Re: NetMeeting Through a NAT Router?

On 11 Aug 2005 16:29:40 GMT, Jeff Gaines wrote:

> Apologies if this is a FAQ, I have down-loaded and read the last 300
> messages in the group (back to April) and have seen odd references but
> nothing definitive.
>
> I am running NM 3.01 on XP Home SP2, connected to the Internet through
> a Draytek Vigor 2600G.
>
> I have re-directed ports 1503, 1720 and 1731 (TCP) to the local PC and
> opened all ports from 1024 to 65535 (UDP), which worries me a bit.

The recommended strategy is to use the dmz feature of the router -- that
forwards all unsolicited traffic so the number of redirected ports is
larger but it is logistically easier to manage.

If your router has a built in h.323 proxy (a few older models did) -- only
tcp 1503 and 1720 need be forwarded. You could try without forwarding the
udp ports

>
> Windows firewall is disabled but I am running Kerio Personal Firewall,
> NM is 'authorised' by Kerio.
>
> I can receive incoming incoming calls and sound, sharing etc. all work.

Presumably these are calls made to the wan IP of the router?


>
> When I make an outgoing call the person at the other end can hear me
> but I can't hear him.


That is the usual situation with NAT interference(I assume that you also
get no incoming video?) -- I suggest you use the dmz strategy instead of
the port forwarding that you are trying. I can't tell you exactly what the
problem is but


> He also has Kerio running and it shows my call as
> originating from 192.168.1.14, not very helpful to his copy of NM :-(

I presume this user is not on the same network? This is not usual -- this
must be something your router is doing ( or not doing) -- and perhaps the
root cause of your problem.

Does the Kerio firewall somehow interact with the router?

>
> If I put my PC in the DMZ on the Draytek everything works fine, but I
> would rather just open the ports that are needed rather than opening
> everything up.

It may be possible to do this without using the dmz but I can't tell you
specifically what to change (it sounds like you have already done all the
right things).


>
> I have Googled and read several articles, they range from easy peasy
> just open a few ports to it's impossible don't try.


I don't think it is impossible in the general sense but it usually more
trouble than it is worth ( your local firewall should protect you almost as
well as the NAT -- so going the dmz route is not in my opinion all that
much more dangerous).

>
> I have also asked Drayek (no response so far) why the router is sending
> out an internal IP address, I don't know enough (anything) about NAT to
> even know if this was a sensible question.

The leaking the private IP should not happen -- so I suspect that is a
router anomaly -- I don't think other routers have this leakage under this
situation (but I have always used the dmz route)

>
> Any suggestions or pointers to guides would be very much appreciated,
> we use NM for support amongst a small group of us so getting it working
> with calls in both directions would be really useful!
>

I would suggest that you use the dmz and configure the local firewall
appropriately.
.

Relevant Pages

  • Re: What is broken:McAfeee firewall or my router ????? Urgent, ple
    ... your computer regardless of what McAfee firewall said. ... If your router is ... warned about those ports being available right away if you had any of those ...
    (microsoft.public.security)
  • Re: What is broken:McAfeee firewall or my router ????? Urgent, ple
    ... your computer regardless of what McAfee firewall said. ... If your router is ... warned about those ports being available right away if you had any of those ...
    (microsoft.public.security)
  • Re: How to stealth against ping/echo requests?
    ... I just started using the Online-Armor firewall. ... Some ports are even open. ... Are you behind a router? ... Every time it founds a new LAN, it asks if you want to trust it ...
    (comp.security.firewalls)
  • Re: DMZ When to use
    ... > DMZ is a feature that a router uses, but I guess it could be used on a Linux ... It has nothing to do with Linux, it is a question about firewall architecture ... NetMeeting is what ...
    (comp.security.firewalls)
  • Re: adsl router security
    ... ]>used the virtual server feature to route packets on ports 21 and 80 to the ... ]>running ssh and mysqld but no other network services. ... if you can if the router is programable ... Remember all a firewall does is to prevent certain packets getting ...
    (comp.os.linux.security)