box, and then enter the local IP address of the computer that you
want to designate as a DMZ host. Note that only one LAN computer may be a DMZ
host at any time.
3. Click OK to save the settings.
3.4.3.3.5 Configuring Port Triggering
Port triggering can be used for dynamic port forwarding configuration. By setting port
triggering rules, you can allow inbound traffic to arrive at a specific LAN host, using ports
different than those used for the outbound traffic. This is called port triggering since the
outbound traffic triggers to which ports inbound traffic is directed. For example, consider a
gaming server that is accessed using UDP protocol on port 2222. The gaming server
responds by connecting the user using UDP on port 3333 when starting gaming sessions.
In such a case, you must use port triggering, since this scenario conflicts with the following
default firewall settings:
„ The firewall blocks inbound traffic, by default.
„
The server replies to the device's IP address, and the connection is not sent back to
your host, since it is not part of a session.
To solve this you need to define a Port Triggering entry, which allows inbound traffic on
UDP port 3333, only after a LAN host generated traffic to UDP port 2222. This will result in
accepting the inbound traffic from the gaming server and sending it back to the LAN Host
which originated the outgoing traffic to UDP port 2222.