Also new to the FVS318N is support for IPv6. The WAN port can run in IPv4 mode or IPv4/IPv6 (Dual Stack) mode. NETGEAR supports 6to4 and ISATAP Tunnels for sending IPv6 packets across IPv4 WANs. The WAN port can get its IPv6 address statically or via DCHP, using stateless or stateful auto configuration.
Similarly, the LAN side of the FVS318N can be configured to provide IPv6 addresses via stateless or stateful DHCPv6. However, the LAN side of the FVS318N only has the option for a single IPv6 VLAN. Note also that enabling IPv6 requires a reboot. Figure 9 is a look at the FVS318N's LAN IPv6 options.
Figure 9: IPv6 config
The FVS318N retains the FVS318G's firewall functionality. so I'll refer you to that review for more details on security. To summarize, the FVS318N is a three zone router, providing traffic filtering between the WAN, LAN and DMZ zones. Rules can be created to allow or block traffic flows based on time of day, it has an ALG function that can be turned on/off, supports UPnP, provides bandwidth management tools and can filter web traffic based on keywords or URLs.
The FVS318N supports four methods of VPN remote access: IPsec Site to Site, IPsec Client to Site, SSL Client to Site, and L2TP Client to Site connections. The FVS318N will support up to 12 IPsec tunnels and 5 SSL tunnels. NETGEAR's documentation doesn't specify the L2TP tunnel limit.
I was able to set up all four types of connections using a 64-bit Windows 7 PC and use them to establish a Remote Desktop Connection to a PC o the FVS318N's LAN. I had no troubles with the first three VPN types, but had some challenges with the L2TP VPN connection.
I set up a Site to Site connection between the FVS318N and NETGEAR's SRX5308. I used NETGEAR's VPN wizard on both routers, which created a tunnel using 3DES encryption and SHA-1 authentication. Upon completing the wizard in both routers, the tunnel came right up.
The FVS318N supports Client to Site IPsec VPN tunnels with “optional software.” To test Client to Site IPsec connectivity, I used Greenbow's IPsec client, a standards based IPsec software client. I set up the NETGEAR using the Client to Site VPN wizard, which used basically the same values as it did for the Site to Site connection, including 3DES encryption and SHA-1 authentication. With the NETGEAR and Greenbow configured, I was able to connect remotely to the FVS318N immediately. Figure 10 is a screen shot showing my active IPsec Site to Site and Client to Site VPN tunnels running simultaneously.
Figure 10: IPsec VPN tunnel status
I've had good results with NETGEAR's SSL solution on several models, including the FVS336G and SRX5308. I had good results with NETGEAR's SSL solution on the FVS318N as well. The FVS318N uses the same Virtual Passage interface and drivers for SSL VPN connectivity as the other NETGEAR routers, subsequently, I had no problems setting it up or connecting with my 64-bit Windows 7 PC.
Configuring an SSL VPN connection on the FVS318N is simply a matter of adding a user name and password in the user section of the manual, and specifying the user as an SSL VPN user. There is no wizard for SSL VPN connectivity, it isn't needed.
By default, the VPN tunnel will run in Split Tunnel mode, which means the client will only send traffic destined for the FVS318N over the SSL VPN connection. Other traffic, such as the client's Internet traffic, will not be routed over the SSL VPN connection unless you choose Full Tunnel mode. Below is a screen shot showing my active SSL Client to Site VPN tunnel.
Figure 11: SSL tunnel status
A useful option on the SSL configuration is to add routes to any VLANs you may have configured. By default, the FVS318N will provide connectivity to the default VLAN over the SSL VPN connection. If you want remote users to have network access to your created VLANs, just add the destination network as a configured client route. Figure 12 is a screen shot showing the previously created 192.168.22.0/24 VLAN added as a client route so it can be accessed over the SSL VPN connection.
Figure 12: Adding a VPN route
Configuring the FVS318N for L2TP VPN connections is just a few steps. Simply enable the server and specify a range of IP addresses for the L2TP users. My configurations are shown below.
Figure 13: L2TP server enable
Windows supports L2TP VPN connections without installing software, so all you have to do is configure it properly. The NETGEAR manual fails to provide guidance on the proper Windows settings, but NETGEAR provided a useful document (.docx) on how to set it up.
Setting up the L2TP adapter in Windows involves entering the FVS318N's WAN IP, the user name and password you created on the FVS318N, and selecting L2TP with IPsec as the VPN type. The tricky part is you have to modify the Windows 7 registry to complete the configuration. Although the steps were easy, I don't like having to mess with the registry in Windows.
With my configurations in place, I still couldn't connect with an L2TP client. After some troubleshooting with NETGEAR, they suggested changing the range of IP addresses I configured on the FVS318N's L2TP configuration page. I did so, and the connection worked. Below is a screen shot showing my active L2TP Client to Site VPN tunnel.
Figure 14: L2TP tunnel status
A couple days later, after testing various other features, I tried the L2TP connection again and it failed. I found I had to again change the range of IP addresses on the FVS318N's L2TP configuration page to get it to work.
To summarize the FVS318N VPN capabilities, NETGEAR's IPsec and SSL VPN solutions were stable and reliable, but NETGEAR's L2TP solution needs more work. 64-bit Windows 7 is pretty common, and having to edit the registry on my PC, and then change IP ranges to get the server to work on the router is a hassle.