Port Forward Security

Question

Hi,
I have a Linksys WRT54G, and a question in regards to port forwarding. I use Remote Desktop to access my home network when I am at school, and enable port 3389 each day before school, then disable access to that port at the end of the school day. This allows me access to my home network when I am at school, and then I close the port when back home, for security purposes. 
Does anyone know of a way to limit what IP addresses (incoming) are allowed to use that port, where I can enter the IP address of the school computer so that it is allowed access, and then do not have to disable port access every day?
tia,
Vgolfmaster 

Answer 1

 Currently the included firmware does not support a source IP for specific port forwarding.  Luckily the DMZ does!  Set your computer as the DMZ with the source IP of your school.  Setting yourself as the DMZ essentially forwards all ports.  This may seem less secure, but since you can set a source IP it is more secure. 
Nevermind that part, after reading saber_tooth's post, I looked up your router and he is right, your router does not support a source IP address for the DMZ.  
If you don't want to use the DMZ, you could take advantage of port triggering.  Port triggering means that, when there is a connection on port x, forward port y.  So you could set up a small server of any kind, and connect to it from your school's computer.  For example, set up a small telnet server, and set port 23 as the triggering range, and 3389 as the forwarding range.  This means that port 3389 is only forwarded when there is a connection on port 23.  If you wanted to be really security paranoid (not a bad thing ) you could set up something like this: (after forwarding port 1)
Forwarding range ---------- Triggering range
2-2 ------------------------------ 1-1
3-3 -------------------------------2-2
4-4 -------------------------------3-3
3389-3389 --------------------4-4
This would mean you would have to connect on port one, which would unlock port two.  Connect on port two to unlock port three, and so on, until you unlock port 3389.  It would also prevent 3389 from being scanned on your system (very secure!).  You can also use any ports you want, not just 1 2 3 4, so long as you remember them!
Obviously you would need something to listen on each of those ports, I recommend using Port Listener.
From there you could use Telnet (Start > Run > Telnet) and connect on each of those ports, using the command "o ip.add.re.ss port".  So you would open four telnet windows, and connect to your computer on each triggering port.  You could even create a Windows batch file to do this automatically.  
I know it sounds complicated but it really isn't! 
You may also be able to find a software firewall that allows port exceptions by time, and set it up so it is only forwarded while you are in school.
I hope I answered your question,
Zach
Message Edited by zachlr on 04-05-2009 10:08 AM
Message Edited by zachlr on 04-05-2009 11:15 PM