strict nat? bridge mode? what is ip passthrough? can i enable on my arris bgw210 or like router?
 
  
the arris bgw210-700 is an advanced residential gateway that supports voip, ipv6, video delivery, security firewall, and extensive remote management features.  
  
the bgw210-700 broadband gateway delivers robust video, primary line telephony, and high-speed data over broadband networks via high-speed internet connectivity. 
  
the four gigabit ethernet ports can be separated into different services allowing the configuration of dedicated ports for data. it is designed for advanced dsl network service deployments and supports quality of service (qos) and ip passthrough. 
  
determining the business need 
business customers sometimes state that they need dsl/broadband cpe that can be configure or placed into a bridged mode where they are putting other cpe behind the dsl/broadband cpe. many times, these customers can be better served with a configuration known as ip passthrough. the below information explains the difference between ip passthrough vs bridged mode and provides instructions on how to configure the arris bgw210-700 internet gateway for ip passthrough. 
  
ip passthrough means the at&t supported cpe device terminates the dsl, authenticates with the network (receives a wan ip) and shares that ip address with a single device connected to the at&t supported cpe equipment. this configuration is often times suitable for a business customer desiring to connect third party equipment to at&t supported equipment. the ip passthrough configuration still allows at&t support groups to access the at&t supported equipment while allowing end-users to connect third party equipment in a configuration they desire. the ip passthrough configuration will only allow one connection to at&t supported equipment to be 'unfiltered' or pingable from the wan or internet side of the at&t equipment (does not support multiple pingable connections). 
  
the ip passthrough feature allows a single pc on the lan to have the at&t gateway's public address assigned to it. it also provides port address translation (pat) or network address and port translation (napt) via the same public ip address for all other hosts on the private lan subnet. 
using ip passthrough, the public wan ip is used to provide ip address translation for private lan computers. the public wan ip is assigned and reused on a lan computer. 
  
note: remember to make a copy of all current ip settings before proceeding. 
  
configuring ip passthrough: 
run your web browser application, such as firefox and chrome, from the computer connected to the arris bgw210-700. 
  
 
 enter http://192.168.1.254 in the location text box. 
 
  
 
 click the ip passthrough tab and configure your settings. 
 
  
  
dynamic host configuration protocol (dhcp) address serving can automatically serve the wan ip address to a lan computer. 
  
when dhcp is used for addressing the designated ip passthrough computer, the acquired or configured wan address is passed to dhcp, which will dynamically configure a single servable address subnet, and reserve the address for the configured pc's mac address. this dynamic subnet configuration is based on the local and remote wan address and subnet mask. 
 
  
 
 the two dhcp modes assign the needed wan ip information to the client automatically. 
 
 you can select the mac address of the computer you want to be the ip passthrough client with fixed mode or with first-come-first-served dynamic. the first client to renew its address will be assigned the wan ip. 
 
 
  
 
 manual mode is like statically configuring your connected computer. with manual mode, you configure the tcp/ip properties of the lan client computer you want to be the ip passthrough client. you then manually enter the wan ip address, gateway address, and so on that matches the wan ip address information of your at&t device. this mode works the same as the dhcp modes. unsolicited wan traffic will get passed to this client. the client is still able to access the at&t bgw210 device and other lan clients on the 192.168.1.x network. 
 
  
 
 dhcp lease: by default, the ip passthrough host's dhcp leases will be shortened to two minutes. this allows for timely updates of the host's ip address, which will be a private ip address before the wan connection is established. after the wan connection is established and has an address, the ip passthrough host can renew its dhcp address binding to acquire the wan ip address. you may alter this setting. 
 
  
 
 click save. changes take effect upon restart. 
 
  
note: ip passthrough restriction 
since both the bgw210 internet gateway and the ip passthrough host use the same ip address, new sessions that conflict with existing sessions will be rejected by the bgw210. for example, suppose you are working from home using an ipsec tunnel from the router and from the ip passthrough host. both tunnels go to the same remote endpoint, such as the vpn access concentrator at your employer's office. in this case, the first one to start the ipsec traffic will be allowed; the second one from the wan is indistinguishable and will fail. 
  
if you need further assistance with your ip passthrough setup and configuration contact connectech support. 
  
jared, at&t community specialist
see above to learn how to setup and configure ip passthrough mode for your router. if you need further assistance with your ip passthrough setup and configuration contact connectech support. jared, at&t community specialist
Magda, have you found what you need, yet?


I did this many years ago. It is simple… the 2nd time you do it!  

Exit points are simply “interrupts” that IBM supplies. You can attach programs to them, and the programs will automatically run at that point. For setting your AS/400 up to accept FTP logons, for example, the exit point is:  

QIBM\_QTMF\_SVR\_LOGON and the format you wil use is: TCPL0100.


A program inserted there can control WHO can log on, and when.  

To control WHAT they can do, you use another exit point, QIBM\_QTMF\_SERVER\_REQ and use format VLRQ0100.


My notes (from 1999) say I used the IBM TCP manual to get this info, specifically: TCP/IP manual SC41-5420-01 page I-14.


I do not know if it will allow me to post code here, it is long and complex due to the number of variables and some of them being in hex.


Write me (drow@waxie.com) if you would like me to email you my program code.


David Row  

WAXIE Sanitary Supply  

San Diego, CA





This is a link for [Add-ons for Firefox](https://addons.mozilla.org/en-US/firefox/). These are programs written by users or developers that the browser knows how and when to call. The developers of Firefox designed it to allow external programs to be hooked in by users of the browser.


IBM did something similar for a lot of the TCP/IP and other server functions. (And a lot of other things.) When you connect to the FTP server for example, the server checks to see if a program has been registered to process FTP logon requests. The registered program is an ‘exit program’.


Browser add-ons get an entry added to a file someplace within the browser directory structure. In your iSeries, the entry would be added to the Registration Facility. (Not always, but that’s the commonly recognized object for exit points and programs.) Use WRKREGINF to review your registration facility.


To create an exit program, you need to know the parameter list that will be passed to your program and the exit protocol. To find the parameter list, you should start looking at the documentation for the server the exit program will be associated with. The protocol, the meanings of the parms and what to with them, is also there.


A FTP exit program would be structured after documentation within the [File Transfer Protocol exit programs](http://publib.boulder.ibm.com/infocenter/iseries/v5r4/index.jsp?topic=/rzaiq/rzaiqreferenceexit.htm) topic of the Information Center for your release.


Once registered, a server logon exit program (for example) would be called just before the server decides whether or not to accept the logon. Your exit program directly influences that decision by returning an ‘accept or reject’ parameter. It chooses based on examination of the input parms.


The exit program may control who can and cannot logon, where they may logon from, what times of day logons are accepted, or it might accept all logons — its purpose can be simply to write all logons to a log file or to send a message when particular logons happen. Your exit program can do whatever it is programmed to do at that point in the logon process.


It doesn’t have to be a ‘security’ function. It’s whatever you want it to be.


For the FTP server, there are two general exit points. One is just before a logon is accepted. The other is just before each transaction in a session is processed. You can control individual transactions just as you can logons. (FTP client has its own exit points.)


Most other exit programs work on similar principles.


A few issues complicate things.


* An exit program needs enough authority to do whatever it needs to do; it can’t always rely on the authority of the session user.
* An exit program shouldn’t unduly delay transactions; there’s no way to know how often an exit program may be called, so you don’t want it slowing down every single transaction.
* Exit programs may be called by many instances of a server at the same time; it shouldn’t be locking things that are needed by a different instance.
* IBM changes the interfaces at times and the servers themselves can get PTFs; regular, on-going maintenance can be needed — keep the programs direct with little complication.
* There are other issues, but those are enough to consider.


Code a very simple exit program that accepts the parms and returns an ‘Accept’ indication. Don’t have it do anything except maybe send a message to a message queue. That lets you see how the registration facility works and how the parms work. It also gives you a program that you can register and deregister in the future to check whether or not the server is stilling calling your program correctly. (Problems can happen.)


Tom Power off the router. 


Get yourself a copy of TeraTerm (it is old, but good)  

Connect your PC serial port to the CON port on the router and run TeraTerm, configured for the serial port, at 9600, 8 bits, no parity.


Press return a few times, and make sure you can see the output from the router.


Power off the router.  

Power it back on again, and when you see something, send a ‘BREAK’ by pressing Alt+B  

The router shoud return a boot> prompt.  

Type 


<b>config-reg 0x2142</b>


Then type


<b>boot</b>


Let the router load, and it will come up with the prompts asking if you want to use the configuration utility.  

Say <b>NO</b> to this.


Type the following when it gets to the > prompt


<b>en  

copy start run</b>  

{press return to the prompts from this command}


When it has finished


<b>show run</b>


Check and see if it has an ‘enable password’ command or an ‘enable secret’


<b>conf t  

config-reg 0x2102  

enable secret {whatever you want as a password}  

no enable password</b> (if it has one of these)  

<b>end  

wr</b>


And the password is changed. 


You should reboot to make the config register change, and also to confirm the password has changed correctly. 


I did all this from memory, so if it doesn’t work, then post here and I will double check, or someone will point out my stupid mistake 😉 i assume your new router is wireless?

limited access with wireless usually means you don't have a valid ip address assigned. you need two things for a working internet connection. 1. you need a physical connection, known as layer 1 and layer 2. 2. you need a logical connection known as layer 3.

if you've got the limited access message that means your laptop has a working wireless connection at layers 1 and 2. what you don't have is the layer 3 connection i.e. an ip address.

there could be a number of reasons why this is happening. i would suggest that you start by powering your pc down - shut it off completely not just hibernate it or just shut the lid. next power down the router, pull the power cord out of it. let the router sit unplugged for about 2 minutes. power the router back up......wait about 2 min more. power your pc back up.

learn how to use the command line command "ipconfig". you access the command line via the accessories folder on windows. when you get the c:/> prompt - enter the command "ipconfig" hit enter. in the group of stuff on the screen you want to see an ip addess assigned to the wireless interface. when you get the limited access message the first thing you want to do is check to see if you have an ip address assigned.

if the above trick doesn't work, then i suspect there is something wrong with your network configuration on your pc. if you take your laptop to a starbucks does it work there? well, then, you might as well put extra jacks out there anyway. in either case, it should work fine as long as ap is on the same subnet (ip address range.) Hello,  


Please find below the answer for your questions

 QinQ Mapping

 Principles

QinQ mapping maps VLAN tags in user packets to specified tags before the user packets are transmitted across the public network.

* Before sending local VLAN frames, a sub-interface replaces the tags in the local frames with external VLAN tags.
* Before receiving frames from external VLANs, a sub-interface replaces the tags in the external VLANs with local VLAN tags.

QinQ mapping allows a device to map a user VLAN tag to a carrier VLAN tag, shielding different user VLAN IDs in packets.

QinQ mapping is deployed on edge devices of a Metro Ethernet. It is applied in but not limited to the following scenarios:

* VLAN IDs deployed at new sites and old sites conflict, but new sites need to communicate with old sites.
* VLAN IDs planned by each site on the public network conflict. These sites do not need to communicate.
* VLAN IDs on both ends of the public network are asymmetric.

Currently, only 1 to 1 QinQ mapping is supported. When a QinQ mapping-enabled sub-interface receives a single-tagged packet, the sub-interface replaces the VLAN ID in the frame with a specified VLAN ID.

Figure 7-8 QinQ mapping  
![imgDownload?uuid=4402391882494f24bacff41](https://download.huawei.com/mdl/imgDownload?uuid=4402391882494f24bacff41f1955d182.png)  


As shown in [Figure 7-8](https://support.huawei.com/enterprise/en/doc/EDOC1100055122/fbe6cdac/qinq-mapping#fig_dc_vrp_qinq_feature_003501), 1 to 1 QinQ mapping is configured on Sub-interfaces 1 on Switch 2 and Switch 3. If PC1 wants to communicate with PC2:

1. PC1 sends a frame to Switch 1.
2. Upon receipt, Switch 1 adds VLAN ID 10 to the frame, and forwards the frame to Switch 2. After Sub-interface1 on Switch 2 receives the frame with VLAN ID 10, Sub-interface 1 on Switch 2 replaces VLAN ID 10 with carrier VLAN ID 50. Interface 2 on Switch 2 then sends the frame with carrier VLAN ID 50 to the Internet service provider (ISP) network.
3. The ISP network transparently transmits the frame.
4. After Sub-interface 1 on Switch 3 receives the tagged frame from Switch 2, Sub-interface 1 on Switch 3 replaces the carrier VLAN ID 50 with VLAN ID 30.

PC2 communicates with PC1 in a similar manner.

 Comparison Between QinQ Mapping and VLAN Mapping

[Table 7-3](https://support.huawei.com/enterprise/en/doc/EDOC1100055122/fbe6cdac/qinq-mapping#tab_dc_vrp_qinq_feature_003501) describes the comparison between QinQ mapping and VLAN mapping.

Table 7-3 Comparison between QinQ mapping and VLAN mapping



| Mapping Type | Similarity | Difference |
|  |  |  |
| 1 to 1 | An interface maps the tag of a received single-tagged frame to the specified tag. | * QinQ mapping
	+ Performed on a sub-interface
	+ Used for VPLS access
* VLAN mapping
	+ Performed on an interface
	+ Used on Layer 2 networks where VLAN frames are forwarded
 |

  


  


Thanks you have to forward the sip and rtp ports of the snom. (before the update this was done by a sip application layer gateway, but we had to remove this because it breaks security.)

[image]

[security announcement: mitigating nat slipstreaming - the ipfire blog](https://blog.ipfire.org/post/security-announcement-mitigating-nat-slipstreaming)

last autumn, we learned about … There are certainly other methods that can be used, but what you describe is simple and timeproven. It also happens to be what I (tend to) use when moving data between systems 🙂 It beats media and, if you don’t need real time replication of data, gets the job done.


Bruce Vining


May I suggest a one-step method, ObjectConnect using SAVRSTLIB or SAVRSTOBJ.


There is a little of prep work to do, like ,


* You need to install licensed program 5722SS1 option 22,
* Change network attributes to “Allow Anynet support” to *YES
* Create a host table entry on host system for target system with valid IP address with host name of targetsysname.SNA.IBM.COM
* Create an APPC controller on host and target systems using this


CRTCTLAPPC CTLD(XXXX) LINKTYPE(*ANYNW) RMTNETID(SYSTEMB) RMTCPNAME(ANYNET)TEXT(‘AnyNet connection to system SYSTEMB’)  

XXXX = the controller name  

RMTNETID = the remote systems name  

RMTCPNAME = the remote control point name


* Then finally create or modify the Remote Configuration list for QAPPNRMT:



```
CRTCFGL TYPE(*APPNRMT) TEXT('AnyNet TCP Connection list') <<ENTER>>
```

or



```
CHGCFGL TYPE(*APPNRMT) <<ENTER>>
```

REMOTE LOCATION= the target system name.  

REMOTE NET ID: APPN  

LOCAL LOCATION: The local systems name is found by issuing a DSPNETA.  

REMOTE CONTROL POINT: Is the same control point that was used when creating the controller.  

CONTROL POINT NET ID: APPN


If you need additional, please feel free to contact me.  

Karl @ wrote:is there an option that i just haven't found that can be set for webroot to shut down the computer after a deep scan? do i need to enable the windows firewall? my router has a firewall that runs my computer in stealth mode.  hello ohheckyeah and welcome to the webroot community forums!  and to add yes you must have windows firewall on with wsa have a look here as to why: http://www.webroot.com/en\_us/secureanywhere/pc/wsa\_pc\_help.htm#c4\_firewall/ch4a\_managingfirewall.htm and it's a nice second layer to the router's firewall. cheers, daniel 😉 are you still forwarding dns requests to the old isp's dns servers?  that could slow things down...

 switch to google (8.8.8.8) or opendns (208.67.222.222 and 208.67.220.220) and see if that helps any, or find the dns servers for your new isp. ok so you can crate a firewall rule as follows:

soucre = internal network
service= tcp 9000 (you will need to create the definition)
destination = 128.194.162.30 (create either a host definition if it is always the same ip or dns host if it changes)