User Manual
Page 45 of 66
NAT Endpoint Filtering
The NAT Endpoint Filtering options control how the router's NAT manages incoming connection requests to ports that are already being used.
Endpoint Independent
Once a LAN-side application has created a connection through a specific port, the NAT will forward any incoming connection
requests with the same port to the LAN-side application regardless of their origin. This is the least restrictive option, giving the best connectivity and
allowing some applications (P2P applications in particular) to behave almost as if they are directly connected to the Internet.
Address Restricted
The NAT forwards incoming connection requests to a LAN-side host only when they come from the same IP address with which a
connection was established. This allows the remote application to send data back through a port different from the one used when the outgoing session
was created.
Port And Address Restricted
The NAT does not forward any incoming connection requests with the same port address as an already establish connection.
Note that some of these options can interact with other port restrictions. Endpoint Independent Filtering takes priority over inbound filters or schedules,
so it is possible for an incoming session request related to an outgoing session to enter through a port in spite of an active inbound filter on that port.
However, packets will be rejected as expected when sent to blocked ports (whether blocked by schedule or by inbound filter) for which there are no active
sessions. Port and Address Restricted Filtering ensures that inbound filters and schedules work precisely, but prevents some level of connectivity, and
therefore might require the use of port triggers, virtual servers, or port forwarding to open the ports needed by the application. Address Restricted
Filtering gives a compromise position, which avoids problems when communicating with certain other types of NAT router (symmetric NATs in particular)
but leaves inbound filters and scheduled access working as expected.
UDP Endpoint Filtering
Controls endpoint filtering for packets of the UDP protocol.
TCP Endpoint Filtering
Controls endpoint filtering for packets of the TCP protocol.
NAT Port Preservation
NAT Port preservation (on by default) tries to ensure that, when a LAN host makes an Internet connection, the same LAN port is also used as the Internet
visible port. This ensures best compatibility for internet communications.
Under some circumstances it may be desirable to turn off this feature.
Anti-Spoof checking
Enabling this option can provide protection from certain kinds of "spoofing" attacks.
Non-UDP/TCP/ICMP LAN Sessions
When a LAN application that uses a protocol other than UDP, TCP, or ICMP initiates a session to the Internet, the router's NAT can track such a session,
even though it does not recognize the protocol. This feature is useful because it enables certain applications (most importantly a single VPN connection to
a remote host) without the need for an ALG.
Note that this feature does not apply to the DMZ host (if one is enabled). The DMZ host always handles these kinds of sessions.