D-Link DFL-600 - Manual - manualsarea.com

Page 2 - Table of Contents

Table of Contents Introduction ......................................................... 4 IP Address Settings and Computer Settings ...... 8 Introduction and Overview .................................. 9 Using the Configuration Utility ............................ 12 Setup Wizard .....................

Page 3 - Package Contents; Contents of Package:; Manual; System Requirements:

Package Contents Contents of Package: • D-Link DFL-600 Firewall/VPN Router • Manual • Quick Installation Guide • Power Adapter, 5V DC, 2.5A* • CAT-5 UTP Cable If any of the above items are missing, please contact your reseller. *Using a power supply with a different voltage rating will damage the pr...

Page 4 - Introduction; (DHCP stands for Dynamic Host Configuration Protocol. It is a

Introduction The D-Link DFL-600 VPN Router enables your network to connect to the Internet via a secure, private connection using a Cable or DSL modem. The Virtual Private Network (VPN) that is created on the Internet between your home and a VPN server in your office is secure from interference when...

Page 6 - Rearview; Connects the DC power adapter to the Power port; Product Features; The DFL-600 can connect any Cable or DSL modem to the network.; DHCP

Rearview Power (5V 2.5A DC) Connects the DC power adapter to the Power port WAN Connects DSL/Cable modem to the WAN Ethernet port Ports 1-3 Connect networked devices such as computers and ftp servers to the three LAN ports. All LAN ports support auto crossover. DMZ Connects a networked device to the...

Page 8 - IP Address Settings and Computer Settings; Dynamic IP Settings:

IP Address Settings and Computer Settings In order to install the DFL-600 you will need to check your computer’s settings and the values from your ISP. The information offered by your ISP: • Dynamic IP settings • Your fixed IP address for the gateway • Your subnet mask for the gateway • Your default...

Page 9 - Introduction and Overview; WAN; LAN; Local; Address; DMZ

Introduction and Overview The DFL-600 Firewall/VPN Router creates two separate networks on the LAN side of your network − by default, a 192.168.0.0 subnet and a 192.168.1.0 subnet (both with a subnet mask of 255.255.255.0). The DFL-600 routes packets between these two subnets and the Internet (or th...

Page 12 - Using the Configuration Utility; address; and the default Password is also; admin; to open the; Home

Using the Configuration Utility Launch your web browser and type the device IP address ( https:// 192.168.0.1 ) in the browser’s address box. This is the default IP address of your DFL-600. Press Enter. The following dialog-box will appear to prompt you to enter the DFL-600’s default User Name and P...

Page 13 - Run Setup Wizard

The Setup Wizard will guide you the most basic setup tasks, such as setting an administrative password, selecting the type of WAN connection you have, entering your computer’s host name (if required by your ISP), saving the configuration and restarting the router. All other setup tasks can be accomp...

Page 14 - Setup Wizard; menu contains a; link. Click on this button to; Next

Setup Wizard The Setup Wizard will guide you through the most basic setup tasks for the DFL-600. All other configuration tasks can be accomplished through the web-based manager. The Home menu contains a Run Setup Wizard link. Click on this button to run the Setup Wizard. Click Next to continue.

Page 16 - PPPoE; connections, while many Cable ISPs use; click-box is used to enter a permanent IP address that

This menu allows you to select the type of connection your ISP provides. Many ISPs use the PPPoE (Point-to-Point Protocol over Ethernet) for DSL connections, while many Cable ISPs use DHCP (Dynamic Host Configuration Protocol). DHCP assigns an IP address for your Internet connection each time you lo...

Page 17 - on the; Select Internet Connection Type; wizard screen above, the following screen will open:; screen above, the following window will

Some ISPs require you to use an assigned host name for your Internet connection. If your ISP requires this, you can enter the assigned host name in the Host Name field. If you selected Static IP Address on the Select Internet Connection Type (WAN) wizard screen above, the following screen will open:...

Page 19 - Restart; will save

You have completed the basic setup Wizard. The configuration now needs to be entered into the DFL-600’s non-volatile RAM. Clicking Restart will save the configuration to non-volatile RAM and restart the router.

Page 20 - The; menu contains links to all of the setup menus for the DFL-600.

Home The Home menu contains links to all of the setup menus for the DFL-600. Click on the WAN button:

Page 21 - WAN Settings; menu allows you to view the current configuration for; WAN Settings; are the network settings currently in; IP Settings Mode

WAN Settings The WAN Settings menu allows you to view the current configuration for your DFL-600, and to choose the protocol by which your DFL-600 will receive its WAN network settings. The settings listed under WAN Settings are the network settings currently in use by the DFL-600. The fields where ...

Page 23 - Default Gateway; from your home network; Primary DNS Server; If your ISP uses the Dynamic Host Configuration; DNS

Default Gateway This is the IP address of a device at your ISP’s office where packets destined for the Internet − from your home network − are sent, before being forwarded to their final destination. For the DFL-600, the Default Gateway address is provided by your ISP. For computers on your home net...

Page 24 - MAC address when connecting to the cable modem. Clicking on the; Clone; button and then to save the changes using; Tools

MAC address when connecting to the cable modem. Clicking on the Clone button will enable this function. Remember to click the Apply button and then to save the changes using Tools , System , and the Save button.

Page 25 - Static IP Address; If your ISP has assigned you an IP address that will

Static IP Address − If your ISP has assigned you an IP address that will never change, choose this option. When this option is chosen, the following fields appear to allow you to enter the network address information:

Page 26 - allows the PPPoE WAN connection to be active only

PPPoE − If your ISP uses Point-to-Point Protocol over Ethernet ( PPPoE ), choose this option. When this option is chosen, the following fields appear to allow you to enter the network address information: Connect on Demand − allows the PPPoE WAN connection to be active only when a computer on your L...

Page 27 - LAN Settings; if you assign an IP address and subnet mask to the DFL-600 that is

LAN Settings The LAN Settings allows you to view the current IP address and subnet mask assigned to the DFL-600. It also allows you to change these settings. If it is necessary to change the IP Address or Subnet Mask assigned to the DFL-600, enter the new values in the appropriate fields, and press ...

Page 28 - obtain an IP address automatically

As an example, if your LAN network is to be a 192.168.0.x network with a subnet mask of 255.255.255.0, you might assign the DFL-600 an IP address of 192.168.0.1 and configure the DFL-600’s DHCP server to assign addresses in the range between 192.168.0.2 to 192.168.0.100. The default gateway setting ...

Page 29 - DHCP Settings; This allows you to

DHCP Settings DHCP (Dynamic Host Configuration Protocol) is a method of automatically assigning IP addresses, subnet masks, default gateway and DNS server IP address to computers on the LAN side of the DFL-600. The DFL-600 can be a DHCP server for your LAN, assigning IP addresses, etc. to computers ...

Page 30 - through the DHCP protocol; Auto Configuration; Auto Configuration, the; Disable; Auto

the IP address assigned to the DFL-600 be contained in the range of IP addresses available for the DFL-600 to assign. In this case, the IP address of the DFL-600 is 192.168.0.1, so the first IP address in the range is 192.168.0.2. IP addresses can range from 0.0.0.0 to 255.255.255.255, but in the DF...

Page 33 - NAT; Network Address Translation; NAT is automatically applied between the WAN and the LAN sides of; Complications with Using NAT and Some Applications

NAT Network Address Translation Note: NAT is automatically applied between the WAN and the LAN sides of the DFL-600. It does not require any user configuration. Network Address Translation (NAT) is a routing protocol that allows your network to become a private network that is isolated from, yet con...

Page 36 - DMZ host IP address

to connections to the WAN or Internet. The IP address must be from the same range as the IP address of the DMZ port. The default DMZ IP address is 192.168.1.1, so DMZ Servers must be from the IP address range from 192.168.1.2 to 192.168.1.254, with a subnet mask of 255.255.255.0. DMZ host IP address...

Page 37 - Displays the current system date and time.; Time Zone; allows you to manually enter; SNTP; allows the DFL-600 to

Time Settings The DFL-600 can be set to obtain and distribute the correct time to computers on your LAN using the Simple Network Time Protocol (SNTP). Click on the Time button to open the following page: System Date Time Displays the current system date and time. Time Zone This drop-down menu allows...

Page 38 - Enter the IP address of an SNTP server here.; Domain Name

Set Type This drop-down menu allows you to select either the IP address of an SNTP server, or the Domain Name (URL) of an SNTP server that the DFL-600 will contact to obtain the correct date and time. IP address Enter the IP address of an SNTP server here. Domain Name Enter the Domain Name (URL) of ...

Page 43 - x Device Configuration; page will be allowed to access the WAN; RADIUS; click box will open the following page:

If you have some PCs (or other network devices) that do not require RADIUS user authentication to access the WAN (Internet), you can enable 802.1x, and then enter the IP Address and IP (subnet) Mask of these devices under the Edit link (which will appear when you enable 802.1x). PCs and network devi...

Page 45 - link will open the

RADIUS server will use to connect to PCs on your LAN for the RADIUS accounting function. The default port number for accounting is 1813. Secret Key Enter the shared key used between PCs on your LAN and the RADIUS server. Accounting Service Use the drop-down menu to enable or disable the RADIUS accou...

Page 46 - link. This will allow you; Configuration; page will be allowed to access the Internet without RADIUS

Clicking on the Edit link (which appears when you enable 802.1x) will open the 802.1x Device Configuration page, as shown below. If you have PCs on your LAN that do not require RADIUS user authentication to access the Internet (or other networks through your ISP), you can use Enable 802.1x, and then...

Page 47 - LDAP (Lightweight Directory Access Protocol) serves as an

802.1X 802.1x is a standard for passing the Extensible Authentication Protocol (EAP) over a LAN. You should enable this only if there are 802.1x devices between the DFL-600 and the RADIUS server on the WAN. Clicking on the Edit link (which appears when you enable 802.1x) will open the 802.1x Device ...

Page 48 - LDAP; This is the Distinguished Name used for LDAP.

Clicking the LDAP click box will open the following page: LDAP Server IP Enter the IP address of your LDAP server here. Your ISP should provide you with this address. Server Port This is the TCP port number that the LDAP server will use to communicate with PCs on your LAN. Port 389 is the ‘well know...

Page 49 - Advanced Settings; global; Virtual Servers

Advanced Settings NAT Network Address Translation Network Address Translation (NAT) is a routing protocol that allows your network to become a private network that is isolated from, yet connected to the Internet. It does this by changing the IP address of packets from a global IP address − assigned ...

Page 51 - Application Name; This is a reference; Netmeeting

Application Gateway (ALG) Some applications (programs running on a PC on your LAN) require multiple TCP or UDP ports to function properly. Applications such as Internet gaming, video conferencing, and Internet telephony are some examples of applications that often require multiple connections. These...

Page 53 - application requires a Trigger Port; Static Routing

firmware and can be selected here from the drop-down menu. Selecting one of the listed applications is the equivalent of entering the correct settings in the fields above for the specific application. For example, the Netmeeting application requires a Trigger Port Range of 1720 – 1720, a Trigger Typ...

Page 54 - or; None; will; Disabled; for the

Destination IP Network This is the IP address of the remote network that the DFL-600 will route service requests to. Subnet Mask This is the corresponding subnet mask for the remote network. Gateway IP Address This is the IP address of the gateway on the remote network that will provide the connecti...

Page 56 - Routing Information; link. This information is displayed in the Routing Information

LAN RIP interface will disable the routing function of your router. Network Address This is the IP address of either the LAN or WAN side of your DFL-600. Subnet Mask This is the subnet mask corresponding to the Network Address above. Interface Name This is the name of the interface corresponding to ...

Page 57 - the address within; Default

In the case shown above, the DFL-600’s WAN port was connected to a 10.0.0.0 network − with a subnet mask of 255.0.0.0. The LAN ports used the default 192.168.0.0 network addresses, and the DMZ port used the default 192.168.1.0 network addresses − both with a subnet mask of 255.255.255.0. The 0.0.0.0...

Page 58 - Setting the Schedule

Policy (Firewall) Configuration Some Examples Your DFL-600 allows you to make policy rules and then group these rules into a policy that will limit the types of access PCs on your LAN can have to the WAN (Internet). In addition, you can create a Schedule that will determine at what times and days of...

Page 60 - Setting the Policy Rules

You can change the times and days entered for a Schedule by clicking on the link below the Schedule View heading. This will open the Schedule Rules page for the corresponding Schedule Name , and allow you to make changes. Setting the Policy Rules Now you need to configure the DFL-600 to block PCs on...

Page 61 - Adding the Policy Rule to a Policy Group

range to PCs that you want the Policy Rule to apply to, and leave PCs with IP addresses outside the range free to access web-pages on the WAN (Internet). For simplicity in this example, we are going to specify Any in both the Source IP Range and Destination IP Range fields. This will mean that any P...

Page 63 - Policy Name; field. This name will; StudyTime; . The schedule we created previously will appear in; Assign to Schedule; drop-down menu and is selected as the times and; Action

Enter a name for the Policy group in the Policy Name field. This name will be used to reference this Policy group. In this case, we have named this Policy group StudyTime . The schedule we created previously will appear in the Assign to Schedule drop-down menu and is selected as the times and days o...

Page 64 - , and then click the; “Outbound Firewall Rule”; link. This will open a page that contains all of; Policy Rules; that apply to; Outbound

Under the Rule Filter heading, click Enabled , and then click the “Outbound Firewall Rule” link. This will open a page that contains all of the Policy Rules that apply to Outbound packets, as shown below.

Page 65 - Setting the Policy Global Status

Click the box under the Add heading to add the BlockWeb Policy Rule to the StudyTime Policy group. Click the Apply button to make the entry current. Click the Back button to return to the Policy Add page. Setting the Policy Global Status Now we need to configure the Global Policy Status . Click the ...

Page 67 - Example 2; button to open the

Remember to save the Policy configuration into the DFL-600’s non-volatile RAM using the Save button (under the Tools tab, click the System button to see the Save options). This will ensure that the DFL-600 will retain the Policy configurations when it is restarted or if the AC power is interupted. E...

Page 69 - Global Policy Status

The next step is to specify if you want the policy rule to apply to Inbound or Outbound packets. Inbound here means from the WAN to your LAN, while Outbound means from your LAN to the WAN. The Direction drop-down menu allows you to choose which direction the DFL-600 will filter packets that meet the...

Page 70 - Policy Status page, “; Default allow all; ” means that the DFL-600 will allow; Default deny all; link; Policy Add

Policy Status page, “ Default allow all ” means that the DFL-600 will allow all packets except those that meet the criteria established in the policy rules. “ Default deny all ” means that the DFL-600 will deny (filter) all packets except those that meet the criteria established in the policy rules....

Page 71 - Always; or a schedule; Allow; Deny; link on the; page will open the

Enter a name for the new group of policy rules in the Policy Name field. This name is used to reference the group of policy rules. You can also assign this group of policy rules to a schedule (which is either Always or a schedule you can create below). Finally, you can choose to Allow or Deny access...

Page 72 - Blocking Keywords

Enter a domain name you want to limit access to in the Domain Name field. Click the Apply button to add this domain name to the list. Blocking Keywords The DFL-600 will allow you to make a list of keywords for which packets will be filtered Clicking on the Keywords Add link on the Policy Rules page ...

Page 73 - Blocking MAC Addresses; where the numerals 0-9 and the letters A-F are; MAC Add; MAC Address; that you want the DFL-600 to scan for and filter; Apply; button to enter the MAC address into the table.

Blocking MAC Addresses The DFL-600 will allow you to make a list of MAC addresses for which packets will be filtered. MAC (Media Access Control) addresses are the physical addresses that are assigned to networking devices by their respective manufacturers. These addresses are 12 hexadecimal digits l...

Page 74 - mode allows the IPSec packets to; IPSec Passthrough; IPSec Settings

IPSec Settings IPSec (IP Secure) is a group of IP extensions developed by the Internet Engineering Task Force (IETF) to provide security services that are compatible with the existing IP standard. IPSec provides authentication, integrity, access control, and confidentially. The data and information ...

Page 76 - Manual Key

SPI An IKE VPN i VPN o configure a Manual Key VPN, click the Manual Key link to open the s to maintain the IPSec connection. s generally considered more secure than a Manual Key because IKE can generate new keys and SPIs randomly during the negotiation phase. Tpage shown below.

Page 81 - The following fields will identify the VPN; Tunnel Name; You can choose the type of remote peer that

Add/New Tunnel The following fields will identify the VPN tunnel on the DFL-600. Tunnel Name Enter a name by which this IPSec VPN tunnel configuration can be referrenced. Peer Tunnel Type You can choose the type of remote peer that

Page 84 - Subnet Mask

addresses of computers on the remote LAN to ote that the IP addresses192.168.2.0 and IPthat will be allowed to access the VPN. In this case, the entire subnet of IP addresses from192.168.2.1 to 192.168.2.254 will be allowedaccess the VPN. N192.168.2.255 are reserved for use on the remote network. Su...

Page 86 - hase 2 Proposal; This drop-down menu allows you to specify the

tion. the ore more likely to be IKE encryption algorithm that will be used to encrypt the messages passed between the VPN tunnel endpoints during the Phase 1 negotiaYou can choose between DES and 3DES encryption methods. The key length for 3DES algorithm is three times as long as the DES key, and is...

Page 91 - gs

gs ing a n the DFL-600. VPN-L2TP Settin The Layer 2 Tunneling Protocol (L2TP) is another method of establishsecure tunnel between your DFL-600 and a remote gateway. The L2TP Status page allows you to enable or disable L2TP o L2TP Pass Through Click Enable to allow L2TP packets to pass n through the ...

Page 95 - the; Remote Access; page allows you to enter the IP addresses of computers; roxy Redirect

Remote Access n the WAN (Internet) that will be allowed to access the configuration utility. the e allowed to ccess the DFL-600’s configuration utility. The Remote Access page allows you to enter the IP addresses of computers oIf you do not enter any IP addresses on this page, then no IP address onW...

Page 97 - ware

Tools − Firmware The Firmware Upgrade page allows you to upgrade the DFL-600’s firmfrom a new firmware file stored on your local hard drive. ware In addition, you can choose to load the DFL-600’s current VPN or Firewall ive on a local computer. Clicking on the OK button will d er. settings to a hard...

Page 103 - Blocking Log

on your LAN, or between computers on your LAN and the WAN) because t ia pre-d ed intrusion method, are recorshown below: hey meet the criter efined at the factory as being a commonly usded here, in the Intrusion Detection Log , as Intrusion Type A brief statement of the type of intrusion that was at...

Page 104 - Transport Type; otocol used to make the connection; Source; computer or device that was the destination; Blocking Reason

Transport Type otocol used to make the connection Source The prattempt is displayed here. The IP address and the TCP/UDP port number ofthe of c Destination: port computer or device that was the destination onnection attempt to the DFL is displayed here. Blocking Reason A brief statement of why the c...

Page 107 - IPSEC Statistics; This displays the sequence of the IPSec log.; HED; A brief descrip; Description; tion of the log entry will be

l connection between the WAN and the LAN. These statistics can be iewed on the IPSEC Statistics table, as shown below: IPSec Log The DFL-600 maintains a table containing statistics concerning the IPSec protocov Index This displays the sequence of the IPSec log. HED There are five categories of statu...

Page 108 - Sys Log; configuration page, as

Sys Log The DFL-600 can save or transmit Syslog messages to aid in network administration. You must have a Syslog application on one of the computers on your LAN to take advantage of this feature. configuration page, as Clicking on the Sys Log link will open the Sys Log shown below. Save Location Ch...

Page 110 - eeps a log

Status − Traffic Log Y eeps a log transmitted on to and from displayed by clicking on th affic Statistics page, as shown below. our DFL-600 k of the total number of bytes received and the LAN and WAN. This information can be e Traffic button to display the Tr

Page 111 - g PCs to the DFL-600 Router; ed to; Connectin; If you; do not; wish to set the static IP address on your PC, you will ne

g PCs to the DFL-600 Router ed to elect Settings then select Control Panel. ouble-click the Network icon. TCP/IP line listed, Connectin If you do not wish to set the static IP address on your PC, you will ne configure your PC to request an IP address from the gateway. Click the Start button, sDIn th...

Page 112 - S IP CONFIGURATION; Inside the windows 95/98 Start button, select Ru; CONFIRM YOUR PC’; WINIPCF; n and type winipcfg. In the

Click the Properties button, then choose the IP Address tab. Select Obtain an IP address automatically . g OK , windows might ask you to restart the PC. Click S IP CONFIGURATION o tools which are great for finding out a com configuration: MAC address and default gateway. G (for Windows 95/98) Inside...

Page 113 - IPCONFIG; and press; Enter

• IPCONFIG and press Enter . Your PC IP wn below. IPCONFIG (for Windows 2000/NT/XP) In the DOS command prompt type information will be displayed as sho

Page 114 - tablish a network at home or work,; Networking Basics; Please refer to websites such as

tablish a network at home or work, http://www.homenethelp.com Networking Basics Using the Network Setup Wizard in Windows XP In this section you will learn how to esusing Microsoft Windows XP. Note: Please refer to websites such as and http://www.microsoft.com/windows2000 for information about K CON...

Page 116 - Click

(optional.) Click Next Enter a Computer description and a Computer nam Click Next e

Page 118 - When the changes are complete, Click

puter. e a few minutes. When the changes are complete, Click Next . Please wait while the wizard configures the comThis may tak

Page 119 - You will run this disk on each of the

ple, “Create a You will run this disk on each of the In the window below, select the best option. In this examNetwork Setup Disk” has been selected. computers on your network. Click Next . :” Insert a disk into the Floppy Disk Drive, in this case drive “A

Page 120 - ormat the disk if you wish, and Click; how in the screen below. After you; en Click Finish to complete the

ormat the disk if you wish, and Click Next . F Please wait while the wizard copies the files. how in the screen below. After you e the Network Setup Disk to puters on your Please read the information under Here’s complete the Network Setup Wizard you will usrun the Network Setup Wizard once on each ...

Page 122 - e your computer; Select the; You m; START; Select; Properties; ay enter a

e your computer Naming your Computer Naming your computer is optional. If you would like to namplease follow these directions: • Select the Computer Name Tab in the System Properties window. You m puter description if In Windows XP: Click START (in the lower left corner of the screen) Right-click on...

Page 124 - ssigning a Static IP Address; rol Panel

ssigning a Static IP Address ote: Residentia atically assign IP Addresses to the com ic Host Gateway/Router you will not need If you are not usin to assign a Sta A N l Gateways/Broadband Routers will autom puters on the network, using DHCP (Dynam Configuration Protocol) technology. If you are using ...

Page 125 - Highlight

Right-click on Local Area Connections . perties Double-click Pro Highlight Internet Protocol (TCP/IP) Click Properties

Page 127 - the assignment of a Static IP Address. (You do not need

the assignment of a Static IP Address. (You do not need assign a Static IP Address if you have a DHCP-capable Gateway/Router.) You have completed to

Page 128 - Contacting Technical Support

ebsite. D-Link provides free technical support for customers within the United States for the duration of the warranty period on this product. U.S. customers can contact D-Link technical support through our web site, or by phone. D-Link Technical Support over the Telephone: (800) 758-5489 24 hours a...

D-Link DFL-600 - Manual

Table of Contents:

Summary

Other D-Link Models