User manual

Firewall
149
Note
The displayed options apply to the firewall classes, not to the ports with these names.
That is, the LAN interface options apply to all interfaces that are configured with a LAN
connection type, not just to the port labelled as LAN.
It strongly recommended that you leave Enable NAT from LAN/VPN interfaces to
Internet interfaces checked. Typically, this is required to allow Internet access from the
LAN.
Universal plug and play gateway
The Universal Plug and Play (UPnP) Gateway allows UPnP capable applications and
devices to request port forwarding rules to be established on demand. This allows some
applications and devices that may not operate correctly behind the NAT firewall to
automatically work.
Warning
When UPnP in enabled, any host connected to the internal network can create a port
forwarding rule on the firewall. We strongly recommend that do not enable the UPnP
Gateway feature.
Configuring the UPnP gateway
The UPnP Gateway needs to be run on a pair of interfaces, the External interface
(typically default gateway internet) and the Internal interface (typically LAN or DMZ).
The UPnP Gateway sends out notifications on the internal interface, advertising its
presence on the network. Any UPnP capable applications or devices that you require to
make use of the UPnP Gateway need to be connected to the SG unit via this interface.
The UPnP Gateway listens on this interface to requests from UPnP capable applications
and devices to establish port forwarding rules.
In response to these requests, the UPnP Gateway establishes port forwarding rules to
allow matching packets to be forwarded from the configured external interface through to
the internal interface.
Note