WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Configure Internet Connection Sharing

Internet Connection Sharing (ICS) allows multiple computers in a small office or home office to access an Internet connection using a single public IP address. For example, you may have a computer in an intranet that connects to the Internet by using a dial-up connection. By enabling ICS on the computer that uses the dial-up connection, you can provide Internet access to all computers in the network. ICS provides network address translation, address allocation, and name resolution services for all computers on your network. ICS can also be enabled for high-speed networks, such as Integrated Services Digital Network (ISDN), Digital Subscriber Line (DSL), and cable-based Internet connections.

ICS is a version of a network address translator (NAT). A network address translator is an IP router defined in RFC 1631 that can translate IP addresses and TCP/UDP port numbers of packets as they are being forwarded. Consider a small business network with multiple computers connecting to the Internet. A small business normally has to obtain an Internet Service Provider (ISP)-allocated public IP address for each computer on its network. With a NAT, however, the small business can use private addressing (as described in RFC 1918) and have the NAT map its private addresses to a single or to multiple public IP addresses as allocated by its ISP. ICS uses the private network 192.168.0.0 with a subnet mask of 255.255.255.0 for all computers in an ICS-enabled network, permitting a maximum of 254 hosts.

Figure 22.18 shows an example of a small business intranet using ICS. The small business has obtained a public IP address of 207.46.140.35 by its ISP. ICS assigns IP addresses from the private network address 192.168.0.0 for all computers in the business intranet.

Figure 22.18 Internet Connection Sharing Procedure

When a user on the small business intranet connects to an Internet resource, the user's TCP/IP protocol creates an IP packet with the following values set in the IP and TCP or UDP headers (bold text indicates the fields changed by ICS):




Destination IP Address: Internet resource IP address

Source IP Address: Private IP address

Destination Port: Internet resource TCP or UDP port

Source Port: Source application TCP or UDP port




The computer forwards this IP packet to ICS, which translates the addresses of the outgoing packet as follows:




Destination IP Address: Internet resource IP address

Source IP Address: ISP-allocated public address

Destination Port: Internet resource TCP or UDP port

Source Port: Remapped source application TCP or UDP port




ICS sends the remapped IP packet over the Internet. The responding computer sends back the response to ICS. When received by ICS, the packet contains the following addressing information:




Destination IP Address: ISP-allocated public address

Source IP Address: Internet resource IP address

Destination Port: Remapped source application TCP or UDP port

Source Port: Internet resource TCP or UDP port




When ICS maps and translates the addresses and forwards the packet to the intranet client, it contains the following addressing information:




Destination IP Address: Private IP address

Source IP Address: Internet resource IP address

Destination Port: Source application TCP or UDP port

Source Port: Internet resource TCP or UDP port

For outgoing packets, the source IP address and TCP/UDP port numbers are mapped to a public source IP address and a possibly changed TCP/UDP port number. For incoming packets, the destination IP address and TCP/UDP port numbers are mapped to the private IP address and original TCP/UDP port number.

ICS includes a DHCP allocator service to assign private IP addresses, and a proxy DNS server to perform name resolution services on behalf of all computers in the intranet.

NOTE

---

Do not enable ICS in an existing network that has DNS servers, gateways, DHCP servers, or computers configured with static IP addresses. If your Windows 2000 Professional-based computer is in a network where one or more of these conditions exist, you must use Windows 2000 Server network address translation. For more information, see "Unicast IP Routing" in the Internetworking Guide.

Enable Internet Connection Sharing

To enable ICS, you must be logged on to an account that has administrative rights.

To enable Internet Connection Sharing

In Control Panel, open Network and Dial-Up Connections.

Right-click the connection you want to share (the connection that connects to the Internet), and then click Properties.

On the Sharing tab, select the Enable Internet Connection Sharing for this connection check box.




If the shared connection is a dial-up connection and you want the connection to dial automatically when another computer on your network attempts to use external resources, select the Enable on-demand dialing check box.

Click OK.

A dialog box is displayed, indicating that the intranet's connection's IP address is set to 192.168.0.1, and warns that connectivity with other computers on the network might be lost.

Click Yes.

NOTE

---

If your office users need to gain access to a corporate network via a VPN server that is connected to the Internet, they need to create a PPTP-based virtual private network (VPN) connection to tunnel from the computer on the intranet to the corporate VPN server on the Internet. The VPN connection is authenticated and secure, and creating the tunneled connection allocates proper IP addresses, DNS server addresses, and WINS server addresses for the corporate network. For more information about configuring a VPN connection, see "Local and Remote Network Connections" in this book.

When ICS is enabled, the TCP/IP configuration is modified on the computer with the shared connection, and services related to network translation are started. Table 22.7 shows the modified system configuration on the sharing computer:

Table 22.7 ICS System Configuration Modifications

NOTE

---

You cannot modify the default configuration of ICS. This includes items such as disabling the DHCP allocator or modifying the range of private IP addresses that are handed out. If you want to modify any of these items, you must use Windows 2000 Server network address translation. For more information about network address translation as implemented in Windows 2000 Server, see "Unicast IP Routing" in the Internetworking Guide.

All computers on your network that access the Internet by means of Internet Connection Sharing must reconfigure their TCP/IP configurations to use DHCP. Each computer in the network is reassigned an IP address from the reserved IP address range 192.168.0.2 to 192.168.0.254, with a subnet mask of 255.255.255.0. As with the ICS-enabled computer, the change in IP address might cause you to lose connectivity with other computers in the network that use static addressing.

Configure Applications and Services

You might need to configure Internet Connection Sharing to provide access to remote programs and services to users in your network. For example, if users on your intranet want to use a videoconferencing application such as NetMeeting, ICS must be configured to support the application on the connection in which shared access is enabled.

Conversely, you might want to provide services to applications and services on remote computers. Services that you provide must be configured so that Internet users can gain access to them. For example, if you are hosting a Web server on your home network and you want Internet users to be able to connect to it, you must configure ICS to provide the Web Server service.

ICS provides support for remote services and applications via ports. Ports are used by TCP and UDP to identify the ends of logical connections to deliver data to applications. For the purpose of providing services to unknown callers, a service contact port is defined. The contact port is sometimes called the well-known port. For a list of standard UDP and TCP ports, see "Well Known Port Numbers" in RFC 1700, "Assigned Numbers."

To configure applications to access remote services

From Network and Dial-up Connections, right-click the shared connection, and then select Properties.

On the Sharing tab, verify that the Enable Internet connection sharing for this connection check box is selected, and then click Settings.

To configure a network application for the computers sharing the connection, on the Applications tab, click Add, and then do the following:




In Name of application, type an easily recognized name for the application.

In Remote server port number, type the port number of the remote server where the application resides, and then click either TCP or UDP.

In TCP or UDP or both, type the port number for the port on your home network to which the application connects. Some applications require TCP and UDP port numbers.

To configure services for remote applications

From Network and Dial-up Connections, right-click the shared connection, and then select Properties.

On the Sharing tab, verify the Enable Internet connection sharing for this connection check box is selected, and then click Settings.

Click the Services tab, and then select the standard services in the Services box.

- Or -

To add a service that is not in the list, click Add, and then do the following:




In Name of Service, type an easily recognized name for the service.

In Service port number, type the port number of the computer where the service resides, and then click either TCP or UDP.

In Name or address of server computer on private network, type the name or TCP/IP address of the computer on your network where the service is located.