Yesterday I made the decision (read: mistake) to update my Netgear DG834G router (hardware v4, firmware v5.01.09) to firmware v5.01.14 – and, as is the way with these things, it brought trouble.  After the upgrade I couldn’t reach www.nikrivers.com from the LAN side of the router.

The problem is caused by the way the router handles traffic coming from an internal IP address and destined for the WAN (i.e. external) IP address.  In this situation it requires that the router first transfers the traffic from the internal network to the external network, and then immediately passes it back whilst applying any firewall or routing rules that are relevant to incoming external traffic.

This behaviour is called ‘NAT loopback’, and it seems the vast majority of routers built for the home market have this ability turned off, or do not have the ability at all.  It can be a big problem if you host a website and wish to access that same website using its domain name.  The domain name will resolve to the WAN IP address of your router, and any traffic headed there (such as an HTTP GET request on port 80) from the internal network will be ignored by the router.

There are a few ways to solve this, but none of them are ideal.

1. Use the server name instead of the domain name to access your website
2. Modify the list of known network hosts on each client to point your domain name straight to the server in question.
3. Run your own DNS server, using a view to return the server’s local IP address to requests for your domain name originating from your network.

Of course, the situation gets more complex if you’re also using your router to send TCP traffic on port 80 to your webserver and UDP traffic on port 8668 to a game server.

The solution is to get NAT loopback working on your router.  With some routers, such as the Touchspeed 535 as provided by Be Broadband, this feature can be enabled using a simple CLI command.  For other routers, such as the Netgear DG834G, it’s not quite so easy.

For the purposes of this post I’ll assume the internal network is on the 192.168.0.x range, the router is 192.168.0.254, and the web server is 192.168.0.1.  You will need to modify these IP addresses according to your own network setup.

The first thing to do is to enable debug mode on the router.  Simply go to http://192.168.0.254/setup.cgi?todo=debug and you’ll be rewarded with an appropriate message, “Debug Enable!”.  Nice.

Now connect to the router with ‘telnet 192.168.0.254′ to gain access to the router’s cut-down installation of Linux.  All that is required is to add one additional entry to the router’s iptables (which is a standard Linux feature; Google it or more info).  Type the following, amending any IP addresses according to the network setup:

iptables -t nat -A POSTROUTING -d 192.168.0.1 -s 192.168.0.0/24 -p tcp –dport 80 -j SNAT –to 192.168.0.254

This adds a rule to the POSTROUTING chain on the nat table which applies to all TCP traffic on port 80 (HTTP) coming from the private network and headed to the router.  The rule redirects the traffic to the server, and then processing jumps to the SNAT chain.

If the server is more than just a simple web server, such as an NTP server or mail server as well, the above step needs to be performed (changing the -p and –dport parameters accordingly) for each port and protocol combination you require.  Alternatively, those parameters could be omitted altogether, which will allow all traffic types on all ports through:

iptables -t nat -A POSTROUTING -d 192.168.0.1 -s 192.168.0.0/24 -j SNAT –to 192.168.0.254

If you do this, I recommend you run a firewall on your server, with only the appropriate ports opened.

There is more information in section 10 of Rusty Russell’s Linux 2.4 NAT Howto.

Unfortunately, the iptables change isn’t retained when the router restarts, so it is necessary to go through the process every time – which is a pain in the backside.  Fortunately, however, the Netgear support website has a download link for previous firmware versions, so I downgraded my router back to firmware v5.01.09 and everything worked fine again–including NAT loopback–with no iptables hack required.

A robust solution with DNS

Simply put, proper DNS is the best way to get around a router’s lack of/poorly implemented NAT loopback.

If you have the resources to host a website then you most likely also have the resources to host a DNS server for your internal network.  Simply create an ACL list describing all the clients on your internal network (probably as simple as specifying the CIDR block for your network, maybe something like 192.168.1.0/24).  Then create a view whose clients match that ACL, and define that view as a master DNS server for your website domain.  You then need to create a zone file for that domain – but instead of using an external IP for your webserver, use its internal IP.

All requests for other domains will be routed to the DNS forwarders, but requests for your webserver’s domain will be handled locally, and internal IP addresses will be returned.

The benefit is that you avoid traversing your gateway router to simply come back inside your network.  It doesn’t make sense that you rely on your gateway router to access a website within your own network.  In addition, the firewall on your router can be hardened to a much greater degree: for example, you needn’t leave FTP ports open on your router if you’re only connecting locally.  Or, to put it another way, you’re likely going to want to give yourself more access to your server than you want to give to the outside world; configuring a router’s firewall rules for this kind of conditional logic is simply asking for trouble.

Because when the Viewty first came out, people seemed to be falling over each other trying to be the first to review the phone. They hadn’t used it in anger. And boy, this phone makes me angry. When people ask me “is it a good phone?”, I struggle not to begin ranting. It is still widely available, so if I cause just one person to stop and reconsider the purchase of a Viewty, I will consider this post to be worthwhile.

The technical details, pictures, and many reviews of people singing the Viewty’s praises are everywhere. Just google it. I’m going to skip all of that rubbish, and tell you why you should have stuck with Sony Ericsson.

The interface

It’s a touch screen phone, and so has a larger-than-usual display on a phone of its size, because of the lack of hard keys on the front. There are three, in fact – Call, Delete, and Hang Up. The touch screen is slow to respond, however, and often unresponsive; this may be due to the membrane being of a more rugged design to withstand contact with keys, coins, and other pocket content, but it results in a lot of frustration.

The Viewty gives positive feedback in the form of a brief vibration when pressing any of the soft keys, which is so completely necessary to save the phone from being unusable I don’t understand why there is an option to disable the feedback altogether.

A stylus is included, and it has an interesting design. It’s a liptick-like thing, with the narrow stylus point retracting into the stubby grip given enough pressure. It doesn’t attach to the phone any any way other than looping the stylus cord through an attachment on the corner of the phone – a traditional long narrow stylus, with a corresponding slot in the body of the phone, would have been much more user friendly. Not wanting to have to carry the lipstick-stylus around with me, I’ve always used my finger to use the phone – maybe contributing to my finding it difficult to use.

My HP iPaq, of much older design than the Viewty, has a touch screen which far outclasses that of the Viewty, and doesn’t even give any kind of positive feedback. And its stylus is shorter than the Viewty is long — it would easily fit inside the Viewty case, if there was a slot for it — so I really fail to see why the lipstick stylus was ever considered a good idea.

Writing a text message is average. Unlike phones with hard keys there’s no physical boundary between the different soft keys, so you can’t feel the ‘home keys’ and even with the positive feedback you can’t tell if you’ve accidentally pressed the wrong key or not. Oh, and the backspace key is the Delete hard key, which requires much more force to press than the soft keys, and often means you need to readjust your grip slightly. And trying to position your cursor without the stylus is just pot luck.

Camera

It’s average, even though I bought the phone on the strength of the advert which concentrated on the camera as a selling point. It has an image stabiliser (which is activated with the lock button – yes, wtf?) but I don’t use it. The video camera is ok, and although it can shoot movies at 120fps, any such movies will only play back on the phone at

There is a sliding three-position selector to change the camera mode between still shots, movies, and camera album mode. This just adds to the delay in getting the phone ready to take a snap – the software takes a few seconds to load, and if you activate the wrong mode, e.g. movie instead of stills, you’ll miss your shot.

The camera album mode displays thumbnails of your movies and pictures at 8 or so per page. Changing pages takes forever, and finding a particular picture to show someone invariable leads that someone to get bored and ask you not to bother.

Scrolling and zooming

Ah yes, I nearly forgot. Scrolling through menus, and zooming in on the subject of a photo, is simply infuriating. There’s a spring-loaded zoom ring around the camera lense, which is used for both the camera zoom and menu scrolling. When scrolling, you operate the ring with your off-hand index finger – but the spring is so stiff that it’s impossible to quickly select the option you are looking for. And when zooming, you are supposed to use the edge of your left 2nd finger to operate it – careful, don’t get your zoom-finger in shot – but it feels like you would be better off using your thumb, and holding the phone in a cack-handed way.

You can also opt to scroll through menus by touching and dragging – but without using the stylus it’s very hit and miss as to whether you successfully scroll, or accidentally select a random option without realising until you’re dialling someone you’ve never spoken to before.

Locking the phone

On the edge of the Viewty is a lock button, which locks the touch screen. It’s a push-button, rather than a sliding button, and so it gets accidentally pressed in pockets and when picking it up. When locked, the screen goes black showing just the time and date , and then after a few seconds a power-saving feature causes the display to go completely blank. When the phone is locked, the first press of the lock button reactivates the display to show the time and date, and the second press unlocks the phone. That’s 1 too many presses in my opinion.

There’s an autolock function, which admittedly can be disabled, but when you’re in a call and the phone autolocks, it doesn’t exhibit the usual behaviour of showing the time and date on a blank screen. Instead, it shows a tiiiiiiiny little padlock icon at the side of the screen, and actually it’s really frustrating when you’re working through an automated phone system’s options, for example, and your phone keeps locking.

Phonebook

Mobile phones have had address books, contact lists, or phonebooks (whatever you want to call them) since the beginning of time. Well, at least since my very first mobile, anyway. So you would have thought UI designers would know how people want to use them by now. Not so at LG. Sometimes, throwing away the rulebook and starting from scratch can be beneficial. Not in this case.

By default, when you press the phonebook button to access your phonebook, you’re presented with a screen which shows you the first two (by alphabet) entries in your phonebook. The rest of the screen is taken up by the keypad, allowing you to search by name. But unless you have no more than 2 people with the very same first name in your address book, you’re going to need to scroll at some point.

You can switch to a grouped view, where the names are grouped into six groups, A-D, E-H, etc, and six entries are viewable at once. But that still involves a fair amount of scrolling, and that’s very dangerous if you’re using your finger instead of the stylus.

And there’s no Sony Ericsson-style most recently used contacts to be found ANYWHERE.

Because of all this, it’s easier to reply to an existing text message than it is to start a new text message to that person, and starting a phonecall is just heart-sinkingly depressing. However, the result is that I never go over my inclusive allowance.

Voicemail

All modern phones allow you to pre-program the number for your voicemail service, and dial that number by holding down the 1 key. Ok, for a start there’s no 1 key until you press unlock twice, to unlock your phone, and then press the keypad soft key to display the keypad. It also makes your provider’s voicemail system frustrating, because when you press 2/3/4 to delete/save/whatever the message you just heard, you realise the phone was locked and your keypress wasn’t recognised. By the time you figure out why your voicemail was ignoring you and unlock your phone, you’re halfway through the next message.

And then, when you’re done listening to voicemail messages, the Viewty kindly asks you whether you want to save your voicemail number in your phonebook. Every time.

Then you throw your Viewty against a wall.

Power

My phone always seems to be fully charged but will suddenly show the 25% battery charge icon, then a few minutes later a flashing empty battery icon. A few minutes after that, the phone will turn off. No other indication. No warning sound. I can’t count the number of times I have realised my phone battery was flat, simply because I don’t have eyes in my pocket.

Alarm

You can set a handful of alarms to repeat daily, or on a set pattern, or just once. Alarms will even go off if your phone has shut down because of low power – useful if your phone dies overnight, and you have an alarm set for the morning. However, if I wanted a fully-featured alarm clock, I would have bought a fully-featured alarm clock, in the same way that I take a digital camera with me when I think I will want to take photos, instead of just using my phone.

Conclusion

It’s a rubbish phone. If you must buy one, I recommend the following mitigating actions:

1. Buy a handbag if you don’t already have one – for the stylus – otherwise your options are to tie the stylus/lipstick to the phone (like a phone-sized phone charm) or use the phone with your finger (bloody frustrating).
2. Never travel more than 10 metres away from a phone charger.
3. Buy a second (better) phone and use that instead. (Feel free to keep your Viewty in your pocket if you feel the need to put something on the table down the pub.)
4. Abstain from mobile phone usage for a few years before buying your Viewty, so that you misinformedly think it’s the best thing since interchangeable phone covers.

But at the weekend it refused to upload anything successfully, complaining about PHP and web server upload limits – things over which I have no control. So I went back to using the clunky web interface to upload my photos, only to be greeted by the useless “Internet Explorer cannot display the webpage” page on each attempt.

Things didn’t look good. So I decided to download a cleaner-looking and simpler gallery application (Plogger) to give it a go. Still no luck.

Having ruled out the problem being Gallery2, I decided my website host had changed some things on their side. A quick Google later, and I realised that I couldn’t upload anything more than small text files to any server. So it’s not my website host.

Good job I didn’t send them that email.

But wait, I can upload files to the gallery using a machine on the other side of the corporate VPN… which uses the corporate Internet connection. So it must be my ISP. It must be. Surely? After another quick Google, I read that a number of ISPs have been caught sending fake TCP reset packets to their users so that ‘undesirable’ connections (ie. file sharing applications) are disconnected.

Knowing how to troubleshoot this kind of problem, I proceed to download Wireshark, a network protocol analyzer (formerly Ethereal). Sure enough, each time I try to upload a .jpeg or .bmp or… in fact almost any type of file, I receive a TCP RST message – surely the fake reset message sent to me by my interfering ISP!

However, it seems that my ISP is blameless after all.

It turns out the latest firmware for my Draytek 2800 router adds an innocent-looking option called “Drop non-http connection on TCP port 80″ which is enabled by default. I feel it should be more accurately called “break everything”. Disabling it fixed the problem, but it took an entire lunch break.

I’m winding down at work in time for holiday next week. Having been uber productive and finished all I was supposed to, I now find myself getting involved in discussions such as “Where IS that image for our exotic chutney on site” along with other gems “Why does the new office smell like manure” (a question that prompted a less-than-healthy debate on the finer points of paint, carpet glue and mould) and my personal favourite “If someone came into work with a bogey on their lip, would you tell them?”.

The prospect of a brand spanking new leather bed is also not very conducive to working.

Ho hum…the clock ticks…11:11….

Had a visit today from my 2 best friends (Butch & Greengrass) from the old days down the road who cheered me up no end, but who made me miss lunch, leaving me sitting here with nothing but a soggy pasty.

Am bored. Deathy bored, and annoyed at having to work through. Never fear however, as I will be leaving the building at 16:00 on the dot.

In short – working lunches….don’t.

I’m having a mare of a time working with mismanaged data and bungled images in order that in October, I can flick a switch and start selling turkeys.

It’s totally ruining my “real-life” Christmas too, as by 25th December, I won’t be able to look at a Christmas pudidng without feeling the urge to ram it down some poor unsuspecting throat. It’s not very festive of me, I know, but I’m starting to dream about turkeys and chestnuts, (neither of which I have any intention of buying myself) when I should be dreaming about puppies and kittens and crisp-eating teddy bears.

Don’t even get me started on the 4 Bird Roasts…

Plus, of course, there’s the fact that you can almost never take the very next working day in lieu. The reason for my working on Saturday was to make sure we were ready for a delivery on Monday. So there was no chance of taking Monday off. As it happens, the delivery has been rescheduled for today, so along with there having been no need to work on Saturday (but that’s another story), it’s four days later and I still haven’t got my day back.

And due to the nature of deliveries to clients, there’s always something small to fix or tweak – and our delivery being at the end of play results in those fixes or tweaks being made the day after: tomorrow.

So it will be Friday at the earliest before I get my day back. Assuming the delivery isn’t rescheduled again.

And then I have to haggle with project managers, whose Microsoft Project plans (or, more accurately, Microsoft Excel plans) are meticulously calculated and set out, but don’t make any allowance for resources having an unexpected day off, or being ill, or being hit by a bus.

So in all likelihood, this Saturday I will be a week behind everyone else…