WOL (WakeOnLAN) over Internet

[ntbill]

This is a tutorial about using WOL to wake up a pc through Internet. For example, you are at work and you want to wake up your home PC to retreive a file or take control of the home PC remotly.

Basically, you need to have a static arp so Wake On LAN (WOL) can work trough the firewall using port forwarding. The problem is: How can it forward an ip packet to an ip address when the pc doesn't have an ip address (the pc is power off, remember I told you I'm trying to use WOL from Internet).

The answer? You tell the firewall the MAC address associated with this ip address with a static arp entry. If you don't use a static arp entry, that entry will be flushed from the arp cache after a short moment of inactivity (there is a lot of inactivity on a MAC address that is powered off ).

Since BrazilFW doesn't have the command "arp" available, you can use "ip neigh". On the console, type this:
ip neigh add 192.168.0.65 lladdr 00:01:02:03:ab:cd nud permanent dev eth0

Replace the ip address (192.168.0.65) and MAC address (00:01:02:03:ab:cd) by yours and you're done, you just made a static arp entry. Type this to verify the arp table:
ip neigh show

Now, to survive a reboot, simply add the command to /etc/rc.d/rc.local file.

I've tested the static arp entry on BFW 2.31.10 and it works. At work, I sended my WOL MagicPaquet at home, the packet passed through BFW and waked up my pc.

Another solution may have been forwarding a broadcast using port forwarding but that doesn't work (to ip address 192.168.0.255 for example). BFW doesn't allow this, I tried and it didn't work.

So let me add some more explannation about the way it works.
First of all, you don't send a broadcast if you do WOL over internet. You send a broadcast if you are on the same LAN (or VLAN) than the target pc. But on the internet, you cannot send a broadcast. I use the tool from Depicus (http://www.depicus.com/wake-on-lan/wake-on-lan-gui.aspx). With this tool, you can specify an ip address. This will not be a broadcast, it will only be sent to an ip address. In our case, it is our BFW's external ip address. But you specify the MAC address of the target pc, not the BFW mac address. In this MagicPaquet, you still have 16 times the MAC address of the target.

When BFW receives this paquet, it forwards it to the target pc (before you have to do a port forwarding for that pc, as I said earlier). But port forwarding is on layer 3 of networking ISO. On layer 2, a paquet is always sent to a MAC address, not an ip address because this concept doesn't exist on layer 2. The ARP table, which contains corresponding IP address to MAC address (similar to DNS tables which contains corresponding network names to IP address) frequently flush entries that become useless. In the case of a power down pc, his MAC address is flushed from BFW ARP table because it doesn't respond anymore.

So when the packet passes through port forwarding and is sent to the target pc, you have to make a static entry in ARP table so that port forwarding knows at which MAC address it must send the paquet.

Now, when the target pc receives the MagicPaquet, even if it is not a broacast paquet but a direct ip addressed paquet, the network card opens the paquet because it is addressed to him, sees that is MAC address appears 16 times and then send a signal to the BIOS to power on the pc.

As you can see, when doing WOL over intrnet, there is no broadcast. It may sound strange to do WOL without doing a broadcast, but that the way it works. At least, that the way I read it on other web pages. Maybe there are other ways. And maybe not all network card will wake up a pc if the MagicPaquet is not a broadcast. But with an onboard network card from nVidia nForce 4 Ultra chipset, it works.