File Sharing with Router

There lies the rub. If you want a SPI router that selectively permits apps access without DMZ or port forwarding rules, the basic (read inexpensive) routers are all out. I got around this problem by spending $$$ and purchasing a Sun Cobalt Qube3 (no longer in production) and using the Sun Adaptive Firewall to govern permissions. Unfortunately for me, the applications supported by my Qube were relatively limited but it is almost bulletproof for webmail, webserver and file access.

A number of companies sell deep scan SPI products, like Fortinet (www.fortient.com), Checkpoint Software (www.checkpoint.com). I would also recommend Sonicwall or Symantec's vpn appliance.

What kind of applications are you wishing to be scanned?

Opps. Didn't read your post completely. Actually, unless you are willing to spend $500+ on a router, it's best to use software firewall (as you are now using) and couple it with a basic SPI router. If it is for home use only and VPN logging is for one computer at a time plus you have limited bandwith, less than 3kpbs, then stick with something like Linksys' routers. If you want dedicated bulletproof vpn access in compliance with vpn protocols for multiple platforms, Dlink's business router DFL-300 is a good buy, along with Sonicwall's 170TZ. Likewise, Linksys' RV082 is pretty good. I am considering the RV082 since my Qube is getting old...

About Nat-Traversal, a good primer:
http://www.isp-planet.com/technology...ipsec_nat.html

Checkpoint Software is considered a leader in "deep scan" SPI technology (or at least that's what there press releases always claim). Deep scan really exists only at Enterprise level. Frankly, buying deep scan spi for the software and gaming stuff described would be the equivalent of purchasing a tank because you live near a golf course... It's overkill, unnecessary and cost would defeat purpose. Deep scan products typically start around $2k which is why I bought my Sun server... However, I used it for business and home office links so it's worth it for me...

Deep scan SPI monitors applications as they communicate to the outside. From the outside, a deep scan SPI appears to be a firewall - from the inside it appears to be a communications client. It's sort of like a proxy that the firewall predefines for each application. Its not found in SOHO class products because of need to monitor applications as well as speed to track/approve data as well as shunt to proper ip address.

I don't know if this helps because (1) its a complicated process involving the equivalent of proxies plus (2) I wound up purchasing intermediate solution because of the hardware costs (so didn't ever complete research) and (3) I gotta pee!

If you have 10mbps class worth of bandwith, I expect you will run into problems with basic routers. Most basic routers use 50 mhz ARM processors that simply do not have throughput to analyze packets and redirect. I would suggest the RV082, DFL 300, Sonicwall, or any other small business class router because they tend to have fast processors 150 mhz+ plus expanded flash memory for upgrades and ram for the processing. Of course, this stuff will cost between $300 - $500. I am currently unhappy with the Netgear stuff largely because of really limited warranty (90 days) plus they offloaded support to India and frankly the language issues outweigh the limited knowledge base/scripts tech support reads.

If you have cash, I recommend the Sonicwall products. I've used them and my wife's office uses one with great success. They also have excellent tech support. I like DLink though not so much for the product but because they provide good tech support and techs are based here in California...

For your needs, I don't think triggered mapping will work. Triggered mapping works best when there are multiple computers or multiple requests communicating with the port for short bursts of data. A continuous stream will cause the application (LAN side) to continuous operate and will eat into your CPU cycle times (unless you are running a fast server with lots of memory AND managed switch/adapter card). Triggered mapping only allows one computer at a time within the LAN to use the port so if you have an internal lan with a separate server, then only one system at a time can use the port. You are better off mapping a single port and directing it to a specific LAN address and simply operate a software firewall rather than application based triggered mapping.

A good primer:
http://www.smallnetbuilder.com/Secti...le18-page5.php

No problem. Glad to be of help!