How set up Port Forwarding or a DMZ with a Virgin Media Hub 5

The cheap and sometimes nasty routers provided for home networking by cable providers frequently make for configuration challenges for external access to internal services on computers in the home. Sometimes, the service providers block any advanced functionality altogether. This poor appoach doubtless leading to users opting for better providers.  Enter the Virgin Media Hub 5 for people in the UK. This device has some benefits compared to previous versions. Virgin supports port forwarding on the Hub 5, which is needed to poke a hole through the router to a device on the local network to allow it to be accessed from the Internet, so lets look at the technical aspects. This short article goes into TCP port forwarding, the implications of modem mode, potential security risks, and practical troubleshooting measures. Additionally, you will be able to see what a successful port forwarding configuration looks like

TL:DR – Virgin Media has historically posed challenges for users attempting to set up port forwarding. Limitations in accessing certain ports, potential issues related to modem modes, and varied user experiences all made for problematic operations, and sometimes a stern sounding letter in the physical post from Virgin Media reminding the account holder of the scarieness of the open ports on home systems and the importance of meticulous configuration. Understanding of the complexities of IP networking and effective troubleshooting measures are important prerequisites to navigate these complexities. 

The admin interface of the Hub 5

The sign in screen has a simple form with a password, which is provided on the plastic card supplied and attached with the router. You can also look at the router log without being signed in by selecting 'Check router status'. 

Understanding port forwarding

Port forwarding is a fundamental networking concept that allows external devices to connect to specific services running within a local network. This is achieved by setting rules on a router that specify which ports should be accessible from the outside world and to which internal IPs these ports should route traffic. Understanding these configurations is critical for users attempting to connect applications or servers—such as media streams, or web servers—directly through their home routers. Without proper port forwarding set up, attempts to access these services from outside the local network will fail.

Port forwarding in the Hub 5

The Virgin Media Hub 5 is equipped with port forwarding capabilities. You can find this screen in Advanced Settings > Port Forwarding. In the example below I've set up forwarding for HTTPS connections to my local web server to enable it to be accessible from the Internet.

This was very easy to do.

Dynamic Hosts Configuration Protocol (DHCP) best practice with port forwarding

In the example above the device with IP address 192.168.0.127 has port 443 open, because it is a web server and uses SSL. It would be best practice to ensure that this device, when it powers on, is always assigned address 192.168.0.127. The Virgin Hub 5 comes with a DHCP server built in, which allocated IP addresses dynamically, which means that it might choose to allocate a different number. This would potentially cause a security risk, as a a different device which you were not expecting would be connected to the Internet.

So, you should take the time to set up DHCP, to assign a reservation for an address to the device, so that it is always allocated the same one. This is possible because every ethernet adapter in the world has a unique ID called a MAC address (nothing to do with Apple Mac computers, MAC stands for Media Access Control and is a twelve digit hex number formatted with colons or hyphens).

Below is what the DHCP settings screen looks like, scroll down to 'Add reserved rule' and add the MAC address of the device. you can find the MAC address for any device in its network settings and using the command line on Windows with getmac or ipconfig /all and on macoOS or Linux with ifconfig -a.

ZZ

Demilitarized Zone (DMZ) with Virgin Media Hub 5

Comments in various discussion forums regarding the Virgin Media Hub 5 point to unsuccessful attempts at using the DMZ feature.

In the context of the Virgin Media hub 5 the DMZ feature forwards all incoming connections for any ports allowed by the Virgin Media Hub 5 to one internal device. This is different to port forwarding and has security considerations for the chosen device which will be exposed directly to the Internet.

Consequently, standard port forwarding is generally safer as users can specifically restrict which ports are exposed.

Using a DMZ requires deeper understanding of IP networking, and it is recommended that the DMZ device has a firewall, or indeed is  itself a firewall equipped router.

Conclusion

Port forwarding on the Virgin Media Hub 5 presents a simple user interface for a more complex home Internet configuration. 

Port forwarding is invaluable for users interested in maintaining accessible, secure home networks where specific services can be made available over the Internet.