Wireless Hotspot Router User Guide
Copyright Statement © 2019 Shenzhen Tenda Technology Co., Ltd. All rights reserved. is a registered trademark legally held by Shenzhen Tenda Technology Co., Ltd. Other brand and product names mentioned herein are trademarks or registered trademarks of their respective holders. Copyright of the whole product as integration, including its accessories and software, belongs to Shenzhen Tenda Technology Co., Ltd.
Preface Thank you for choosing Tenda! Please read this user guide carefully before you start. Conventions This user guide is applicable to the following routers. W20E is used for illustrations here unless otherwise specified. The contained images and UI screenshots are subject to the actual products.
Acronym and Abbreviation Full Spelling APSD Automatic Power Save Delivery CPU Central Processing Unit DDNS Dynamic Domain Name Server DDoS Distributed Denial of Service DES Data Encryption Standard DHCP Dynamic Host Configuration Protocol DPD Digital Pre-Distortion DMZ Demilitarized Zone DNS Domain Name System ESP Encapsulating Security Payload GBK Chinese Internal Code Specification GMT Greenwich Mean Time ICMP Internet Control Message Protocol IKE Internet Key Exchange IP In
Acronym and Abbreviation Full Spelling PPPoE Point-to-Point Protocol Over Ethernet PPTP Point to Point Tunneling Protocol RSSI Received Signal Strength Indicator SA Security Association SSID Service Set Identifier SHA Secure Hash Algorithm Short GI Short Guard Interval SMS Short Message Service SPI Security Parameter Index SYN Synchronize SYS System TCP Transmission Control Protocol TKIP Temporal Key Integrity Protocol UDP User Datagram Protocol UI User Interface UPnP Univer
Getting more documents If you want to get more documents of the device, visit www.tendacn.com and search for the target product model. The related documents are listed as below: Document Description Quick Installation Guide It introduces how to set up the device quickly for internet access, the descriptions of LED indicators, ports, and buttons, FAQ, statement information, and so on.
Contents 1 At a glance ....................................................................................................................................... 1 1.1 Overview .................................................................................................................................. 1 1.2 Main features ........................................................................................................................... 1 1.3 Label ..................................................
6.3.1 Overview ..................................................................................................................... 31 6.3.2 Configure a MAC filter rule ......................................................................................... 32 6.4 Advanced settings .................................................................................................................. 34 6.5 Configure guest network..................................................................................
.4.5 Import accounts data .................................................................................................. 83 10 AP mangement.............................................................................................................................. 84 10.1 Basic settings ........................................................................................................................ 84 10.1.1 Overview ..............................................................................
12.2.3 MTU.........................................................................................................................122 12.2.4 Clone MAC address .................................................................................................122 12.2.5 Fast NAT...................................................................................................................123 12.3 Configure static route .........................................................................................
12.14.1 Overview ...............................................................................................................160 12.14.2 Create IPSec connection .......................................................................................160 12.15 Example of configuring VPN conenctions ........................................................................169 12.15.1 Example of configuring a PPTP/L2TP VPN............................................................. 169 12.15.
13.7.3 Execute Traceroute command to detect the route selection .................................205 13.8 System time........................................................................................................................207 13.8.1 Overview .................................................................................................................207 13.8.2 Synchronize with internet time...............................................................................207 13.8.
1 At a glance 1.1 Overview The enterprise router stands out both on hardware and software. With sleek appearance, high-gain antennas, various interfaces, as well as an intuitive web UI that allows you to manage your network to achieve your very specific deployment purpose, such as authentication using captive portal, and VPN connections. You are assured to enjoy stable network and convenient management. 1.2 Main features At most three 2.
1.3 Label The label shows the Default Access, MAC, SSID and Serial NO. of the router. The following is an example of what the router label might look like: (1) (2) (5) (3) (4) (6) (7) (1) Product name of the router. (2) Model: Product model of the router. You can use this model as a key word for searching related supporting materials on our official website. (3) Default Access: Default domain name or IP address for logging in to the web UI of the router.
2 Quick setup This chapter introduces how to set up the router to access the internet for the first time. Step 1 Connect your router. 1. Connect the included power adapter to the Power jack of the router to power it on. 2. Use an Ethernet cable to connect an Ethernet jack or a LAN port of your modem to the WAN port of the router. 3. Either connect your computer to a LAN port of the router, or connect your WiFi-enabled device, such as a smart phone, to the wireless network of the router.
2. Click Start. The system automatically starts detecting your internet connection type. 3. After detection completed, just follow the on-screen instructions to set up your router. PPPoE is used for illustrating here. Enter the PPPoE Username and PPPoE Password provided by you ISP, and click Next.
4. Customize the SSID (wireless network name) and WiFi password as needed. - By default, the WiFi password is set as the Login Password, you can deselect the checkbox and customize them separately. - WiFi Password is used for connecting to your wireless network, while Login Password is used for logging into the web UI of the router for management. 5. Click Next. ---- End To access the internet with: - Wireless clients: Connect your wirelss devices to the SSID with the WiFi password you set.
3 Login 3.1 Login This section introduces how to log in to the web UI of the router for management. For initial use of the router, refer to Quick setup. 3.1.1 Overview The router supports two account types: Administrator and Authentication. The Administrator account enjoys all access permission of the router, while the Authentication account only has permission for accessing System Status and Authentication modules. For detailed explanation, see Password Manager. 3.1.
Log in to the web UI of the router using the Administrator account. See the following figure: Log in to the web UI of the router using the Authentication account.
3.2 Logout If you log into the web UI of the router and perform no operation within 20 minutes, the router logs you out automatically. You can log out by clicking Logout on the upper right corner of the web UI as well.
3.3 Web UI layout The web UI of the router consists of three sections, including the level-1, and level-2 navigation bar, and the configuration area as well. See the following figure: 1 3 2 SN Name Description ❶ Level-1 navigation bar ❷ Level-2 navigation bar Used to display the function menu of the router. Users can select functions in the navigation bars and the configuration appears in the configuration area. ❸ Configuration area Used to modify or view your configuration.
3.4 Frequently-used buttons The following table describes the frequently-used buttons available on the web UI of the router. Button Description Used to save the configuration on the current page and enable the configuration to take effect. Used to change the current configuration on the current page back to the original configuration. Used to get the online help.
4 System status 4.1 Check physical connections and system status To enter the configuration page, choose System Status. You can check if the physical connections are proper, or the router’s system status here. 4.1.1 Check physical connections The following figure indicates that the router is connected to the internet properly through the WAN1 port. √ The following figure indicates that connection between the router and the internet is abnormal.
4.1.2 View system status On System Status page, click the Router icon , the Device Info window pops up. The Device Info window consists of three parts: Operating Status, LAN Port Status, and WAN Info. Operating Status Parameter description Parameter Description It specifies the current system time of the router. System Time You can set system time by navigating to Maintenance > System time. Uptime It specifies the time that has elapsed since the router was started last time.
LAN port status This module shows the LAN IP address and the MAC address of the router. You can modify LAN settings by navigating to More > LAN settings. WAN Info This module displays information about all enabled WAN ports, including Connection Type, Status, and IP Address and so on. Parameter description Parameter Description Connection Type It specifies the internet connection type of the corresponding WAN port. Status It specifies whether or not the WAN port is plugged.
Parameter Description IP Address It indicates the IP address of the corresponding WAN port. Subnet Mask It indicates the subnet mask of the corresponding WAN port. Default Gateway It indicates the gateway IP address of the corresponding WAN port. Only forwarding packets through this gateway can clients access the internet. Primary DNS The primary/secondary DNS server address of the corresponding WAN port. Secondary DNS The Secondary DNS is optional. If you do not set this parameter, it shows 0.0.
4.2 Monitor traffic The router presents the traffic usage in an intuitive way. Click More Statistics on System Status page, the Traffic Monitoring window appears. See the following figure: Monitoring traffic of selected WAN port(s). Monitoring traffic of online client(s).
4.3 Manage online devices To access the configuration page, click the Connected Devices icon The Bandwidth Control and Blacklist window appears. on the System Status page. You can edit the name of connected clients, control the connected clients’ upload and/or download bandwidth separately or in batch, and block a device from accessing your network.
4.3.1 Control bandwidth of online devices Control bandwidth of online devices separately To limit the upload and/or download bandwidth of one or several devices, select a pre-defined value from the drop-down list menu of Upload Limit and/or Download Limit, or select Manual to specify a value manually. Control bandwidth of online devices in batch Click Limit All, specify the values according to your actual situation, and click Save to apply your settings.
4.3.2 Add devices to blacklist To protect your network from being accessed by unknown devices, click the Blacklist button to block them. The blocked devices will be moved to the Blacklist section, and cannot connect to your router. Click this tag to view blocked devices. Click to block. 4.3.3 Remove devices from blacklist Follow steps below to unblock devices from the blacklist. Step 1 Click the Connected Devices icon and Blacklist window appears. on the System Status page.
4.4 Manage APs This page displays some basic information operations about APs connected to the router. If you want to perform further configurations concerning connected APs, please refer to AP Mnagement. To access the configuration page, choose System Status, and click the AP icon. The AP Management window appears. See the following figure: Parameter description Parameter Description AP Model It specifies the model of the corresponding AP.
5 Internet settings 5.1 Overview To enter the configuration page, choose Internet Settings. Parameter description Parameter Description It specifies how many WAN ports you can set on the router. WAN Ports By default, the router has only one WAN port (the WAN1 port), and you can set 3 WAN ports at most. It indicates that if the port functions as a WAN port or a LAN port, as well as if a port is connected or not. Port Type ：The port is connected properly.
Parameter Description It specifies in which way the router is connected to the internet. The router supports PPPoE, Static IP, and Dynamic IP. Refer to the table Choose your connection type for details. Connection Type The router supports PPPoE Russia, PPTP/PPTP Russia, and L2TP/L2TP Russia as well. These three connection types are only applicable to Russia and its vicinity. PPPoE Username PPPoE Password These two parameters are required only when your internet connection type is PPPoE.
5.2 Configure multiple WAN ports The router supports 3 WAN ports at most. The multi-WAN port feature lets you aggregate bandwidth, enjoy uninterrupted broadband service even in case of one connection malfunctions, and make ISP route selection, thus getting a better utilization of your bandwidth. Assume that: WAN1 internet connection type is Static IP, and the static IP information is as follows: - IP Address: 192.168.97.86 - Subnet Mask: 255.255.255.0 - Default Gateway: 192.168.97.1 - Primary DNS: 192.168.
Step 2 On WAN1 configuration area, enter the static IP information provided by your ISP. The following figure is only for example. Step 3 On WAN2 configuration area, select Dynamic IP from the drop-down list menu of Connection Type. Step 4 Click Save at the bottom of the page. ---- End Wait a moment. The router performs rebooting to apply your settings. When the status shows Connected, your configuration is successful.
5.3 Set up to access the internet This section describes how to set up to access the internet using different connection types. Choose the proper connection type according to your actual environment. Use the table below to help you select your internet connection type if you are uncertain about how to select one. Choose your connection type: Connection Type Parameters available PPPoE Your ISP provided you the PPPoE username and password.
Wait for the router to complete rebooting. The router connects to the internet successfully when the Status shows Authenticated successfully. Otherwise, check if the parameters you entered are correct. 5.3.2 Set up to internet access with dynamic IP Step 1 Click Internet Settings, the configuration page appears. Step 2 Select Dynamic IP from the Connection Type drop-down list menu. Step 3 Click Save at the bottom of the page to apply your settings.
Wait for the router to complete rebooting. The router connects to the internet successfully when the Status shows Connected. You can enjoy the internet now.
5.3.3 Set up to internet access with static IP Step 1 Click Internet Settings, the configuration page appears. Step 2 Select Static IP from the drop-down list menu of Connection Type. Step 3 Enter the IP Address, Subnet Mask, Default Gateway and Primary/Secondary DNS parameters provided by your ISP. Configurations on the following figure are only used for examples. Step 4 Click Save at the bottom of the page to apply your settings. ---- End Wait for the router to complete rebooting.
6 Wireless 6.1 Wireless settings This dual-band router supports at most three 2.4 GHz wireless networks, and three 5 GHz wireless networks. By default, the 2.4 GHz and 5 GHz SSIDs for a wireless network are unified, and only WiFi Network1 is enabled. In this module, you are allowed to set up WiFi network-related configurations, such as view and edit wireless network names (SSID), WiFi passwords, configure 2.
Parameter description Parameter Description Enable WiFi Network Used to enable/disable the wireless network of the router. Unify 2.4&5 GHz SSID Whether to unify SSIDs for 2.4 GHz and 5 GHz wireless networks. SSID Wireless network name of the corresponding WiFi network. Password used for wireless internet connection. You are recommended to use the combination of digits, letters and special characters for higher security.
6.2 Network isolation Isolating a network makes clients connected to it cannot communicate with clients connected to another network. To access the configuration page, choose Wireless > Network Isolation. See the following figure: Parameter description Parameter Description SSID Wireless network name of the corresponding WiFi network.
6.3 MAC filters 6.3.1 Overview This module allows you to configure MAC address-based wireless access control rules. To enter the configuration page, choose Wireless > MAC Filters. By default, this function is disabled. To enable this function, set the MAC Filters to following configuration area appears: , and click Save at the bottom of the page. The Parameter description Parameter Description It lists all the main wireless networks that the router supports. SSID If you unify the SSIDs for 2.
Parameter Description this wireless network. - Only Allow: Only wireless clients with the specified MAC address can connect to this wireless network. - Only Forbid: Only wireless clients with the specified MAC address cannot connect to this wireless network. MAC Filters List MAC Filters List It specifies the wireless access control list you configured. MAC Address It specifies the MAC address of the client to which the rule applies.
1. Click Add. The Add configuration window appears. 2. Enter the description of the client in Remark, and select the wireless network from the drop-down list menu of the Effective Network. 3. Click Save. The rule appears on the MAC Filter List. Parameters on the following figure are only used for examples. Please specify them based on your actual conditions. 4. Repeat Add rule(s) to add other clients one by one.
6.4 Advanced settings This section introduces wireless-related advanced settings. To enter the configuration page, choose Wireless > Advanced. See the following figure: Parameter description Parameter Description 2.4 GHz WiFi Network Used to enable or disable the 2.4 GHz wireless network of the router. 5 GHz WiFi Network Used to enable or disable the 5 GHz wireless network of the router. Transmit power of this device. Transmit Power A higher value leads to wider WiFi coverage.
Parameter Description regulations of different countries or regions concerning channels. It specifies the wireless network mode (also called 802.11 mode, radio mode, or wireless mode) of the router. A proper network mode enables the clients to get the maximum transfer rate and compatibility. Network Mode Available options for 2.4 GHz band: 11b, 11g, 11b/g, and 11b/g/n (default). Available options for 5 GHz band: 11a, 11ac (default), and 11a/n mixed. You are recommended to keep the default settings.
Parameter Description duration. This prevents some slow clients from occupying excessive airtime resources, so as to improve the overall AP efficiency and effectively ensure AP connections for a larger number of clients and greater throughputs. APSD It specifies whether to enable the Automatic Power Save Delivery (APSD) mode. APSD is a WMM power saving protocol created by Wi-Fi Alliance. Enabling APSD helps reduce power consumption. By default, this mode is disabled.
6.5 Configure guest network This section introduces guest network. You can configure a guest network for visitors to protect the security of the main network. In addition, the router allows you to set a guest network segment different from the main network. To access the configuration page, choose Wireless > Guest Network. See the following figure. By default, this function is disabled.
Parameter description Parameter Description Enable Guest Network Used to enable or disable this function. Unify 2.4&5 GHz SSID Used to unify SSIDs for 2.4 GHz and 5 GHz guest wireless networks. Isolate Client With this function enabled, clients connected to the guest network cannot communicate with each other, leading to higher wireless network security. Wireless network name of the guest network.
7 Address reservation The address reservation function always allows a host, such as a computer, on LAN to receive the same IP address each time when they connect to the DHCP server. If there are some hosts on LAN that require static IP addresses, you can configure the address reservation for this purpose. 7.1 Configue on-line client-based quick address reservation The router allows you to conveniently reserve static IP addresses for on-line hosts one by one or in batch.
7.1.2 Configure on-line client-based quick address reservation in batch Step 1 Choose Address Reservation to enter the configuration page. Step 2 Select hosts you want to reserve a static IP address, and click the Reserve button. Or if you want to select all hosts on the list, check the checkbox next to Host Name. Select all with one click ---- End The Reservation Status of hosts are changed into Reserved, and displayed on the lower part of the page.
41
7.2 Configure address reservation manually To reserve static IP addresses for hosts disconnected to the router, you can add the rule manually. If the network segment of LAN IP of the router is modified in LAN settings, the IP address of the manually-reserved host will not change synchronously, but the rule remains effective. Before you start Obtain the IP addresses and MAC addresses of hosts you are going to add.
The Reservation Status of hosts are changed into Reserved, and displayed on the lower part of the page. See the following figure: Click to delete. Click to modify. Remark you specified Toggle the button to enable/disable the rule.
7.3 Export/import your address reservation configuration The router supports to export the current configuration you set to your local PC for backup, and import the configuration file you backed up to the router, relieving your from repeated laborious efforts for configuration. This section introduces: Export configuration file to your local PC. Import configuration file to your router. 7.3.
8 Bandwidth control Internet bandwidth is limited. Well-controlled traffic of users ensures that the bandwidth is properly used to effectively access resources over the internet. 8.1 Overview To enter the configuration page, choose Bandwidth Control. Parameter description Parameter Description Upload Rate WAN Broadband Control Mode Download Rate Enter the bandwidth provide by your ISP for better internet experience.
Parameter Description Auto The router evenly allocates bandwidth to all clients on the LAN. Limit By Group This mode allows the network administrator to customize control rules based on IP groups and time groups. The concurrent sessions can also be configured here.
8.2 Bandwidth control mode The router allows you to control upload and download bandwidth for both online and offline clients with four control modes, including No Limit, Auto, Manual, and Limit By Group to meet your various requirements by unleashing the potential of your WAN broadband services. 8.2.1 No limit Select No limit from the Control Mode drop-down list menu, and clients connected to the router compete for bandwidth resources without restriction. 8.2.
Click Offline Devices tag, the following configuration area appears: Parameter description Parameter Description It specifies the name of clients connected to the router. You can click the host name for convenient management. to personalize Host Name - Modification of host name here will be applied to the whole system. - For host name-based rules, use host name, you need to use the host name here. Total Download It specifies the total download traffic utilized by each client.
Control bandwidth of online/offline devices separately To limit the upload and/or download bandwidth of one or several devices, select a pre-defined value from the drop-down list menu of Upload Limit and/or Download Limit, or select Manual to specify a value manually.
To control bandwidth based on groups, you need to configure IP group and time group first by navigating to Filter Management > IP Group/Time Group. Refer to Configure IP group and time group for detailed description. Step 1 Choose Bandwidth Control, and move to the Control Mode configuration area. Step 2 Set Control Mode to Limit By Group, the following configuration area appears. Step 3 Click Save at the bottom of the page. Step 4 Click +Add to add a bandwidth control policy.
Parameter description Parameter Description IP Group Create or select the IP group to which the rule applies. To create an IP Group, choose Filter Management > IP Group/Time Group. Time Group Create or select the time group to which the rule applies. To create a time Group, choose Filter Management > IP Group/Time Group. Concurrent Sessions Maximum number of sessions of each device. Recommended value: 300.
8.3 Example of configuring group-based control rules Networking requirement An enterprise uses the router to set up a LAN to address the following requirement: During business hours (08:30 to 18:00 on weekday), each computer with an IP address ranging from 192.168.0.2 to 192.168.0.100 is allocated 1 Mbps upload and download bandwidth, while the bandwidth allocated to the computers with an IP address ranging from 192.168.0.101 to 192.168.0.254 is not limited.
Step 2 Set IP address group(s). 1. Choose Filter Management > IP Group/Time Group. 2. Set the IP address group(s) shown in the following figure. Step 3 Set bandwidth control rule(s). 1. On the Bandwidth Control page, set Control Mode to Limit By Group. 2. Click Save at the bottom of the page. 3. Click +Add. The Add configuration window appears.
4. Create a rule shown in the following figure, and click Save. 1 Mbps = 128 KB/s ---- End Added successfully. See the following figure: Verification During business hours from 08:30 to 18:00 on weekday, each computer with an IP address ranging from 192.168.0.1 to 192.168.0.100 is allocated 1 Mbps (128 KB/s) upload and download bandwidth, while the bandwidth allocated to the computers with an IP address ranging from 192.168.0.101 to 192.168.0.254 is not limited.
9 Authentication 9.1 Overview The router supports captive portal. Captive portal can promote your brand visibility and attract more fans. 9.2 Configure captive portal This section introduces how to configure captive portal. 9.2.1 Overview To access the configuration page, choose Authentication > Captive Portal. By default, this function is disabled.
Enable Captive Portal, the configuration page is shown as below. Parameter description Parameter Description Captive Portal It specifies whether or not to enable the captive portal function of the router. It specifies the type of the captive portal. Authentication Type - Local User Authentication: It allows a user to access the internet with a username and password on the authentication web page. The username and password should be added on Authentication > User Management page.
Parameter Description - WiFi via SMS: It allows a user to access the internet with a verification code sent by SMS when receiving an authentication web page. To enable this authentication type, you need to configure SMS Provider Settings first. The router supports Jixintong and NEXMO, and allows you to customize HTTP interconnection yourself as well. - Email Authentication: It allows a user to access the internet with a verification code sent through email when receiving an authentication web page.
9.2.2 Configure SMS authentication Configuration description Step Task Description 1 Configure basic settings. Set authentication type, valid duration, and choose networks to be applied, as well as SMS provider settings. 2 Configure authentication page settings. Configure the authentication page received by users. Before you start Obtain required information from your SMS provider first. Jixintong: User Name and Password you applied on the Jixintong platform.
Parameter description Parameter Description User name from your SMS provider Password from your SMS provider Jixintong Enter the user name and password you’ve applied on the Jixintong platform. Customize the short message sent to users. Content The verification code format is $$CODE$$, which cannot be modified. api_key Enter the api_key you’ve applied on the NEXMO platform. api_secret Enter the api_secret you’ve applied on the NEXMO platform. NEXMO Customize the short message sent to users.
6. Click Choose, and choose the network(s) to be applied, and click Save. If the WiFi network name you selected is modified, it will be automatically deselected here. To make the WiFi network effective, you have to re-select the WiFi network with the new SSID here manually. Step 2 Configure authentication page settings. 1. Set required parameters for the authentication page by following the on-screen instructions. Configurations on the following figure are only used for examples. 2.
9.2.3 Configure authentication with local user authentication Configuration description Step Task Description 1 Configure basic settings. Set authentication type, valid duration, and choose networks to be applied, as well as the required authentication page. 2 Configure authentication page settings. Configure the authentication page received by users. Configuration procedure Step 1 Configure basic settings. 1. Choose Authentication > Captive Portal, and enable this function. 2.
2. Click Save at the bottom on the page.
9.2.4 Configure email authentication Configuration description Step Task Description 1 Configure basic settings Set authentication type and valid duration, choose networks to be applied, and set the maximum number of people sharing the same authentication mode. 2 Configure email server settings Configure the Email used to send authentication code, including Email Address, Email Password, SMTP Server, SMTP Server Port and Account for Test.
1. Enter the Email Address and Email Password of the email account used to send authentication emails. 2. Enter the SMTP Server and SMTP Server Port of the email account, select SSL. 3. Enter another email address in Account for Test box,and click Test. The configurations are correct when you receive a notification as follows: - If you failed to send test email, please check the SMTP Server of the email account for sending test email. - The default SMTP Server Port is 25.
9.2.5 Configure one-key authentication Configuration description Step Task Description 1 Configure basic settings. Set authentication type, valid duration, and choose networks to be applied. 2 Configure authentication page settings Configure the page received by users. Configuration procedure Step 1 Configure basic settings. 1. Choose Authentication > Captive Portal, and enable this function. 2. Select One-key authentication from the Authentication Type drop-down list menu. 3. Set Valid Duration.
2. Click Save at the bottom on the page.
9.3 Examples of captive portal 9.3.1 Example of configuring SMS authentication Networking requirement An enterprise wants to establish a network and regulate the use of the network with the router. The requirements include: - SMS authentication is required for employees who want to access the internet through the LAN port of the router or the wireless network Tenda_W20E. - Employees are directed to www.tenda.com.cn after being authenticated.
(4) Click Save. 6. Set Valid Duration, such as 24 hours. 7. Select Choose, choose the networks that the SMS authentication is applied to, and click Save. Step 2 Configure authentication page. 1. Click Change to upload a logo image. 2. Customize the Title of the authentication page. 3. Click Change to upload a background image. 4. Customize a Disclaimer for the enterprise, such as “Copyright ©2019 Shenzhen Tenda Technology Co,. Ltd. All rights reserved.” 5. Select Specified Page, enter www.tenda.com.cn.
6. Click Save. Step 3 Add authentication-free host. 1. Choose Authentication > User Management. 2. Navigate to Authentication-free Host configuration area, click +Add. 3. Select MAC Address for Host Type, enter a MAC Address, which is 44:37:E6:12:34:56 in this example. 4. Customize a Remark for the host, such as Administrator.
5. Click Save. ---- End Verification The network administrator can access the internet without authentication. Other employees have to perform SMS authentication as follows: Step 1 Start a web browser on a smart phone, and visit any website. The authentication page appears. Step 2 Enter a valid phone number and tap Obtain. Step 3 Enter the Verification Code in the SMS received. Step 4 Tap Connect. After successful authentication, the browser will navigate to www.tenda.com.cn.
9.3.2 Example of configuring local user authentication Networking requirement An enterprise wants to establish a network and regulate the use of the network with the router. The requirements include: - Local user authentication with user name and password is required for employees who want to access the internet through the LAN port of the router or the wireless network Tenda_W20E. - No upload or download rate limit is specified for employees. - Employees are directed to www.tenda.com.
Step 2 Configure authentication page. 1. Click Change to upload a logo image. 2. Customize the Title of the authentication page. 3. Click Change to upload a background image. 4. Customize a Disclaimer for the enterprise, such as “Copyright ©2019 Shenzhen Tenda Technology Co,. Ltd. All rights reserved.” 5. Select Specified Page, enter www.tenda.com.cn. 6. Click Save. Step 3 Add local user authentication account (s). 1.
3. Fill the required parameters. (1) Set User name and Password, such as zhangsan/zhangsan, (2) Set Valid Duration to Always valid, (3) Set People Shared with to 10, (4) Set Current Sessions to 600, (5) Set Upload Rate and Download Rate to No Limit. (6) Click Save. Step 4 Add authentication-free host. 1. Choose Authentication > User Management. 2. Navigate to Authentication-free Host configuration area, click +Add. 3.
5. Click Save. ---- End Verification The network administrator can access the internet without authentication. Other employees have to perform local user authentication as follows: Step 1 Start a web browser on a smart phone, and visit any website. The authentication page appears. Step 2 Enter the correct User Name and Password. Step 3 Tap Connect. After successful authentication, the browser will navigate to www.tenda.com.cn.
9.3.3 Example of configuring email authentication Networking requirement An enterprise wants to establish a network and regulate the use of the network with the router. The requirements include: - Email authentication is required for employees who want to access the internet through the LAN port of the router or the wireless network Tenda_W20E. - No upload or download rate limit is specified for employees. - Employees are directed to www.tenda.com.cn after being authenticated.
1. Fill zhangsan@163.com in Email Address. 2. Fill abc123456 in Email Password. 3. Fill smtp.163.com in SMTP Server. 4. Select SSL. 5. Fill 465 in SMTP Server Port. 6. Enter another email address in Account for Test, which is lisi@163.com in this example. 7. Click Test to ckeck if the configurations are correct. If the test fails, try the following solutions: - Check if the SMTP service is enabled for the Email Address. - Check if the Account for Test is valid. - Change the email content.
5. Select Specified Page, enter www.tenda.com.cn. 6. Click Save. Step 4 Add authentication-free host. 1. Choose Authentication > User Management. 2. Navigate to Authentication-free Host configuration area, click +Add 3. Select MAC Address for Host Type, enter a MAC Address, which is 44:37:E6:12:34:56 in this example. 4. Customize a Remark for the host, such as Administrator.
5. Click Save. ---- End Verification The network administrator can access the internet without authentication. Other employees have to perform email authentication as follows: Step 1 Start a web browser on a smart phone, and visit any website. The authentication page appears. Step 2 Enter a valid email address in the Email box and tap Obtain. Step 3 Enter the Verification Code in the email received. Step 4 Tap Connect. After successful authentication, the browser will navigate to www.tenda.com.cn.
9.4 User management 9.4.1 Overview To manage users connected to the network of the router, choose Authentication > User Management. See the following figure. In this page you are able to add authentication-free host, add user accounts used for local user authentication and import or export account data of authenticated accounts. 9.4.2 Add authentication-free host Configuration procedure Step 1 Click +Add. Step 2 Set the required parameters.
Parameter description Parameter Description Host Type It allows you to set a device without authentication based on host name, IP address or MAC address. When the Host Type is set as Host Name, input the host name of the authentication-free device. To get the host name of the device, navigate to System Status > Online Devices. Host Name Once the host name is modified, the authentication-free rule will be disabled. To make such a rule effective, manually edit the Host Name here simultaneously.
9.4.3 Add user accounts used for local user authentication You can add user accounts in this page and use it for local user authentication. You are allowed to create a maximum of 300 accounts. Configuration procedure Step 1 Choose Authentication > User Management, and locate the Account Management configuration area. Step 2 Click +Add. Step 3 Set required parameters.
Parameter description Parameter Description User Name Password User Name specifies a user name for captive portal. Password specifies a password for captive portal. If captive portal is enabled, a user must be authenticated with a correct user name and password before accessing the internet. Remark (Optional). It specifies the description of a user account. It specifies the validity of a user account. Valid Duration Valid Time: Specify the validity time by hours.
9.4.4 Export accounts data Step 1 Choose Authentication > User Management, and move to the bottom of the page. Step 2 Click Export. ----End A file named auth_user.csv will be downloaded to your local computer. 9.4.5 Import accounts data A maximum of 300 account data is allowed for importing at one time. Step 1 Choose Authentication > User Management, and move to the bottom of the page. Step 2 Click Browse, select and upload a file that you’ve backed up. A proper file name may be indicated by auth_user.
10 AP mangement The AP management function of the router enables you to manage Tenda APs centrally. The router can only manage Tenda APs. 10.1 Basic settings 10.1.1 Overview To access the configuration page, choose AP Management > Basic Settings. By default, this function is disabled. See the following figure: After the AP Management function is enabled, the following configuration page appears.
within the LAN of the router. Tap to edit more configurations Parameter description Parameter Description Serial number of the wireless policies. WiFi Signal - 1 to 4 policies: Used to apply to 1 to 4 wireless networks of APs - 5 to 8 policies: Used to apply to 5 to 8 wireless networks of APs. Status Used to enable or disable the wireless policy. SSID Used to change the wireless network name. Select a band used by the wireless policy which will be delivered to APs. Frequency - 2.
Parameter Description APs. If a single band is selected in policies 1 to 4, the wireless networks at the other band will be disabled after the policy is delivered to APs. Encryption type of the wireless network. - None: Open wireless network. No password is required when a client connects to the wireless network. To secure the network, this option is not recommended. Encryption Type - WPA_PSK: The wireless network adopts the WPA-PSK authentication method (AES encryption rule).
10.1.2 Distribute wireless policies to APs When wireless policies are distributed to APs that do not support part of the functions, these unsupported policies will still be received but will not take effect. For example, when policies concerning 5G network are distributed to APs that do not support 5G, these policies will be received but will not take effect in these APs. Step 1 Choose AP Management > Basic Settings. Step 2 Change wireless configurations. Step 3 Click Save at the bottom of the page.
10.2 AP settings This function is available only when the AP Management function is enabled on the AP Management > Basic Settings page. To access the configuration page, choose AP Management > AP Settings. You can configure online APs separately, or upgrade, reset, or reboot APs centrally. The first figure below shows how to configure APs separately, while the other figures show how to configure your APs in batch.
Select APs in batch for management Select all APs for management 10.2.1 Upgrade To avoid data loss and device damage, DO NOT remove the power of APs and the router during the upgrade. Step 1 Download the latest firmware of the AP to your local computer. 1. Visit www.tendacn.com, searching the AP model in the searching bar to enter the product details page. 2. Locate the latest firmware, download it to your computer, and unzip it. Step 2 Click AP Management > AP Settings to access the configuration page.
Only APs of the same model can be upgraded in batch. Step 4 Click Browse on the pop-up window, select and upload the firmware that has been downloaded to your computer. Step 5 Click Upload. Wait until the progress bar completes. ---- End 10.2.2 Reset the APs When resetting, do not power off the AP. Step 1 Click AP Management > AP Settings to access the configuration page. Step 2 Select APs you want to reset. You can reset APs one by one, or select multiple APs to reset them in batch.
Step 3 Click Save on the pop-up window. Wait until the progress bar completes. ---- End 10.2.3 Reboot the APs Step 1 Click AP Management >AP Settings to access the configuration page. Step 2 Select APs you want to reboot. You can reboot APs one by one, or select multiple APs to reset them in batch. Click the Reboot button. Step 3 Click Save on the pop-up window. Wait until the progress bar completes.
10.2.4 Delete the APs Step 1 Click AP Management >AP Settings to access the configuration page. Step 2 Select APs you want to delete. You can delete APs one by one, or select multiple APs to delete them in batch. Click the Delete button. Step 3 Click Save on the pop-up window. Wait until the progress bar completes. ---- End 10.2.5 Refresh the page Click the Refresh button to refresh the page.
10.2.6 Export data Use Export Data button if you want to download your APs’ information displayed on the AP Setting page as an Excel document to your local computer. Step 1 Click AP Management >AP Settings to access the configuration page. Step 2 Click the Export Data button. Step 3 Click Save button on the confirm page appears, and then an EXCEL file will be downloaded to your local computer.
10.3 Advanced settings This function is available only when the AP Management function is enabled on the AP Management > Basic Settings page. In this section, you can set up advanced settings for the APs. To access the configuration page, choose AP Management > Advanced Settings. See the following figure: Parameter description 2.4 GHz Advanced Settings / 5 GHz Advanced Settings Parameter Description Country/Region Country or region where this device is located.
Parameter Description You are recommended to keep the default settings. Select the channel bandwidth for the AP. Available options for 2.4 GHz band: Auto (default), 20MHz, and 40MHz. Channel Bandwidth Available options for 5 GHz band: 20MHz, 40MHz, and 80MHz (default). You are recommended to keep the default settings. Channel Specify the channel in which the AP operates. Select one idle channel for less interference.
Parameter Description multimedia packets. By default, this function is enabled. APSD It specifies whether to enable the Automatic Power Save Delivery (APSD) mode. APSD is a WMM power saving protocol created by Wi-Fi Alliance. Enabling APSD helps reduce power consumption. By default, this mode is disabled. It specifies the deployment mode of the router. This parameter is valid only for 2.4 GHz networks. Select a mode that conforms to your application scenario.
11 Filter management 11.1 Overview The router allows you to configure MAC address-based, port-based, and URL-based filter rules to control the access of certain clients to specified pages. 11.2 Configure IP group and time group To access the page for setting IP address groups and time groups, choose Filter Management > IP Group/Time Group. See the following figure. 11.2.1 Configure time groups - By default, there is a time rule named Every Day which cannot be edited or deleted.
Settings configuration area. Step 2 Click +Add. The Add configuration window appears. Step 3 Set the required parameters. - Duplicate group names are not allowed. - 00:00~00:00 indicates a whole day. Step 4 Click Save. ---- End Added successfully. See the following figure.
11.2.2 Configure IP groups Step 1 Choose Filter Management > IP Group/Time Group, and locate the IP Group Settings configuration area. Step 2 Click +Add. The Add configuration window appears. Step 3 Set the required parameters. Duplicate group names are not allowed. Step 4 Click Save. ---- End Added successfully. See the following figure. Click to delete rules in batch Click to delete a single rule Click to select all Click to modify An IP address group that is in use cannot be deleted.
11.3 MAC address filter This is a time group-related function. You can create MAC address-based rules to decide whether or not clients can access the internet through the router on what time. 11.3.1 Configure the MAC address filter Before you start Set up at least one time group rule. The default time group name is Every Day. Configuration procedure Step 1 Choose Filter Management > MAC Address Filter. Step 2 Enable this function, and click Save. Step 3 Configuring MAC address filter rule(s). 1.
2. Set the required parameters. 3. Click Save. ---- End Added successfully. See the following figure: 11.3.2 Example of configuring MAC address filter rule(s) Networking requirement An enterprise uses the router to set up a LAN to address the following requirement: During business hours (08:00 to 18:00 on weekday), only the purchaser is allowed to access the internet. Assume that the MAC address of the purchaser’s computer is CC:3A:61:71:1B:6E. Solutions The MAC address filter can meet this requirement.
Step 2 Set an MAC address filter rule. 1. Choose Filter Management > MAC Address Filter, enable this function, and click Save. 2. Click +Add. The Add window appears. 3. Set the required parameter, and click Save. See the following figure. You are recommended to enter a brief description on the rule in Remark field for later management. 4. Deselect Allow clients with disabled status or clients not on the list to access the internet through this device. 5.
11.4 IP address filter This is a time group-related function. You can create IP address-based rules to decide whether or not clients can access the internet through the router during certain period of time. 11.4.1 Configure the IP address filter Before you start Set up at least one time group rule. Set up at least one IP group rule. To make IP address-based filter rules always take effect, specify a static IP address for the clients.
1. Click +Add. The Add configuration window appears. 2. Set the required parameters. 3. Click Save. ---- End Added successfully. See the following figure: 11.4.2 Example of configuring IP address filter rule(s) Networking requirement An enterprise uses the router to set up a LAN to address the following requirement: During business hours (08:00 to 18:00 on weekday), only the purchaser is allowed to access the internet. Assume that the IP address of the purchaser’s computer is 192.168.8.217.
Configuration procedure Step 1 Specify a static IP address for the purchaser’s computer, which is 192.168.8.217 in this example. Refer to Address reservation for detailed description of configuration procedure. Step 2 Set up a time group. 1. Choose Filter Management > IP Group/Time Group. 2. Set a time group shown in the following figure. Step 3 Set up an IP group. 1. Choose Filter Management > IP Group/Time Group, and locate the IP Address Settings. 2. Set an IP group shown in the following figure.
Step 4 Set IP address filter rule(s). 1. Choose Filter Management > IP Address Filter. 2. Enable this function, and click Save. 3. Click +Add. The Add window appears. 4. Set required parameter, and click Save. 5. Deselect Allow clients with disabled status or clients not on the list to access the internet through this device. 6. Click Save at the bottom of the page to apply your settings. ---- End Verification During 08:00 to 18:00 on weekdays, only the purchaser’s computer can access the internet.
11.5 Port filter The protocols of various services available over the internet use dedicated port numbers. The common service port numbers range from 0 to 1023 and are generally assigned to specific services. A port filter prevents LAN users from accessing certain internet services by disabling the users to access the port numbers of the services. To access the page for setting the port filter, choose Filter Management > Port Filter. By default, this function is disabled.
Repeat the port number in the second box. For example, to add the port number 80, enter 80 in the first box. Then repeat it in the second box. To add consecutive port numbers: Enter the start port number in the first box, and the end port number in the second box. The start port number cannot be greater than the end port number. To add inconsecutive port numbers: The router does not support adding inconsecutive port numbers with one rule.
11.5.2 Example of configuring port filter rules Networking requirement An enterprise uses the router to set up a LAN to address the following requirement: During business hours (08:00 to 18:00 on weekday), computers with IP addresses ranging from 192.168.0.2 to 192.168.0.100 are not allowed to browse web pages. The default port number of the web service is 80. Solutions The port filter function of the router can meet this requirement. Configuration procedure Step 1 Set up a time group. 1.
examples: - To add consecutive port numbers, enter the start port number in the first box, and the end port number in the second box. The start port number cannot be greater than the end port number. - The router does not support to add inconsecutive port numbers with one rule. Therefore, to add inconsecutive port numbers, add multiple port number rules that include your requirement. 5. Click Save.
11.6 URL filter An URL filter prevents LAN users from accessing specified types of website and controls internet accessibility of LAN users so that they will not spend time on websites irrelevant to their duties. Before you add web filter rules, add web categories. To access the following page, choose Filter Management > URL Filter. By default, this function is disabled. Once it is enabled, the following page appears. 11.6.1 Configure URL filter Before you start Set up at least one time group rule.
2. Click New. The Add window appears. 3. Set the required parameters by following the on-screen instructions, and click Save. The added URL groups are shown as follows: - To delete an URL group, move the mouse pointer to it, and click the - A rule in use cannot be deleted. Step 3 Configure an URL filter rule. 1. Click +Add. The Add window appears. 112 on the upper left corner.
2. Set the required parameters, and click Save. ---- End Added successfully. See the following figure: 11.6.
During business hours (08:00 to 18:00 on weekday), staffs are not allowed to access social medias including Facebook, YouTube, and Tumblr. Solutions The URL filter can meet this requirement. Configuration procedure Step 1 Set up time groups and IP groups. 1. Choose Filter Management > IP Group/Time Group. 2. Set up a time group from 08:00 to 18:00 on weekday, and an IP groups ranging from 192.168.0.2 to 192.168.0.100.
3. Set the required parameters. See the following figure. 4. Click Save. Step 4 Configure the URL filter rule. 1. Back to the URL filter configuration page, click +Add. The Add window appears. 2. Set the required parameters, and click Save.
Added successfully. See the following figure: Verification During 08:00 to 18:00 on weekdays, clients with the IP address ranging from 192.168.0.2 to 192.168.0.100 cannot access Facebook, YouTube, and Tumblr.
12 More settings This chapter describes how to modify LAN settings and WAN parameters, how to configure static router, port mirroring, DDNS, port forwarding, UPnP, DMZ host, and how to establish VPN connections. 12.1 LAN settings You can view and modify the LAN IP address of the router, and configure DHCP server here. To enter the configuration page, choose More > LAN Settings. 12.1.1 Modify LAN IP address of the router The LAN IP address is also the login IP address of the router.
Step 2 Click Save, the following message appears. Step 3 Click Save. ---- End Wait until the progress bar completes. You will be redirected to the login page. Use the new LAN IP address to log in to the web UI of router later. 12.1.2 Modify DHCP server DHCP server can automatically assign IP addresses, subnet mask, gateway and other internet parameters to devices connected to the router.
With this function enabled, IP address-based functions, such as port forwarding and IP address filter may be affected.
12.2 WAN parameters 12.2.1 Overview If you have set internet connection parameters but your LAN devices cannot access the internet, try modifying WAN port parameters here. To access the configuration page, choose More > WAN Parameters.
12.2.2 WAN speed The speed of an Ethernet physical port is determined through negotiation with its peer device. The negotiated speed can be any speed within the interface capability. You can try to modify the speed and duplex mode when network connection issues occur. Duplex modes supported by the router and their scenarios: Speed and Duplex Applicable scenario The duplex mode of the port is determined through auto negotiation between the router and its peer device.
12.2.3 MTU MTU is abbreviated for Maximum Transmission Unit. It specifies the maximum size of a packet that can be transmitted by a network device. Either larger or smaller MTU value affects the network performance. Do not modify the default settings unless the following situations happen: Some websites are inaccessible, or secure websites cannot be displayed properly, such as online banking websites, or PayPal. Email service suspends, or servers, such as FTP/POP servers, are inaccessible.
Parameter description Parameter Description Current MAC It specifies the MAC address the router currently used. It specifies the MAC address of the router itself. Default MAC - You can view the MAC address of the router on LAN port status page, or the Label on the bottom of your router. - If you clone the local host MAC, the MAC address of the router is changed to the MAC address you cloned. It specifies the MAC address of the computer that can access the internet normally.
12.3 Configure static route 12.3.1 Overview Routing is an operation to select the optimal route for delivering data from a source to a destination. A static route is a special route configured manually, which is simple, efficient, and reliable. Proper static routes help reduce route selection issues and prevent overload caused by route selection data flows, accelerating packet forwarding.
Parameter Description Interface Port through which packets are forwarded. 12.3.2 Configure a static routing rule Step 1 Choose More > Static Routing and click +Add. The Add configuration window appears. Step 2 Set the parameters and click Save. Step 3 Choose More > Static Routing and view the added static route. The available static routes are displayed on the static routing page. See the following figure.
In the route table, the record where Destination Network and Subnet Mask are 0.0.0.0 indicates the default route of the router. If no route exactly matching the destination address of a packet is found in the route table, the router uses the default route to forward the packet. The route containing the gateway IP address 0.0.0.0 is a direct route, which means that the destination network is directly connected to the router using the port specified in the route.
Step 2 Configuring static routing rules. 1. Navigate to System Status to view the default gateway of WAN2 port, which is 192.168.98.1 in this example. 2. Click More > Static Routing, and click +Add. The Add configuration window appears. 3. Set the parameters and click Save.
Added successfully. See the following figure: Verification Computers in the LAN can access the internet and the intranet simultaneously. - If the enterprise LAN is connected to the internet, the router may point its default route to the other router, resulting in incorrect routing. In this case, navigate to Bandwidth Control and set Upload/Download Rate of the WAN2 port to a value far smaller than the value of the WAN1 port.
12.4 Port mirroring 12.4.1 Overview Port mirroring function forwards a copy of data of one or more mirrored ports to the specified mirroring port. The network administrator uses data monitoring devices to monitor traffic, analyze performance and perform network diagnose. By default, this function is disabled.
12.4.3 Example of configuring port mirroring Networking requirement An enterprise has used the router to set up a LAN. Recently, internet access failures occur frequently and the network administrator needs to capture data packets from the WAN and LAN ports of the router for analysis. Solutions The port mirroring function of the router can meet this requirement. Router Data monitoring device Configuration procedure Step 1 Choose More > Port Mirroring to access the configuration page.
Step 4 Click Save to apply your settings. ---- End Verification Run monitoring software such as Wireshark on the monitoring computer to verify the software can capture data packets from the mirrored ports.
12.5 Manage your router remotely using web UI 12.5.1 Overview Generally, the web UI of the router can only be accessed on devices that are connected to the router in wired or wireless manner. This costs in case of seeking technician to fix network problems. The remote web management function is designed to address such requirement. When you encounter network faulty, you can ask technician far away to diagnose and fix your problems, improving efficiency and reducing costs and efforts.
- Any IP: It indicates that all internet users can access the web UI of the router with the Remote Access Address here. For security of your network, select this option only when necessary. - Specified IP: It indicates that only the host with the specified public IP address is allowed to access the web UI of router remotely. - If the computer for remote access is in an intranet, enter the public IP address of the computer’s gateway here. Step 4 Click Save to apply your settings.
12.5.3 Example of conifguring remote web management Networking requirement An enterprise uses the router to deploy its network. And its network administrator needs to seek a Tenda technician to solve a problem remotely. Solutions Remote web management function can meet this requirement. Router Technician IP: 202.105.88.77 Configuration procedure Step 1 Click More > Remote WEB Management, and enable this function. Step 2 Select the WAN port for remote access, which is WAN2 in this example.
Step 5 Click Copy and send the Remote Access Address to the Tenda technician. ---- End Verification Tenda technician with a computer IP address 202.105.88.77 can use http://e9leofi8.cloud.tendacn.net:8080 to access the web UI of the router remotely.
12.6 DDNS 12.6.1 Overview DDNS is short for Dynamic Domain Name Server. It detects when your IP address changes and maps your dynamic IP address to a static domain name. When the service is running, the DDNS client on the router sends its current WAN port IP address to the DDNS server. Then the server updates the mapping between the domain name and the IP address in the database to implement dynamic domain name resolution.
Parameter Description Password It specifies the password used to log in to a DDNS provider. Domain Name It specifies the domain name obtained from a DDNS provider. Status It specifies the DDNS service status. 12.6.2 Configure DDNS - A dynamic IP address will disable the port forwarding rule. To use this function and make the rule always effective, set a static IP address for the specified local host.
12.6.3 Example of configuring DDNS Networking requirement An enterprise uses the router to deploy its WLAN network. The router is connected to the internet. Now the enterprise establishes a web server and wants to be accessed by internet users. Thus when employees are not in the enterprise, they can also access the web server. Assume that the external port is 80. Solutions You can use Port Forwarding and DDNS function to meet this requirement. Router Internet user Web server IP: 192.168.0.
Step 2 Configuring DDNS. 1. Register a domain name. Select the DDNS provider from the drop-down list menu, which is noip in this example, and click Register next to the menu to register a domain name. 2. Set DDNS parameters. (1) Log in to the web UI of the router, navigate to More > DDNS, and enable WAN1 port’s DDNS function. (2) Enter the DDNS-related parameters you registered on your DDNS provider’s website.
Wait a moment, and refresh the page. When the Status shows Connected, the configuration completes successfully. Verification Internet users can use http://itenda.ddns.net:80 to access the web server. Among which: - http indicates intranet service protocol name. - itenda.ddny.net is the domain name you registered on your DDNS provider’s website. - 80 is the external port number.
12.7 Port forwarding 12.7.1 Overview By default, internet users cannot access any service on any of your local hosts. If you want to enable internet users to access a particular service on a local host, enable this function and specify the IP address and service port of the local host. This can also prevent local network from being attacked. To access the configuration page, choose More > Port forwarding.
12.7.2 Configure a port forwarding rule - A dynamic IP address will disable the port forwarding rule. To use this function and make the rule always effective, set a static IP address for the specified local host. - Some programs, such as firewall, antivirus software, and security guard, may hinder internet users to access the local service. Disable them when necessary. Step 1 Choose More > Port Forwarding to enter the configuration page. Step 2 Click +Add. The Add configuration window appears.
12.7.3 Example of configuring a port forwarding rule Networking requirement An enterprise uses the router to deploy its WLAN network. The router is connected to the internet. Now the enterprise establishes a web server and wants to enable its employees to access the web server through the internet. Solutions You can use the port forwarding function to meet this requirement. Router Internet user WAN1 IP: 202.105.11.22 Web server IP: 192.168.8.
Step 4 Click Save to apply your settings. ---- End Added successfully.
Verification Internet users can use http://202.105.11.22:80 to access the web server. Among which: - http indicates intranet service protocol name. - 202.105.11.22 is the WAN1 IP address. - 80 is the external port number. In addition, If the corresponding WAN port is configured with DDNS, you can use intranet service protocol name://domain name:external port to access the web server.
12.8 DMZ host 12.8.1 Overview By default, internet users cannot access any service on any local host. If you want internet users to access all services on a local host, enable this function. It is especially used for video conferences and online games. You can set a local computer running these programs to be a DMZ host for better video conferencing and online gaming experience.
12.8.2 Configure DMZ host - A dynamic IP address will disable the port forwarding rule. To use this function and make the rule always effective, set a static IP address for the specified local host. - Some programs, such as firewall, antivirus software, and security guard, may hinder internet users to access the local service. Disable them when necessary. Step 1 Choose More > DMZ Host, and enable this function of the corresponding WAN port. Step 2 Enter the IP address of the DMZ Host.
12.8.3 Example of configuring DMZ host Networking requirement An enterprise uses the router to deploy its WLAN network. The router is connected to the internet. Now the enterprise establishes a web server and wants to enable its employees to access the web server through the internet. Solutions You can use the DMZ function to meet this requirement. Router Internet user WAN1 IP: 202.105.11.22 Web server IP: 192.168.8.
Step 4 Click Save to apply your settings. ---- End Verification Internet users can use http://202.105.11.22:80 to access the web server. Among which: - http indicates intranet service protocol name. - 202.105.11.22 is the WAN1 IP address. - 80 is the external port number. In addition, If the corresponding WAN port is configured with DDNS, you can use intranet service protocol name://domain name:external port to access the web server.
12.9 UPnP UPnP is short for Universal Plug and Play. After you enable this function, the router can detect UPnP-based application programs on local computers and map onto the ports of the programs automatically. In this way, internet users can access these programs. It is generally used for P2P programs, such as BitComet and AnyChat, and helps to increase the download speed. By default, this function is disabled. Choose More > UPnP, and enable this function, the following figure appears.
12.10 Any IP This function is typically used in public spaces, such as at a hotel. With this function enabled, devices with any IP address can access the internet through the router. This function cannot be enabled if Captive Portal is configured.
12.11 Security settings The router supports ARP defense DDoS defense, IP attack defense, and Block WAN ping. ARP defense Parameter description Parameter Description ARP Defense It is used to efficiently prevent the ARP attack from the local network. ARP Broadcast Interval It specifies the interval for sending ARP inquiry messages. Default: 1 second.
IP attack defense Parameter description Parameter Description IP Timestamp Option It is used to block IP packets that contain the Internet Timestamp option. IP Security Option It is used to block IP packets that contain the Security option. IP Stream Option It is used to block IP packets that contain the Stream ID option. IP Record Route Option It is used to block IP packets that contain the Record Route option.
12.12 VPN server 12.12.1 Overview The router supports PPTP server and L2TP server. To enter the configuration page, choose More > VPN Server. See the following figure. Parameter description Parameter Description VPN Server It is used to enable or disable the PPTP/L2TP VPN server function. It specifies the VPN server type that the router supports, including: Server Type - PPTP: The Point to Point Tunneling Protocol. If PPTP is selected, the peer VPN client should be set to PPTP client.
Parameter Description Max. Users It specifies the maximum number of VPN clients allowed to be connected to the PPTP/L2TP server. The value is fixed to 32. User Name It specifies the user name and password used to dial in a PPTP/L2TP VPN connection. Password Network Users It specifies the password for the user name used to dial in PPTP/L2TP VPN connection. It specifies whether a VPN client is a network. Network Segment - Yes: The network segment and subnet mask of the VPN client are required.
12.12.2 Configure the router as a PPTP/L2TP VPN server To establish a VPN connection, the VPN server and VPN client should be configured consistently on Client Type, WAN and Encryption. Step 1 Enable the PPTP/L2TP server function. 1. Choose More > VPN Server, enable VPN Server, and click Save. 2. Set the VPN server to PPTP or L2TP as required. The peer VPN client should use the same type. 3. Select the egress WAN port of the tunnel between a PPTP/L2TP server and PPTP/L2TP clients.
3. Set required parameters, and click Save. ---- End Added successfully.
12.13 VPN client 12.13.1 Overview To enter the configuration page, choose More > VPN Client. By default, this function is disabled. After you enable the function, the following page appears. Parameter description Parameter Description VPN Client It is used to enable or disable the PPTP/L2TP VPN client function. It specifies the VPN client type that the router supports, including: Client Type - PPTP: The Point to Point Tunneling Protocol.
Parameter Description User Name It specifies the user name and password used to dial in a PPTP/L2TP VPN connection. Password It specifies whether to enable 128-bit data encryption. This parameter only appears when PPTP is selected. Encryption The value of this parameter must be consistent with that of the client. Otherwise, the client is unable to communicate with the server. VPN Proxy With this function enabled, clients access the internet through the peer router that has established a VPN server.
12.14 IPSec 12.14.1 Overview IPSec, abbreviated for Internet Protocol Security, is a protocol suite for transmitting data over the internet in a secure and encrypted manner. The following terms will be used in this document to describe IPSec configurations. Encapsulation Mode The router uses either Tunnel mode or Transport mode to encapsulate IP packets. Tunnel Mode: It is most commonly used between security gateways. Transport Mode: It is mainly used for end-to-end communications.
Configuring Tunnel mode Step 1 Choose More > IPSec. The following page appears. Step 2 Click + Add. The configuration page appears. Step 3 Tick Enable beside the IPSec option. Step 4 Select the WAN port. Step 5 Select Tunnel from the Encapsulation Mode drop-down list menu. Step 6 Set required parameters, and click Save to apply your settings.
Parameter description Parameter Description IPSec It is used to enable or disable the IPSec function. WAN It specifies the WAN port of the IPSec connection on this end. The remote gateway of the IPSec peer should be the IP address of the WAN port you specified here. The router uses either of the following to encapsulate IP packets. Encapsulation Mode - Tunnel Mode: It is most commonly used between security gateways. - Transport Mode: It is mainly used for end-to-end communications.
Key negotiation: Auto Negotiation To protect information confidentiality when using auto negotiation, IKE is in place to negotiate keys for secure communication between IPSec peers. The IKE protocol is a hybrid of three other protocols: - ISAKMP: Internet Security Association and Key Management Protocol. It defines the procedures for authenticating a communicating peer, creation and management of Security Associations, key generation techniques, and threat mitigation.
Clicking Advanced loads the following configuration area: Parameter description Parameter Description It specifies the two periods that the IKE SA (IKE Security Association that is broken down. Period 1/2 The router does not support IKEV2.0. It specifies the mode that IPSec ends use to exchange information in Period 1. Mode - Main: This mode requires double messages to be exchanged in Period 1, which provides higher security but lower efficiency.
Parameter Description message tampering, leading to higher security than MD5. Diffle-Hellman Group Group information for the Diffie-Hellman algorithm for generating a session key used to encrypt an IKE tunnel. The information should be the same as that of the remote gateway. Key Expiration It specifies the life cycle of IKE SA. The default time is 3600 seconds. The minimum time is 600 seconds. When 540 seconds are left, IKE SA will be negotiated again.
Parameter Description hexadecimal characters is required. - AES-192: A 192-bit key is used for encryption. A key of 24 ASCII characters or 48 hexadecimal characters is required. - AES-256: A 256-bit key is used for encryption. A key of 32 ASCII characters or 64 hexadecimal characters is required. ESP Encryption Key This parameter should be the same for IPSec peers. Optional service to ensure the integrity of data packets.
Step 2 Click + Add. The configuration page appears. Step 3 Tick Enable beside the IPSec option. Step 4 Select the WAN port. Step 5 Select Transport from the Encapsulation Mode drop-down list menu. The following page appears.
Step 6 Set required parameters, and click Save to apply your settings. ---- End Parameter description Parameter Description IPSec It is used to enable or disable the IPSec function. WAN It specifies the local WAN port assigned to the IPSec function. The IP address of the WAN port must be set as the value of Remote Gateway of the IPSec peer. The router supports two modes: Encapsulation Mode - Tunnel Mode: It is most commonly used between gateways.
12.15 Example of configuring VPN conenctions 12.15.1 Example of configuring a PPTP/L2TP VPN Networking requirement An enterprise has used the router to set up a LAN and access the internet. Branch employees need to access the HQ's internal resources through the internet, such as internal data, OA, ERP, CRM, project management systems. Solutions PPTP/L2TP VPNs of the router can address this requirement. The following uses PPTP to illustrate the setup procedure. Set up the L2TP VPN in the same way.
Step Task Description 4 Verify the connectivity between the VPN server and VPN client Check if VPN connection is established and access HQ LAN resources using VPN. Configuration procedure Step 1 Configure Router_HQ as a VPN server. 1. On Router_HQ, choose More > VPN Server, enable this function, and click Save. 2. Set Client Type to PPTP. 3. Set the egress port of the VPN server for setting up a tunnel with the VPN client, which is WAN1 in this example. 4. Set Encryption to Enable.
3. Set the required parameters. The following shows the examples: Remark is optional. However, you are recommended to add a brief description of the rule for convenient management later, which is Branch_01 in this example. 4. Click Save. Added successfully. See the following figure: Step 3 Configure Router_Branch as a VPN client. 1. On Router_Branch, choose More > VPN Client, and enable this function. 2. Set required parameters. The parameters should keep consistent with the VPN server.
User name/Password: Branch_HQ/12345678 Remote LAN: 192.168.6.0 Remote Subnet Mask: 255.255.255.0 3. Disable VPN Proxy. 4. Click Save to apply your settings. ---- End Verification Step 1 Check if the VPN connection is established. There are two methods for checking whether or not the VPN connection is established.
Method 2: Log in to the web UI of Router_Branch, choose More > VPN Client, the Status changes into Connected, indicating the VPN connection is established. Step 2 Access HQ LAN resources remotely. ---- End After the preceding configuration, employees at the branch and HQ can remotely access resources on the branch and HQ LANs through the internet in a secure manner. The following is an example of how the employees at branch access the FTP server at the headquarters.
Step 2 In the popup window, enter login User name and Password, which are both admin in this example, and click Log On. ---- End Access the HQ LAN resources successfully.
12.15.2 Example of configuring an IPSec VPN Networking requirement An enterprise has used the router to set up a LAN and access the internet. Branch employees need to access the HQ's internal resources through the internet, such as internal data, OA, ERP, CRM, project management systems. Solutions You can set up an IPSec VPN using the router to meet this requirement.
Key negotiation method: Auto Negotiation Pre-shared key: 12345678 Step 1 Configure Router_HQ the IPSec connection. 1. Choose More > IPsec, and click +Add, the configuration page appears. 2. Set required parameters. (1) Select the WAN port enabled with IPSec, which is WAN1 in this example. (2) Select Tunnel from the Encapsulation Mode drop-down list menu. (3) Customize a Connection Name, which is IPSec_1 in this example.
To configure advanced settings, click Advanced. And use the same configurations to set the peer device. Step 2 Configure Router_Branch. 1. Log in to the web UI of the router Router_Branch. 2. Choose More > IPsec, and click +Add. The Add configuration page appears. 3. Set required parameters. (1) Select the WAN port enabled with IPSec, which is WAN1 in this example. (2) Keep Encapsulation Mode, Connection Name, Tunnel Protocol, Key Negotiation, and Pre-shared Key identical with its peer Router_HQ.
Added successfully. See the following figure. Verification When the IPSec Status of both ends shows Connected, the IPSec VPN is established successfully. Then, employees at the branch and HQ can remotely access LAN resources on the other side through the internet in a secure manner.
12.15.3 Example of configuring a L2TP over IPSec VPN Networking requirement An enterprise has used the router to set up a LAN and access the internet. Employees of its branch must be allowed to access, through the internet, the HQ’s resources over the HQ LAN in a secure manner, including internal resources as well as the OA, ERP, CRM, and project management systems. Solutions You can set up an L2TP over IPSec VPN using the router to meet this requirement. Network topology Router Staff on travel IP: 202.
Pre-shared Key: 87654321 Step 1 Configure IPSec connection. 1. Choose More > IPsec, and click +Add. The Add configuration page appears. 2. Set required parameters. Configurations on the following figure are only used for examples. (1) Set IPSec to Enable. (2) Set Encapsulation Mode to Transport. (3) Set WAN to the WAN port bound to the IPSec tunnel, which is WAN1 in this example. (4) Set Connection Name to the name of the IPSec tunnel, which is HQ in this example. (5) Set Pre-shared Key to 87654321.
2. Click +Add. The Add configuration window appears. 3. Set required parameters. Configurations on the following figure are only used for examples. 4. Click Save. ---- End Added successfully. See the following figure. Verification To access the HQ LAN resources, you have to configure your client. The document introduces how to create VPN dialing on Windows 7 and iOS. Choose the scenario according to your actual situations. Create VPN connection on Windows 7. Step 1 Create VPN connections.
1. Click in the lower right corner of the desktop, click Open Network and Sharing Center. 2. Click Set up a new connection or network. 3. Click Connect to a workplace, then click Next.
4. Click Use my internet connection (VPN). If any other window pop up, follow the on-screen instructions. 5. Set the IP address of the L2TP server, which is 192.168.20.62 in this example. Then click Next.
6. Set the User name to Tom, and password to Tom123. Then click Connect. 7. Wait for a moment to establish a connection.
Step 2 Set VPN connection parameters. 1. Click in the lower right corner of the desktop, choose Open Network and Sharing Center, click Change adapter settings, right click on VPN connection, and choose Properties. 2. Click Security tab, in the Type of VPN section, choose Layer 2 Tunneling Protocol with IPsec (L2TP/IPSec) and click Advanced settings.
3. Click Use preshared key for authentication, and set the Key to 87654321. 4. Click OK. 5. It redirects to the properties page of VPN Connection, tick Unencrypted password (PAP). Then click OK.
Step 3 Create VPN dialing. 1. Go to Network and Sharing Center page, right click VPN Connection, and click Connect. 2. Enter User name to Tom, Password to Tom123, and click Connect.
Wait for a moment to establish a connection. Step 4 Create VPN connection on a mobile device (Example: iOS). 1. Tap on the Settings page. 2. Tap VPN.
3. Tap Add VPN Configuration. 4. Set required parameters. (1) Set Type to L2TP. (2) Set Description to the name of the VPN connection, which is HQ in this example. (3) Set Server to the IP address of L2TP server, which is 192.168.20.62 in this example. (4) Set Account to the user name used to connect the VPN client to the VPN server, which is Tom in this example. (5) Set Password to the password for the user name, which is Tom123 in this example.
Wait for a moment. When the Status turns to Connected created successfully. , the IPSec connection is Step 5 Accessing HQ data for employees on business trip. Here takes accessing web server of HQ as an example. The project data of the HQ is stored on the FTP server. Assume that the server information is as follows: FTP server IP address: 192.168.0.223 Server port: 8080 1. Open a web browser, access the website ftp://192.168.0.223:8080. 2.
12.16 Multi-WAN policy 12.16.1 Overview The router has 1 WAN port by default but allows a maximum of 3 WAN ports. When multiple WAN ports are operating at the same time, an appropriate multi-WAN policy can greatly improve the bandwidth usage of the router.
Parameter Description detection address. - Detection Address: The IP address or domain name to detect. - Detection Interval: The interval of detection, it is 5 minutes by default. 12.16.3 Customize a multi-WAN policy Before you start Configure the following parameters first: IP group(s): Choose Filter Management > Time group/IP group for settings. Bandwidth upload/download rate: Choose Bandwidth Control, and locate the corresponding WAN port for settings.
12.16.4 Example of customizing a multi-WAN policy Networking requirement An enterprise has used the router to set up a LAN. To meet its internet access requirement, the enterprise has set up two broadband connections with two different ISPs and can now access the internet properly. To achieve load balancing, the enterprise raises the following LAN requirements: The computers with IP addresses ranging from 192.168.0.2 to 192.168.0.
3. Click +Add, and set the rules shown in the following figure. ---- End Verification The computers with IP addresses ranging from 192.168.0.2 to 192.168.0.100 can access the Internal through the fixed-line broadband connection with ISP A. The computers with IP addresses ranging from 192.168.0.101 to 192.168.0.250 can access the Internal through the mobile broadband connection with ISP B.
13 Maintenance This chapter describes how to reboot, reset, and upgrade the router, how to modify the login password, how to back up your current configuration and restore the router to previous configuration, how to view the system logs and functions that are enabled or disabled, how to set up system time, and how to use the Ping and Traceroute commands. 13.1 Reboot the router 13.1.
Step 3 Click Save to apply your settings. ---- End The router performs rebooting regularly on the time and date you set here.
13.2 Upgrade 13.2.1 Overview The router supports local and online upgrades. Choose Maintenance > Upgrade to enter the configuration page. See the following figure: 13.2.2 Upgrad the rotuer manually - To enable your router to work properly after an upgrade, ensure that the firmware used to upgrade complies with your Model. - When upgrading, do not power off the router. Step 1 Download the upgrade file to your local computer. 1. Visit www.tendacn.
Step 5 Click Upgrade. Wait until the progress bar completes. If upgrade does not apply, reset the router. Back up your configurations properly before reset. 13.2.3 Upgrad the rotuer automatically When the router is connected to the internet, it checks whether there is a later firmware version, and displays the detected information on the page. You can choose whether to upgrade the firmware with the latest version. If you want to upgrade the firmware, click Upgrade.
13.3 Reset 13.3.1 Overview If the internet is inaccessible for unknown reasons, or you forget the login password, you can reset the router to resolve the problems. The router supports two resetting methods: Reset the router using web UI. Reset the router using the reset button. 13.3.2 Reset the router using web UI - Resetting the router deletes all your current configurations and you need to reconfigure the router to access the internet.
13.4 Password manager 13.4.1 Overview The router supports two account types: Administrator and Authentication. The difference between them is their access permission. The Administrator account enjoys all access permission. Password for Administrator account is the login password you set during initial setup. You can view and modify it here. The Authentication account only has permission for accessing System Status and Authentication modules. The default password for this account is rzadmin.
13.5 Backup/Restore 13.5.1 Overview The backup function is used to export the current configuration of the router to your computer. The restore function is used to import a configuration file to the router. You are recommended to back up the configuration after it is significantly changed. When the performance of your router decreases because of an improper configuration, or after you restore the router to factory settings, you can use this function to restore a configuration that has been backed up.
13.6 System log System logs record information about system running status and the operation you performed on it. When system malfunctions occur, you can use system log for troubleshooting. To enter the configuration page, click Maintenance > System Log. 13.6.1 View system log - System logs will be cleared each time the router reboots or resets. - A maximum of 300 logs will be recorded. - The system only keeps 300 logs that are generated the most recently.
The router records three log types: System Log, Attack Log, and Error Log. You can view all logs or filter the logs to view as needed. 13.6.2 Export system log Click Export Log, the log file will be downloaded to your local computer.
13.7 Diagnostic tool 13.7.1 Overview You can execute Ping/Traceroute command on this page. Ping: Used to check whether the connection is correct and the connection quality. Traceroute: Used to detect the route from the bridge to the destination IP address or domain name. To access the configuration page, click Maintenance > Diagnosis Tool. 13.7.2 Execute Ping command to detect connection quality Assume that: You need to detect the connectivity between the router and the Bing website.
Step 6 Click Start. ---- End Wait a moment. The ping result will be displayed in the result box. See the following figure: 13.7.3 Execute Traceroute command to detect the route selection Assume that: You need to detect the path from the router to Bing website. Step 1 Click Maintenance > Diagnosis Tool to enter the configuration page. Step 2 Select Traceroute from the drop-down list menu of the Tools menu. Step 3 Enter the IP address or domain name of the traceroute target, which is cn.bing.
Step 4 Click Start. ---- End Wait a moment. The traceroute result will be displayed in the result box. See the following figure: Click Stop to end the process as needed.
13.8 System time 13.8.1 Overview This function is used to set the system time of your router. To make the time-related functions effective, ensure that the system time of the router is set correctly. The router supports: Synchronize with internet time (default) Set system time manually To access the configuration page, click Maintenance > System Time. See the following figure: 13.8.
Parameter description Parameter Description Sync Interval It specifies an interval at which the router synchronizes its system time with the time server on the internet. By default, the router performs synchronization every 0.5 hours. Time Zone It specifies the time zone where the router is deployed. After configuration, navigate to the System status page to check whether it is synchronized. 13.8.3 Set system time manually With this method, you can manually specify a system time for the router.
13.9 Function center The function center groups all functions of the router into Enabled Function and Disabled Function, giving you a clearly insight into the functions that are enabled or disabled. In addition, move the mouse pointer to a specific function and click it, you will be taken to the corresponding configuration page.
Appendix Default parameters Parameter Login information Default IP address of the management page 192.168.0.1 Administrator / Authentication management User name rzadmin Password rzadmin IP address 192.168.0.1 Subnet mask 255.255.255.0 DHCP server On Start IP address 192.168.0.100 End IP address 192.168.0.200 Lease time 30 minutes Primary DNS 192.168.0.1 SSID Support three SSIDs, which can be named as Tenda_XXXXXX.
