Accessing W&T devices from the Internet

Unlike traditional, outgoing applications as used by web browsers and email clients, incoming connections also require several points to be considered. As shown in the diagram, a concrete example is a Web Thermometer installed on the intranet that can be accessed and configured from the internet. This allows service staff to access the current temperature and device configuration from any location.

For communication within private networks or intranets, specific IP ranges are reserved for each network class:

The link to the Internet is the router, to which the respective ISP (on the WAN side) assigns an official IP address. This ensures that the router can always be reliably identified within the Internet. From the perspective of an outgoing connection such as the browser, the network sketched here is placed in operation in plug & play fashion. The target address of the communication partner in the Internet is known and the connection is opened from the internal network. Put simply, for outgoing packets the router is simply there to replace the sender addresses with its official WAN-side address. In the case of packets incoming from the Internet within this connection, the destination IP is then replaced by that of the station in the Intranet. This simple address exchange in the IP header performed by the router allows one to connect an entire Intranet with various stations to the Internet using just one of the short, official IP addresses.

But just like the case of traditional telephony, we don’t want to be limited to calling just other stations, rather the possibility of being called is also a requirement. In order to make the Web-Thermometer "visible", the following points need to be considered:

• Is the WAN-IP router address static or dynamic?
• What is the current, official IP address of the router, and how do I get the current IP of the router at any given time?
• Does the router accept incoming connections, and to which Intranet station are these passed on?

Fixed or dynamic IP addresses

IP addresses form the basis of all data traffic on the Internet. When it comes to Internet access, ISPs generally offer two options. The simplest solution—though it involves higher costs—is to order a static IPv4 address. In this case, all you need to do is configure the forwarding of the desired services to the intranet, as described under NAT. Standard plans with dynamic IP addresses, on the other hand, offer a cost-effective alternative. Each time a connection is established with the ISP, the router is assigned a new address from the ISP’s pool. Many routers have a DynDNS client built in to publish their current IP address.

DynDNS - Dynamic Domain Name Service

There are numerous providers of dynamic DNS services. These services allow users with dynamic IP addresses to offer services on the Internet under their own hostname. Essentially, this is always a DNS server that can be updated remotely via the web. Using the Web Thermometer as a concrete example, the first step is to register a free hostname for your device. Unlike with a traditional DNS service, however, this host is not assigned a static IP address, instead, it is possible to perform this mapping online using special HTTP(S) requests. The vendor-specific client required for this is integrated into the firmware of many perimeter routers. When the router receives a new IP address from the ISP, it is automatically reported to the DynDNS provider, and the Web Thermometer can then be accessed worldwide via its registered hostname.

NAT - Network Address Translation

Now that the router can be easily identified using its hostname and the dynamic DNS provider, there is just one final hurdle to overcome. For security reasons, incoming connections from the Internet are rejected or ignored by default. To forward a connection to a specific port on the intranet, the router must be explicitly instructed to which host the connection should be directed. In our example, we want to allow external access to the Web Thermometer’s web pages via HTTP/TCP port 80. The rule in the router’s firewall must therefore be formulated such that incoming connections from the Internet to TCP port 80 are forwarded to the intranet IP address of the Web Thermometer. The following image shows the corresponding configuration page for a Netgear perimeter router.

Some examples for factory set port numbers in W&T devices. Some of these can be reconfigured, so that you may need to consult the manual in individual cases.