NETGEAR FVS336Gv1 - ProSafe Dual WAN Gigabit... User manual

Version 1.0
How to create an SSL VPN portal on the FVS336G and have full VPN or VPN
Port Forwarding access to resources on the Local Network
This document describes the steps to undertake in configuring the FVS336G SSL VPN option.
The FVS336G’s SSL VPN portal can provide two levels of SSL service to the remote user:
• VPN Tunnel
The FVS336G can provide the full network connectivity of a VPN tunnel using the remote
user’s browser in the place of a traditional IPsec VPN client.
• Port Forwarding
Port Forwarding is a web-based client that installs transparently and then
create a virtual, encrypted tunnel to the remote network. No routing is involved and a Custom port
needs to be setup up for each Application that needs to be accessed (similar to an Inbound
firewall rule.
172.22.109.3
RDP Enabled
Internet connection through modem/router
SSL VPN Clients
192.168.120.x/24
LAN IP: 172.22.109.1
SSL VPN Tunnel or Port Forwarding

Version 1.0
Table of Contents
Create a new SSL Portal ................................................................................................ 3
Create a new Domain and associate it to the new SSL Portal Layout.................... 3
Create new Group(s), associate it with an existing Domain...................................... 4
Configure the SSL VPN client settings......................................................................... 5
Connecting and testing the SSL VPN........................................................................... 5
Connecting and testing Port Forwarding...................................................................... 7

Version 1.0
Create a new SSL Portal
Go to VPN, SSL VPN, Portal Layout
Click on Add
NOTE: By default the SSL-VPN portal exists
on the configuration and cannot be deleted
Set all the relevant details including
whether the Portal will display only the
VPN Tunnel page and/or Port Forwarding
(this will become clearer later)
Click on Apply
A new entry will be displayed in the Portal
Layouts summary page
(in this case VPNTest and the portal URL
https://172.22.109.109/portal/VPNTest)
Create a new Domain and associate it to the new SSL Portal Layout
Go to Users, Domain
Click on Add

Version 1.0
Set a name for the Domain, choose the
Authentication type and select the relevant
portal name (in our scenario VPNTest)
Click on Apply
A new entry will appear in the list of
Domains
Create new Group(s), associate it with an existing Domain
Go to Users, Groups
Set the Group name in the Add New
Group section, and the Domain the group
will be associated with
Click on Add
The new group will appear in the List of
groups
NOTE: Existing users cannot be moved into a
new Group. The group will need to be created
first and then when creating the user(s) the
relevant group should be selected
(see procedure following)
Create new User(s) and associate it with a Group
Go to Users, Users
Click on Add
NOTE: By default the guest and admin user
appear in this page and cannot be removed.

Version 1.0
Create each user selecting SSL VPN
User as the User Type and
VPNTestGroup as the Group
Click on Apply
Repeat the process for each new user
The list of new Users is displayed
NOTE: By default the only Groups appearing
in the Select Group list are the Domains.
Create a new Group using the relevant
procedure for this to appear in the selection.
Configure the SSL VPN client settings
Go to VPN, SSL VPN, SSL VPN Client
Enable Full tunnel support
Configure the DNS server settings (if
required) and the VPN clients range
Click on Apply
NOTE:
Enable Full Tunnel Support: check this to
enable full tunnel support; otherwise the
default is a split tunnel and appropriate client
routes must be added
Connecting and testing the SSL VPN
Go to Monitoring, Router status
Identify the WAN IP address that will be
used to connect to the FVS336G from the
Internet (in this scenario 83.71.251.27)
NOTE: Please ensure that the Modem/Router
sitting between the FVS336G and the Internet
is set to forward TCP port 443 to the FVS336G

Version 1.0
Replace the LAN address in the Portal
Layout address with the WAN address
Use the browser to connect from a PC on
the Internet to
https://83.71.251.27/portal/VPNTest
Login with one of the Usernames created
and that would be associated to the
VPNTest domain (whether part of a
group or not)
In the VPN Tunnel section click on the
icon above Connect using VPN Tunnel
The first time the connection is made a
banner will appear under the browser
Address bar –Install the Active X control
as shown and OK any subsequent dialog
box
After the Active X control is installed the
VPN tunnel can be establised
Click on the Connect using a VPN
Tunnel
The VPN Tunnel Adapter will be installed
and the VPN tunnel established

Version 1.0
When the tunnels is fully established the
following icon will be
appearing in the systray
Any resource available and attached to
the same LAN as the FVS336G should
now be accessible
In our example a PC on IP address
172.22.109.3 on the LAN of the FVS336
has been enabled for Remote Desktop
The Remote PC responds correctly over
the VPN prompting the customer for
Username and Password
Connecting and testing Port Forwarding
In order to test Port forwarding this must
be setup first. In this scenario RDP will be
tested through Port Forwarding port 3389
(RDP) to 172.22.109.3
Go to VPN, SSL VPN, Port Forwarding
and create/add a new application for
172.22.109.3 and TCP Port 3389 (RDP)

Version 1.0
Connect to the VPN portal and select the
Port Forwarding Tab
Click on the Connect using Port
Forwarding Icon
Once port forwarding is established the
window on the right will briefly appear and
then disappear (this can be retrieved by
clicking on the Icon in the systray
Also the icon in the systray
will confirm that Port forwarding is
established
Open Remote Desktop connection and
connect to 172.22.109.3
As per test with the SSL VPN the user
should be prompted to enter the
Credentials on the remote PC

Version 1.0
Double-clicking on the Port Forwarding
Icon in the systray , the open connection
will also be visible in the Pending
Connections section