TL-ER604W Wireless N Gigabit Broadband VPN Router REV1.2.
COPYRIGHT & TRADEMARKS Specifications are subject to change without notice. is a registered trademark of TP-LINK TECHNOLOGIES CO., LTD. Other brands and product names are trademarks or registered trademarks of their respective holders. No part of the specifications may be reproduced in any form or by any means or used to make any derivative such as translation, transformation, or adaptation without permission from TP-LINK TECHNOLOGIES CO., LTD. Copyright © 2015 TP-LINK TECHNOLOGIES CO., LTD.
Any changes or modifications not expressly approved by the party responsible for compliance could void the user’s authority to operate the equipment. Note: The manufacturer is not responsible for any radio or TV interference caused by unauthorized modifications to this equipment. Such modifications could void the user’s authority to operate the equipment. FCC RF Radiation Exposure Statement: This equipment complies with FCC RF radiation exposure limits set forth for an uncontrolled environment.
第十二條 經型式認證合格之低功率射頻電機，非經許可，公司、商號或使用者均不得擅自 變更頻率、加大功率或變更原設計之特性或功能。 第十四條 低功率射頻電機之使用不得影響飛航安全及干擾合法通行；經發現有干擾現象時， 應立即停用，並改善至無干擾時方得繼續使用。前項合法通信，指依電信規定作業之無線電 信。低功率射頻電機需忍受合法通信或工業、科學以及醫療用電波輻射性電機設備之干擾。 減少電磁波影響，請妥適使用。 安全諮詢及注意事項 ●請使用原裝電源供應器或只能按照本產品注明的電源類型使用本產品。 ●清潔本產品之前請先拔掉電源線。請勿使用液體、噴霧清潔劑或濕布進行清潔。 ●注意防潮，請勿將水或其他液體潑灑到本產品上。 ●插槽與開口供通風使用，以確保本產品的操作可靠並防止過熱，請勿堵塞或覆蓋開口。 ●請勿將本產品置放於靠近熱源的地方。除非有正常的通風，否則不可放在密閉位置中。 ●請不要私自打開機殼，不要嘗試自行維修本產品，請由授權的專業人士進行此項工作。 此為甲類資訊技術設備，于居住環境中使用時，可能會造成射頻擾動，在此種情況下，使用 者會被要求採取某些適當的對策。 Продукт сертифіковано згід
Avoid water and wet locations.
CONTENTS Package Contents .................................................................................................................. 1 Chapter 1 About this Guide ................................................................................................... 2 1.1 Intended Readers ..................................................................................................................2 1.2 Conventions ....................................................................................
3.3.3 3.4 3.5 3.6 3.7 3.8 View .........................................................................................................................55 Advanced .............................................................................................................................56 3.4.1 NAT ..........................................................................................................................56 3.4.2 Traffic Control ......................................................
3.8.6 Time .......................................................................................................................130 3.8.7 Logs .......................................................................................................................132 3.8.8 NAT Table ..............................................................................................................134 Chapter 4 Application.......................................................................................
Package Contents The following items should be found in your package: One TL-ER604W Router One Power Adapter One RJ45 Ethernet Cable Quick Installation Guide Resource CD Note: Make sure that the package contains the above items. If any of the listed items is damaged or missing, please contact your distributor.
Chapter 1 About this Guide This User Guide contains information for setup and management of TL-ER604W router. Please read this guide carefully before operation. 1.1 Intended Readers This Guide is intended for Network Engineer and Network Administrator. 1.2 Conventions In this Guide the following conventions are used: The router or TL-ER604W mentioned in this Guide stands for TL-ER604W SafeStream Wireless N Gigabit Broadband VPN Router without any explanation.
Chapter 2 Introduction Thanks for choosing the SafeStream Wireless N Gigabit Broadband VPN Router TL-ER604W. 2.1 Overview of the Router The SafeStream Wireless N Gigabit Broadband VPN Router TL-ER604W from TP-LINK supports Wireless N speed and Gigabit wired speeds on all ports. It integrates multiple VPN protocols, high-security and high-performance VPN capabilities, making it an ideal choice for branch offices in need of cost-effective secure remote connections to headquarters or remote offices.
+ Featured Attack Defense to protect the network from a variety of flood attack and packet anomaly attack. + Possessing MAC Filtering function to block the access of illegal hosts. ● Flexible Traffic Control + Featured Bandwidth Control with flexible bandwidth management to automatically control the bandwidth of the host in bi-direction to avoid bandwidth over occupation, as well as optimize bandwidth usage. + Supporting Session Limit to avoid the complaint of a few people to force whole sessions.
Basic Functions Supports Static IP, Dynamic IP, PPPoE/Russian PPPoE, L2TP/Russian L2TP, PPTP/Russian PPTP, Dual Access, BigPond Internet connections Supports IPTV Function Supports Virtual Server, Port Triggering, ALG, Static Route and RIP v1/v2 Built-in Switch supporting Port Mirror, Port VLAN, Rate Control and so on Supports to change the MAC address of LAN and WAN port Supports Logs, Statistics, Time setting Supports Remote and Web management Supports SNMP v1/v2c Suppor
Supports IP-MAC Binding Supports GARP (Gratuitous ARP) Deploys One-Click restricting of IM/P2P applications 2.3 Appearance 2.3.1 Front Panel The front panel of TL-ER604W is shown as the following figure. Figure 2-1 Front Panel ● LEDs LED PWR SYS WLAN Status Indication On The router is powered on. Off The router is powered off or power supply is abnormal. Flashing The router works properly. On/Off The router works improperly. On(Green) The wireless function is enabled.
● Wifi button Press this button to enable or disable Wi-Fi. WLAN LED will light up when the wireless function is enabled. 2.3.2 Rear Panel The rear panel of TL-ER604W is shown as the following figure. Figure 2-2 Rear Panel ● Antenna The router provides two external detachable antennas for receiving and transmitting the wireless data. ● POWER The power socket is where you will connect the power adapter.
Chapter 3 Configuration 3.1 Network 3.1.1 Status The Status page shows the system information, the port connection status and other information related to this router. Choose the menu Network→Status→System Status to load the following page. Figure 3-1 Status 3.1.2 System Mode The TL-ER604W can work in three modes: NAT, Non-NAT and Classic. If your router is hosting your local network’s connection to the Internet with a network topology as the Figure 3-2 shows, you can set it to NAT mode.
Figure 3-2 Network Topology - NAT Mode If your router is connecting the two networks of different areas in a large network environment with a network topology as the Figure 3-3 shows, and forwards the packets between these two networks by the Routing rules, you can set it to Non-NAT mode. Figure 3-3 Network Topology – Non-NAT Mode If your router is connected in a combined network topology as the Figure 3-4 shows, you can set it to Classic Mode.
Figure 3-5 System Mode You can select a System Mode for your router according to your network need. NAT Mode NAT (Network Address Translation) mode allows the router to translate private IP addresses within internal networks to public IP addresses for traffic transport over external networks, such as the Internet. Incoming traffic is translated back for delivery within the internal network. However, the router will drop all the packets whose source IP addresses are in different subnet of LAN port.
Figure 3-6 WAN Mode WAN Mode WAN Ports: Select the total number of WAN ports you prefer to use. The router support one WAN and dual WAN. The router will adjust the physical ports accordingly, which can be illustrated on the following port sketch. Note: By default, TL-ER604W is set to work in the mode of dual WAN ports. Any change to the number of WAN ports may lead to a loss of current configurations. Please be sure to back up your configurations in advance. 3.1.3.
Figure 3-7 WAN – Static IP The following items are displayed on this screen: Static IP Connection Type: Select Static IP if your ISP has assigned a static IP address for your computer. IP Address: Enter the IP address assigned by your ISP. If you are not clear, please consult your ISP. Subnet Mask: Enter the Subnet Mask assigned by your ISP. Default Gateway: Optional. Enter the Gateway assigned by your ISP.
2) Dynamic IP If your ISP (Internet Service Provider) assigns the IP address automatically, please choose the Dynamic IP connection type to obtain the parameters for WAN port automatically. Figure 3-8 WAN – Dynamic IP The following items are displayed on this screen: Dynamic IP Connection Type: Select Dynamic IP if your ISP assigns the IP address automatically. Click to get the IP address from your ISP’s server. Click to release the current IP address of WAN port.
Use the following DNS Server: Select this option to enter the DNS (Domain Name Server) address manually. Primary DNS: Enter the IP address of your ISP’s Primary DNS (Domain Name Server). If you are not clear, please consult your ISP. Secondary DNS: Optional. If a Secondary DNS Server address is available, enter it. Upstream Specify the bandwidth for transmitting packets on the port. Bandwidth: Downstream Specify the bandwidth for receiving packets on the port.
3) PPPoE If your ISP (Internet Service Provider) has provided the account information for the PPPoE connection, please choose the PPPoE connection type (Used mainly for DSL Internet service). Figure 3-9 WAN - PPPoE The following items are displayed on this screen: PPPoE Settings Connection Type: Select PPPoE if your ISP provides xDSL Virtual Dial-up connection. Click to dial-up to the Internet and obtain the IP address.
Account Name: Enter the Account Name provided by your ISP. If you are not clear, please consult your ISP. Password: Enter the Password provided by your ISP. Active Mode: You can select the proper Active mode according to your need. PPPoE Advanced Manual: Select this option to manually activate or terminate the Internet connection by the or button. It is optimum for the dial-up connection charged on time. Always-on: Select this option to keep the connection always on.
Connection Type: Select the secondary connection type. Options include Disable, Dynamic IP and Static IP. IP Address: If Static IP is selected, configure the IP address of WAN port. If Dynamic IP is selected, the obtained IP address of WAN port is displayed. Subnet Address: If Static IP is selected, configure the subnet address of WAN port. If Dynamic IP is selected, the obtained subnet address of WAN port is displayed. Status: Displays the status of secondary connection.
4) L2TP If your ISP (Internet Service Provider) has provided the account information for the L2TP connection, please choose the L2TP connection type. Figure 3-10 WAN - L2TP The following items are displayed on this screen: L2TP Settings Connection Type: Select L2TP if your ISP provides a L2TP connection. Click to dial-up to the Internet and obtain the IP address. Click to disconnect the Internet connection and release the current IP address.
Account Name: Enter the Account Name provided by your ISP. If you are not clear, please consult your ISP. Password: Enter the Password provided by your ISP. Server IP: Enter the Server IP provided by your ISP. MTU: MTU (Maximum Transmission Unit) is the maximum data unit transmitted by the physical network. It can be set in the range of 576-1460. The default MTU is 1460. It is recommended to keep the default value if no other MTU value is provided by your ISP.
Upstream Specify the bandwidth for transmitting packets on the port. Bandwidth: Downstream Specify the bandwidth for receiving packets on the port. Bandwidth: L2TP Status Status: Displays the status of PPPoE connection. “Disabled” indicates that the L2TP connection type is not applied. “Connecting” indicates that the router is obtaining the IP parameters from your ISP. “Connected” indicates that the router has successfully obtained the IP parameters from your ISP.
Figure 3-11 WAN - PPTP The following items are displayed on this screen: PPTP Settings Connection Type: Select PPTP if your ISP provides a PPTP connection. Click to dial-up to the Internet and obtain the IP address. Click to disconnect the Internet connection and release the current IP address. Account Name: Enter the Account Name provided by your ISP. If you are not clear, please consult your ISP. Password: Enter the Password provided by your ISP.
Server IP: Enter the Server IP provided by your ISP. MTU: MTU (Maximum Transmission Unit) is the maximum data unit transmitted by the physical network. It can be set in the range of 576-1460. The default MTU is 1460. It is recommended to keep the default value if no other MTU value is provided by your ISP. Active Mode: You can select the proper Active mode according to your need.
PPTP Status Status: 6) Displays the status of PPTP connection. “Disabled” indicates that the PPTP connection type is not applied. “Connecting” indicates that the router is obtaining the IP parameters from your ISP. “Connected” indicates that the router has successfully obtained the IP parameters from your ISP. “Disconnected” indicates that the connection has been manually terminated or the request of the router has no response from your ISP.
Figure 3-12 WAN – Bigpond The following items are displayed on this screen: BigPond Settings Connection Type: Select BigPond if your ISP provides a BigPond connection. Click to dial-up to the Internet and obtain the IP address. Click to disconnect the Internet connection and release the current IP address. Account Name: Enter the Account Name provided by your ISP. If you are not clear, please consult your ISP. Password: Enter the Password provided by your ISP.
Enter the domain name of authentication server. It's only required Auth Domain: when the address of Auth Server is a server name. You can select the proper Active mode according to your need. Auth Mode: Manual: Select this option to manually activate or terminate the Internet connection by the or button. It is optimum for the dial-up connection charged on time. Always-on: Select this option to keep the connection always on.
Default Gateway: Displays the IP address of the default gateway assigned by your ISP. Note: To ensure the BigPond connection re-established normally, please restart the connection at least 5 seconds after the connection is off. 3.1.4 LAN 3.1.4.1 LAN On this page, you can configure the parameters for LAN port of this router. Choose the menu Network→LAN→LAN to load the following page.
Figure 3-14 DHCP Settings The following items are displayed on this screen: DHCP Settings DHCP Server: Enable or disable the DHCP server on your router. To enable the router to assign the TCP/IP parameters to the computers in the LAN automatically, please select Enable. Start IP Address: Enter the Start IP address to define a range for the DHCP server to assign dynamic IP addresses. This address should be in the same IP address subnet with the router’s LAN IP address. The default address is 192.168.0.
Primary DNS: Optional. Enter the Primary DNS server address provided by your ISP. It is recommended to enter the IP address of the LAN port of the router. Secondary DNS: 3.1.4.3 Optional. If a Secondary DNS Server address is available, enter it. DHCP Client On this page, you can view the information about all the DHCP clients connected to the router. Choose the menu Network→LAN→DHCP Client to load the following page.
The following items are displayed on this screen: DHCP Reservation MAC Address: Enter the MAC address of the computer for which you want to reserve the IP address. IP Address: Enter the reserved IP address. Description: Optional. Enter a description for the entry. Up to 28 characters can be entered. Status: Activate or Inactivate the corresponding entry. List of Reserved Address In this table, you can view the information of the entries and edit them by the Action buttons.
The following items are displayed on this screen: IGMP IGMP Proxy: IGMP Proxy is to act as a multicast proxy for hosts on the LAN side. It is recommended to enable the IGMP Proxy, otherwise you will not be able to use IPTV service. IGMP Version: You can choose the highest IGMP version that the system supports: IGMPv2 or IGMPv3. Tips: Among the WAN ports, only WAN1(Port1) can be used for IPTV service.
Figure 3-18 MAC Address The following items are displayed on this screen: MAC Address Displays the port type of the router. Port: Current MAC Address: Displays the current MAC address of the port. MAC Clone: It’s only available for WAN port. Click the button to restore the MAC address to the factory default value or click the button to clone the MAC address of the PC you are currently using to configure the router. Then click to apply.
Figure 3-19 Statistics The following items are displayed on this screen: Statistics Unicast: Displays the number of normal unicast packets received or transmitted on the port. Broadcast: Displays the number of normal broadcast packets received or transmitted on the port. Pause: Displays the number of flow control frames received or transmitted on the port. Multicast: Displays the number of normal multicast packets received or transmitted on the port.
Oversize: Displays the number of the received packets (including error frames) that are longer than the maximum frame. Total (Bytes): Displays the total number of the received or transmitted packets (including error frames). Click the button to clear all the traffic statistics. Tips: The Port 1/2/3/4/5 mentioned in this User Guide refers to the WAN1/2 port and LAN1/2/3 port on the router. 3.1.7.
Mode: Select the mode for the port mirror function. Options include: Ingress: When this mode is selected, only the incoming packets received by the mirrored port will be copied to the mirroring port. Egress: When this mode is selected, only the outgoing packets sent by the mirrored port will be copied to the mirroring port. Ingress & Egress: When this mode is selected, both the incoming and outgoing packets through the mirrored port will be copied to the mirroring port.
3.1.7.3 Rate Control On this page, you can control the traffic rate for the specific packets on each port so as to manage your network flow. Choose the menu Network→Switch→Rate Control to load the following page. Figure 3-21 Rate Control The following items are displayed on this screen: Rate Control Port: Displays the port number. Ingress Limit: Specify whether to enable the Ingress Limit feature. Ingress Rate: Specify the limit rate for the ingress packets.
Figure 3-22 Port Config The following items are displayed on this screen: Port Config Status: Specify whether to enable the port. The packets can be transported via this port after being enabled. Flow Control: Allows you to enable/disable the Flow Control function. Negotiation Mode: Select the Negotiation Mode for the port. All Ports: Allows you to configure the parameters for all the ports at one time. 3.1.7.5 Port Status On this page, you can view the current status of each port.
3.1.7.6 Port VLAN A VLAN (Virtual Local Area Network) is a network topology configured according to a logical scheme rather than the physical layout, which allows you to divide the physical LAN into multiple logical LANs so as to control the communication among the ports. The VLAN function can prevent the broadcast storm in LANs and enhance the network security. By creating VLANs in a physical LAN, you can divide the LAN into multiple logical LANs, each of which has a broadcast domain of its own.
Choose the menu Wireless→Wireless Setting→Wireless Setting to load the following page. Figure 3-25 Wireless Setting The following items are displayed on this screen: Wireless Setting Wireless: Enable or disable the Wireless function. Region: Select your region from the drop-down list. This field specifies the region where the wireless function of the router can be used. It may be illegal to use the wireless function of the router in a region other than one of those specified in this field.
Channel: This field determines which operating frequency will be used. The default channel is automatic and the router will choose the best channel automatically. It is not necessary to change the wireless channel unless you notice interference problems with another nearby access point. Mode: Select the desired mode. 11b only - Select if all of your wireless clients are 802.11b. 11g only - Select if all of your wireless clients are 802.11g. 11n only- Select only if all of your wireless clients are 802.
SSID Broadcast: Enable or disable the SSID Broadcast. When wireless clients survey the local area for wireless networks to associate with, they will detect the SSID broadcast by the router. If the SSID Broadcast is enabled, the Wireless router will broadcast its name (SSID) on the air. AP Isolation Enable or disable the AP Isolation. This function can isolate wireless stations in your network from each other. Wireless devices will be able to communicate with the router but not with each other.
Encryption: Select the Encryption type, including Automatic, TKIP, AES. The default setting is Automatic, which can select TKIP (Temporal Key Integrity Protocol) or AES (Advanced Encryption Standard) automatically based on the wireless station's capability and request. TKIP – TKIP is a security protocol used in the IEEE 802.11 wireless networking standard. AES – AES is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology.
Encryption: Select the Encryption type, including Automatic, TKIP, AES. The default setting is Automatic, which can select TKIP (Temporal Key Integrity Protocol) or AES (Advanced Encryption Standard) automatically based on the wireless station's capability and request. TKIP – TKIP is a security protocol used in the IEEE 802.11 wireless networking standard. AES – AES is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology.
Key Format: Hexadecimal and ASCII formats are provided. Hexadecimal format stands for any combination of hexadecimal digits (0-9, a-f, A-F) in the specified length. ASCII format stands for any combination of keyboard characters in the specified length. Key Selected: You can select the key based on need. WEP Key: Select which of the four keys will be used and enter the matching WEP key that you create. Make sure these values are identical on all wireless stations in your network.
Figure 3-26 Multi-SSID The following items are displayed on this screen: General Multi-SSID: Enable or disable the Multi-SSID. You can establish multiple wireless networks if Multi-SSID is enabled. SSID Insulation: Enable or disable the SSID Insulation. If enabled, the hosts accessing to the different SSID cannot be communicate with each other. Multi-SSID Config SSID: Specify a name for the wireless network. Description: Enter a description for this SSID.
Specify the security option of the wireless network. If you do not want to Security: use wireless security, select “Disable Security”, otherwise select one Security option from the drop-down list. It’s strongly recommended to choose one of the security options to enable security. There are three wireless security options supported by the router: WPA-PSK/WPA2-PSK, WPA/WPA2 and WEP. It is recommend to choose WPA-PSK/WPA2-PSK. The detail information of the three security options will be introduced below.
Auth Type: Choose the Auth type of the WPA-PSK/WPA2-PSK security on the drop-down list. The default setting is Automatic, which can select WPA-PSK (Pre-shared key of WPA) or WPA2-PSK (Pre-shared key of WPA) automatically based on the wireless station's capability and request. Encryption: Select the Encryption type including Automatic, TKIP, AES.
Encryption: Select the Encryption type, including Automatic, TKIP, AES. The default setting is Automatic, which can select TKIP (Temporal Key Integrity Protocol) or AES (Advanced Encryption Standard) automatically based on the wireless station's capability and request. TKIP – TKIP is a security protocol used in the IEEE 802.11 wireless networking standard. AES – AES is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology.
Key Format: Hexadecimal and ASCII formats are provided. Hexadecimal format stands for any combination of hexadecimal digits (0-9, a-f, A-F) in the specified length. ASCII format stands for any combination of keyboard characters in the specified length. Key Selected: You can select the key based on need. WEP Key: Select which of the four keys will be used and enter the matching WEP key that you create. Make sure these values are identical on all wireless stations in your network.
3.2.1.3 WDS With the WDS function, the router can bridge two or more WLANs. Choose the menu Wireless→Wireless Setting→WDS to load the following page. Figure 3-27 WDS Configuration The following items are displayed on this screen: General WDS: Enable or disable the WDS function. With this function, the router can bridge two or more WLANs. Scan: Click this button, and you can search the APs that run in the channels this device supports.
WEP Key Index: This option should be chosen if the key type is WEP (ASCII) or WEP (HEX).It indicates the index of the WEP key. Auth Type: This option should be chosen if the key type is WEP (ASCII) or WEP (HEX).It indicates the authorization type of the Root AP. Key： If the AP your router is going to connect needs password, you need to fill the key in this blank. Tips: The Multi-SSID function will be disabled if WDS is enabled. 3.2.1.
Short GI: This function will increase the data capacity by reducing the guard interval time. You are recommended to enable it. Wireless Advanced Transmit Power: Here you can specify the transmit power of router. You can select High, Middle or Low which you would like. High is the default setting and is recommended. Beacon Interval: Enter a value between 40-1000 milliseconds for Beacon Interval here. The beacons are the packets sent by the router to synchronize a wireless network.
Choose the menu Wireless→MAC Filtering to load the following page. Figure 3-29 MAC Filtering The following items are displayed on this screen: General Each SSID can be configured the MAC Address Filtering rules. You can select an SSID in the SSID drop-down list. To create a new SSID, please refer to 3.2.1.2 Multi-SSID. To control some of the hosts to access the wireless network, it is recommended to select “Enable Wireless MAC Address Filtering” and select one filtering rule according to need.
Figure 3-30 Host Status The following items are displayed on this screen: General Select an SSID, the status of the host in this wireless network will display on the following table. Host Status MAC Address: Displays the MAC address of the host which access the router by wireless connection. SSID: Displays the name of the SSID to which the host connects. Current Status: Displays the Status of the wireless connection. Received Packets: Displays the total packets received by the host.
Figure 3-31 Group Configuration The following items are displayed on this screen: Group Config Group Name: Specify a unique name for the group. Description: Give a description for the group. It's optional. List of Group In this table, you can view the information of the Groups and edit them by the Action buttons. 3.3.2 User On this page, you can configure the User for the group. Choose the menu User Group→User to load the following page.
Description: Give a description to the user for identification. It's optional. List of User In this table, you can view the information of the Users and edit them by the Action buttons. 3.3.3 View On this page, you can configure the User View or Group View. Choose the menu User Group→View to load the following page. Figure 3-33 View Configuration The following items are displayed on this screen: View Config View: Select the desired view for configuration.
Available Member: Displays the Users and the Groups which can be added into this group. Selected Member: Displays the members of this group, including Users and Groups. 3.4 Advanced 3.4.1 NAT NAT (Network Address Translation) is the translation between private IP and public IP, which allows private network users to visit the public network using private IP addresses. With the explosion of the Internet, the number of available IP addresses is not enough.
Host IP Address: 3.4.1.2 Enter the IP address of the host specified as NAT DMZ server. One-to-One NAT On this page, you can configure the One-to-One NAT. Choose the menu Advanced→NAT→One-to-One NAT to load the following page. Figure 3-35 One to One NAT The following items are displayed on this screen: One-to-One NAT Mapping IP Address: Enter the Original IP Address in the first checkbox and Translated IP Address in the second checkbox. TL-ER604W allows mapping from LAN port to WAN port in LAN Mode.
Note: One-to-One NAT entries take effect only when the Connection Type of WAN is Static IP. Changing the Connection type from Static IP to other ones will make the entries attached to the interface disabled. 3.4.1.3 Multi-Nets NAT Multi-Nets NAT function allows the IP under LAN port within multiple subnets to access the Internet via NAT. Choose the menu Advanced→NAT→Multi-Nets NAT to load the following page.
Application Example Network Requirements The LAN subnet of TL-ER604W is 192.168.0.0 /24, the subnet of VLAN2 under a three layer switch is 192.168.2.0 /24, while the subnet of VLAN3 is 192.168.3.0 /24. The IP of VLAN for cascading the switch to the router is 192.168.0.2. Now the hosts within VLAN2 and VLAN3 desire to access the Internet. The network topology is shown as the following: Configuration procedure 1. Establish the Multi-Nets NAT entries with Subnet/Mask of VLAN2 and VLAN3.
Choose the menu Advanced→Routing→Static Route to load the following page. The Static Route entry is as follows: 3.4.1.4 Virtual Server Virtual server sets up public services in your private network, such as DNS, Email and FTP, and defines a service port. All the service requests to this port will be transmitted to the LAN server appointed by the router via IP address. Choose the menu Advanced→NAT→Virtual Server to load the following page.
Interface: Select an interface for forwarding data packets. External Port: Enter the service port or port range the router provided for accessing external network. All the requests from Internet to this service port or port range will be redirected to the specified server in local network. Internal Port: Specify the service port of the LAN host as virtual server. Protocol: Specify the protocol used for the entry.
Figure 3-38 Port Triggering The following items are displayed on this screen: Port Triggering Name: Enter a name for Port Triggering entries. Up to 28 characters can be entered. Interface: Select an interface for forwarding data packets. Trigger Port: Enter the trigger port number or the range of port. Only when the trigger port initiates connection will all the corresponding incoming ports open and provide service for the applications, otherwise the incoming ports will not open.
The router supports up to 16 Port Triggering entries. Each entry supports at most 5 groups of trigger ports and overlapping between the ports is not allowed. Each entry supports at most 5 groups of incoming ports and the sum of incoming ports you set for each entry should not be more than 100. List of Rules In this table, you can view the information of the entries and edit them by the Action buttons.
3.4.2 Traffic Control Traffic Control functions to control the bandwidth by configuring rules for limiting various data flows. In this way, the network bandwidth can be reasonably distributed and utilized. 3.4.2.1 Setup Choose the menu Advanced→Traffic Control→Setup to load the following page. Figure 3-40 Configuration The following items are displayed on this screen: General Disable Bandwidth Control: Select this option to disable Bandwidth Control.
Interface Bandwidth Interface: Displays the current enabled WAN port(s). The Total bandwidth is equal to the sum of bandwidth of the enabled WAN ports. Upstream Displays the bandwidth of each WAN port for transmitting data. The Bandwidth: Upstream Bandwidth of WAN port can be configured on WAN page. Downstream Displays the bandwidth of each WAN port for receiving data. The Bandwidth: Downstream Bandwidth of WAN port can be configured on WAN page.
The following items are displayed on this screen: Bandwidth Control Rule Direction: Select the data stream direction for the entry. The direction of arrowhead indicates the data stream direction. WAN-ALL means all WAN ports through which the data flow might pass. Individual WAN port cannot be selected if WAN-ALL rules are added. Group: Select the group to define the controlled users. Mode: Individual: The bandwidth of each user equals to the current bandwidth of this entry.
Note: The premise for single rule taking effect is that the bandwidth of the interface for this rule is sufficient and not used up. It is impossible to satisfy all the guaranteed bandwidth if the total guaranteed bandwidth specified by all Bandwidth Control rules for certain interface exceeds the physical bandwidth of this interface. 3.4.3 Session Limit The amount of TCP and UDP sessions supported by the router is finite.
Max. Sessions: Enter the max. Sessions for the users. Description: Give a description for the entry. Status: Activate or inactivate the entry. List of Session Limit You can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-42 indicates: The amount of maximum sessions for the hosts within group1 is 100 and this entry is enabled. 3.4.3.2 Session List On this page, you can view the Session Limit information of hosts configured with Session Limit.
With the box before Enable Application Optimized Routing checked, the router will consider the source IP address and destination IP address of the packets as a whole and record the WAN port they pass through. And then the packets with the same source IP address and destination IP address or destination port will be forwarded to the recorded WAN port. This feature is to ensure the multi-connected applications to work properly.
Destination IP: Enter the destination IP range for the entry. 0.0.0.0 - 0.0.0.0 means any IP is acceptable. Source Port: Enter the source Port range for the entry, which is effective only when the protocol is TCP, UDP or TCP/UDP. The default value is 1 – 65535, which means any port is acceptable. Destination Port: Enter the destination port range for the entry, which is effective only when the protocol is TCP, UDP or TCP/UDP. The default value is 1 – 65535, which means any port is acceptable.
Figure 3-46 Link Backup The following items are displayed on this screen: General WAN Ports: Displays all the WAN ports in use. You can drag the light-blue WAN button to primary and backup WAN list. The color of WAN button changing to gray indicates that the WAN port is already in the primary and backup WAN list. WAN Config: The WAN port in the secondary WAN list will share the traffic for the WAN in the primary WAN list under the specified condition. Mode: You can select Timing or Failover Mode.
Backup Effective Specify the backup effective time if Timing Mode has been selected. Time: Then the backup WAN port will be enabled, while the primary WAN port is disabled in the specified time period. When the start time you enter is not earlier than the end time, the default effective time is from the start time of the day to the end time of the next day. Status： Activate or inactivate the entry. List of Rules You can view the information of the entries and edit them by the Action buttons.
The following items are displayed on this screen: Protocol Enter a name to indicate a protocol. The name will display in the Name: drop-down list of Protocol on Access Rule page. Number: Enter the Number of the protocol in the range of 0-255. List of Protocol You can view the information of the entries and edit them by the Action buttons. Note: The system predefined protocols cannot be configured. 3.4.5 Routing 3.4.5.
The following items are displayed on this screen: Static Route Destination: Enter the destination host the route leads to. Subnet Mask: Enter the Subnet Mask of the destination network. Next Hop: Enter the gateway IP address to which the packet should be sent next. Interface: Select the physical network interface, through which this route is accessible. Metric: Defines the priority of the route. The smaller the value is, the higher the priority is. The default value is 0.
The network topology is shown as the following: Configuration procedure On the Static Route page, add a static routing rule for LAN2 with destination address 192.168.2.0 (LAN2’s IP address) and next hop address 192.168.0.2 (IP address of the cascading LAN port) as shown in the following figure. Then click the button. Add a static routing rule for LAN3 by referring to step 2. The static routing rules are shown in the following figure. 3.4.5.
in 180 seconds, the RIP of the other routers would set the distance to this router into infinity and delete the corresponding information from route table. RIP develops from initial RIPv1 to RIPv2 gradually. Compared with RIPv1, RIPv2 supports VLSM (Variable Length Subnet Mask), simple plain text authentication, MD5 cryptograph authentication, CIDR (Classless Inter-Domain Routing) and multicast.
List of RIP After RIP is enabled, the information of RIP forwarding the packets received by the router will be displayed in the list. The first entry in Figure 3-49 indicates: when receiving packets with destination IP is 116.10.20.28, the router will select WAN1 which is in the same network with the destination IP as next hop and forward data via this port. The IP address of next hop is 116.10.1.254 and the hop count is 1. The effective time of this entry is 1 second.
Physical Interface: The physical interface of route entry. Metric The Metric of route entry. 3.5 Firewall 3.5.1 Anti ARP Spoofing ARP (Address Resolution Protocol) is used for analyzing and mapping IP addresses to the corresponding MAC addresses so that packets can be delivered to their destinations correctly. ARP functions to translate the IP address into the corresponding MAC address and maintain an ARP Table in which the latest used IP address-to-MAC address mapping entries are stored.
The following items are displayed on this screen: General It is recommended to check all the options. You should import the IP and MAC address of the host to IP-MAC Binding List and enable the corresponding entry before enabling “Permit the packets matching the IP-MAC Binding entries only”. When suffered ARP attack, the correct ARP information will be sent to the device suffering attack initiatively by GARP (Gratuitous ARP) packets, thus the error ARP information of the device will be replaced.
Figure 3-52 ARP Scanning Enter the start and the end IP addresses into the Scanning IP Range field. Then click the button, the router will scan all the active hosts within the scanning range and display the result in the list. The entries displayed on the List of Scanning Result do not mean the IP and MAC addresses are already bound. The current status for the entry will display in the “Status” field.
Figure 3-53 ARP List The configurations for the entries is the same as the configuration of List of Scanning Result on 3.5.1.2 ARP Scanning page. The unbound IP-MAC information will be replaced by new IP-MAC information or be automatically removed from the list if it has not been communicated with others for a long time. This period is regarded as the aging time of the ARP information. 3.5.
The following items are displayed on this screen: General Flood Defense: Flood attack is a commonly used DoS (Denial of Service) attack, including TCP SYN, UDP, ICMP and so on. It is recommended to select all the Flood Defense options and specify the corresponding thresholds. Keep the default settings if you are not sure. Packet Anomaly Packet Anomaly refers to the abnormal packets. It is recommended to Defense: select all the Packet Anomaly Defense options.
Description: Give a description for the entry. List of Rules You can view the information of the entries and edit them by the Action buttons. 3.5.4 Access Control 3.5.4.1 URL Filtering URL (Uniform Resource Locator) specifies where an identified resource is available and the mechanism for retrieving it. URL Filter functions to filter the Internet URL address, so as to provide a convenient way for controlling the access to Internet from LAN hosts.
Mode: Select the mode for URL Filtering. “Keyword’’ indicates that all the URL addresses including the specified keywords will be filtered. “URL Path” indicates that the URL address will be filtered only when it exactly matches the specified URL. Effective Time: Specify the time for the entry to take effect. Description: Give a description for the entry. List of Rules You can view the information of the entries and edit them by the Action buttons.
3.5.4.2 Web Filtering On this page, you can filter the desired web components. Choose the menu Firewall→Access Control→Web Filtering to load the following page. Figure 3-57 Web Filtering Check the box before Enable Web Filtering and select the web components to be filtered. 3.5.4.3 Access Rules Choose the menu Firewall→Access Control→Access Rules to load the following page.
Service: Select the service for the entry. Only the service belonging to the specified service type is limited by the entry. For example, if you select “Block” for Policy and only FTP for Service, the packets of other service types can still pass through the router. You can add new service types on 3.5.4.4 Service. Interface: Select interface for the entry. The entry will take effect when the interface to which the data is flowing is selected. WAN and LAN refers to all the WAN and LAN interfaces.
Note: For the users in the private network and not being set access rule, the default Policy is Allow. To specify all IP addresses, type “0.0.0.0 / 32” in the Policy field. For detailed setting of subnet mask, please refer to Appendix B FAQ. 3.5.4.4 Service The Service function allows you to specify the protocol and port number to be filtered for Firewall function conveniently. Protocol name and port range constitute a service type.
Dest. Port: Enter the start and end ports to make a destination port range for the service. The start port number cannot be greater than the end port number. List of Service You can view the information of the entries and edit them by the Action buttons. Note: The service types predefined by the system cannot be modified. 3.5.5 App Control 3.5.5.1 Control Rules On this page, you can enable the Application Rules function. Choose the menu Firewall→App Control→Control Rules to load the following page.
Control Rules Object: Specify the object for the entry. You can select “Group” to limit the predefined group, or select “ANY” to limit all the users. Group: If select “Group” as object, you can select the group in the drop-down Application: Click the button to select applications from the popup list. To establish new group, please refer to 3.3.1 Group. checkbox. The applications include IM, Web IM, SNS, P2P, Media, Basic and Proxy.
The database refers to all the applications in the application list on the Application Rules page, you can download the latest database from http://www.tp-link.com. Click the button and select the file, and then click the button to save the database. 3.6 VPN VPN (Virtual Private Network) is a private network established via the public network, generally via the Internet.
IKE consists of two phases. Phase 1 is used to negotiate the parameters, key exchange algorithm and encryption to establish an ISAKMP SA for securely exchanging more information in Phase 2. During phase 2, the IKE peers use the ISAKMP SA established in Phase 1 to negotiate the parameters for security protocols in IPsec and create IPsec SA to secure the transmission data. 3.6.1.1 IKE Policy On this page you can configure the related parameters for IKE negotiation.
Exchange Mode: Select the IKE Exchange Mode in phase 1, and ensure the remote VPN peer uses the same mode. Main: Main mode provides identity protection and exchanges more information, which applies to the scenarios with higher requirement for identity protection. Aggressive: Aggressive Mode establishes a faster connection but with lower security, which applies to scenarios with lower requirement for identity protection. Local ID Type: Select the local ID type for IKE negotiation.
List of IKE Policy In this table, you can view the information of IKE Policies and edit them by the action buttons. 3.6.1.2 IKE Proposal On this page, you can define and edit the IKE Proposal. Choose the menu VPN→IKE→IKE Proposal to load the following page. Figure 3-64 IKE Proposal The following items are displayed on this screen: IKE Proposal Proposal Name: Specify a unique name to the IKE proposal for identification and management purposes. The IKE proposal can be applied to IPsec proposal.
Encryption: Specify the encryption algorithm for IKE negotiation. Options include: DES: DES (Data Encryption Standard) encrypts a 64-bit block of plain text with a 56-bit key. DH Group: 3DES: Triple DES, encrypts a plain text with 168-bit key. AES128: Uses the AES algorithm and 128-bit key for encryption. AES192: Uses the AES algorithm and 192-bit key for encryption. AES256: Uses the AES algorithm and 256-bit key for encryption.
Figure 3-65 IPsec Policy The following items are displayed on this screen: General You can enable/disable IPsec function for the router here. IPsec Policy Policy Name: Specify a unique name to the IPsec policy. Up to 28 characters can be entered. Mode: Select the network mode for IPsec policy. Options include: Local Subnet: LAN-to-LAN: Select this option when the client is a network. Client-to-LAN: Select this option when the client is a host.
Remote Subnet: Specify IP address range on your remote network to identify which PCs on the remote network are covered by this policy. It's formed by IP address and subnet mask. WAN: Specify the local WAN port for this Policy. The "Remote Gateway" of the remote peer should be set to the IP address of this WAN port. Remote Gateway: Enter the Remote Gateway. It can be IP address or Domain name. Policy Mode: Select the negotiation mode for the policy.
SA Lifetime: ● Specify IPsec SA Lifetime for IKE mode. Manual Mode IPsec Proposal: Select the IPsec Proposal. Only one proposal can be selected on Manual mode. You need to first create the IPsec Proposal. Incoming SPI: Specify the Incoming SPI (Security Parameter Index) manually. The Incoming SPI here must match the Outgoing SPI value at the other end of the tunnel, and vice versa.
ESP Encryption Specify the outbound ESP Encryption Key manually if ESP protocol is Key-Out: used in the corresponding IPsec Proposal. The outbound key here must match the inbound ESP encryption key at the other end of the tunnel, and vice versa. List of IPsec Policy In this table, you can view the information of IPsec policies and edit them by the action buttons. The first entry in Figure 3-65 indicates: this is an IPsec tunnel, the local subnet is 192.168.0.0/24, the remote subnet is 192.168.3.
Security Protocol: AH Authentication: ESP Authentication: ESP Encryption: Select the security protocol to be used. Options include: AH: AH (Authentication Header) provides data origin authentication, data integrity and anti-replay services. ESP: ESP (Encapsulating Security Payload) provides data encryption in addition to origin authentication, data integrity, and anti-replay services. Select the algorithm used to verify the integrity of the data for AH authentication.
3.6.2.3 IPsec SA This page displays the information of the IPsec SA (Security Association). Choose the menu VPN→IPsec→IPsec SA to load the following page. Figure 3-67 IPsec SA Figure 3-67 displays the connection status of the NO.1 entry in the List of IPsec policy in Figure 3-65. As shown in the figure, the router is using WAN2 for tunnel connection, and the IP address of WAN2 and the default gateway of remote peer are 172.30.70.151 and 172.30.70.161 respectively.
3.6.3.1 L2TP/PPTP Tunnel On this page, you can configure the L2TP/PPTP VPN. Choose the menu VPN→L2TP/PPTP→L2TP/PPTP Tunnel to load the following page. Figure 3-68 L2TP/PPTP Tunnel The following items are displayed on this screen: General Hello Interval: Specify the interval to send hello packets. Primary/Secondary DNS: Enter the Primary/Secondary DNS server address. The default IP is "0.0.0.0", which means the LAN IP of the router is used as the DNS server address.
Mode: Specify the working mode for this router. Options include: Client: In this mode, the device sends a request to the remote L2TP/PPTP server initiatively for establishing a tunnel. Server: In this mode, the router responds the request from the remote client for establishing a tunnel. Account Name: Enter the account name of L2TP/PPTP tunnel. It should be configured identically on server and client. Password: Enter the password of L2TP/PPTP tunnel.
IP Address Pool: Select the IP Pool Name to specify the address range for the server's IP assignment. This item is available for Server mode. Remote Subnet: Enter the IP address range of your remote network. (It's always the IP address range of LAN on the remote peer of VPN tunnel.) It’s the combination of IP address and subnet mask. Status: Activate or inactivate the entry. List of Configurations In this table, you can view your configurations of the tunnels and edit them by the action buttons.
List of IP Pool In this table, you can view the information of IP Pools and edit them by the action buttons. 3.6.3.3 List of L2TP/PPTP Tunnel This page displays the information and status of the tunnels. Choose the menu VPN→L2TP/PPTP→List of L2TP/PPTP Tunnel to load the following page. Figure 3-70 List of L2TP/PPTP Tunnel Figure 3-70 displays the connection status of the NO.1 entry in the list of tunnel in Figure 3-69. This tunnel has been successfully established.
Figure 3-71 General The following items are displayed on this screen: General PPPoE Server: Specify whether to enable the PPPoE Server function. Dial-up Access Only: Specify whether to enable the Dial-up Access Only function. If enabled, only the Dial-in Users and the user with Exceptional IP can access the Internet. PPPoE User Isolation: Specify whether to allow the Dial-in Users to communicate with one another. Primary/Secondary Enter the Primary/Secondary DNS server address.
Authentication: Select the Authentication type. It can be Local authentication and Remote authentication. Select Local authentication for authentication in PPPoE server and select Remote authentication for authentication in the remote server. Auth Protocol: Radius Server: Select at least one authentication protocol for Local Authentication. PAP, transferring username and password in plain text in the network, is used in a less secured network.
IP Address Range: Specify the start and the end IP address for IP Pool. The start IP address should not exceed the end address and the IP address ranges must not overlap. List of IP Pool In this table, you can view the information of IP Address Pools and edit them by the Action buttons. 3.7.1.3 Account On this page, you can configure the PPPoE account. Choose the menu Services→PPPoE Server→Account to load the following page.
IP Address Pool: It's available on Dynamic mode. Select an IP Address Pool to make a range to assign dynamic IPs. Max Sessions: Specify the maximum number of sessions for the client. The default value is 1. Expiration Date: Specify the Expiration Date of the account. The default is 2099-1-1. Description: Enter the description for management and search purposes. Up to 28 characters can be entered. Status: Activate or inactivate the entry.
Figure 3-74 Exceptional IP The following items are displayed on this screen: Exceptional IP IP Address Range: Specify the start and the end IP address to make an exceptional IP address range. This range should be in the same IP range with LAN port of the router. The start IP address should not exceed the end address and the IP address ranges must not overlap. Description: Give a description to the exceptional IP address range for identification. Status: Activate or inactivate the entry.
Choose the menu Services→E-Bulletin to load the following page. Figure 3-76 E-Bulletin The following items are displayed on this screen: General Enable E-Bulletin: Specify whether to enable electronic bulletin function. Interval: Specify the interval to release the bulletin. Enable Logs: Specify whether to log the E-Bulletin. E-Bulletin Title: Enter a title for the bulletin.
Content: Enter the content of the bulletin. Object: Select the object of this bulletin. Options include: ANY: The bulletin will be released to all the users and the PCs on the LAN. Group: The bulletin will be released to the users in the selected group. You can click < > button to add a group to the selected group and click < > to remove a group from the selected group. Group is created on User Group→Group page. Effective Time: Specify the effective time for the bulletin.
DDNS (Dynamic DNS) server provides a fixed domain name for DDNS client and maps its latest IP address to this domain name. When DDNS server works, DDNS client informs the DDNS server of the latest IP address, the server will update the mappings between the domain name and IP address in DNS database. Therefore, the users can use the same domain name to access the DDNS client even if the IP address of the DDNS client has changed.
Domain Name: Enter the Domain Name that you registered with your DDNS service provider. Update Interval: Select the interval to update DDNS service. DDNS Service: Activate or inactivate DDNS service here. WAN Port: Displays the WAN port for which Dyndns DDNS is selected. DDNS Status: Displays the current status of DDNS service: Offline: DDNS service is disabled. Connecting: Client is connecting to the server. Online: DDNS works normally.
The following items are displayed on this screen: No-IP DDNS Account Name: Enter the Account Name of your DDNS account. If you have not registered, click to go to the website of No-IP for register. Password: Enter the password of your DDNS account. Domain Name: Enter the Domain Name that you registered with your DDNS service provider. Update Interval: Select the Interval to update DDNS service. DDNS Service: Activate or inactivate DDNS service here.
Figure 3-79 PeanutHull DDNS The following items are displayed on this screen: PeanutHull DDNS Account Name: Enter the Account Name of your DDNS account. If you have not registered, click to go to the website of PeanutHull for register. Password: Enter the password of your DDNS account. DDNS Service: Activate or inactivate DDNS service here. WAN Port: Displays the WAN port for which PeanutHull DDNS is selected.
List of PeanutHull Account In this table, you can view the existing DDNS entries or edit them by the Action button. 3.7.3.4 Comexe On this page you can configure Comexe DDNS client. Choose the menu Services→Dynamic DNS→Comexe to load the following page. Figure 3-80 Comexe DDNS The following items are displayed on this screen: Comexe DDNS Account Name: Enter the Account Name of your DDNS account. If you have not registered, click to go to the website of Comexe for register.
Domain Name: Displays the domain names obtained from the DDNS server. Up to 5 domain names can be displayed here. List of Comexe Account In this table, you can view the existing DDNS entries or edit them by the Action button. 3.7.4 UPnP Devices based on UPnP (Universal Plug and Play) protocol from different manufacturer can automatically discover and communicate with one another.
Note: When using UPnP function, make sure the UPnP is enabled for the router, and the operating system and applications in the host support UPnP service. As some Trojan and viruses can open the specific port using UPnP service resulting in hacker attack on the host, be careful of using UPnP service. 3.8 Maintenance 3.8.1 Admin Setup 3.8.1.1 Administrator On this page, you can modify the factory default user name and password of the router.
3.8.1.2 Login Parameter On this page, you can configure and modify the Http, Https and Telnet port. Choose the menu Maintenance→Admin Setup→Login Parameter to load the following page. Figure 3-83 Login Parameter The following items are displayed on this screen: General Http Management Port: Enter the Http Management Port for the router. The default port is 80. Https Management Port: Enter the Https Management Port for the router. The default port is 443.
3.8.1.3 Login Control On this page you can configure the Access Control mode. It controls local hosts to access your router by their IPs or MACs. Choose the menu Maintenance→Admin Setup→Login Control to load the following page. Figure 3-84 Login Control The following items are displayed on this screen: Access Control Config IP-based mode： Subnet/Mask: Specify a single IP address or a network segment which is allowed to access the router. Status: Activate or inactivate the entry.
Status: Activate or inactivate the entry. List of Rules In this list, you can view the Login Control entries and edit them by the Action buttons. The first entry in Figure 3-84 indicates that: The host with MAC address 00:27:19:90:52:4E is allowed to access the router and this entry is activated. 3.8.1.4 Remote Management On this page you can configure the Remote Management function. This feature allows managing your router from a remote location via the Internet.
Then type the corresponding port number in Web Management Port and Telnet Management Port fields as the following figure shows. Finally, start the web browser and type 210.10.10.50 in the URL field to log in the Web management page of the router. 3.8.2 Management 3.8.2.1 Factory Defaults Choose the menu Maintenance→Management→Factory Defaults to load the following page.
Figure 3-87 Export and Import The following items are displayed on this screen: Configuration Version Displays the current Configuration version of the router. Export Click the button to save the current configuration as a file to your computer. You are suggested to take this measure before upgrading or modifying the configuration. Import Click the button to locate the update file for the device, or enter the exact path to the saved file in the text box.
The configuration will not be lost after rebooting. The Internet connection will be temporarily interrupted while rebooting. Note: To avoid damage, please don't turn off the device while rebooting. 3.8.2.4 Firmware Upgrade Choose the menu Maintenance→Management →Firmware Upgrade to load the following page. Figure 3-89 Firmware Upgrade To upgrade the router is to get more functions and better performance. Go to http://www.tp-link.com to download the updated firmware.
Figure 3-90 SNMP The following items are displayed on this screen. General SNMP: Enable or disable the SNMP function. Device Name: Enter the name of the router. Location: Enter the location of the router. Contact: Enter the name of the network administrator for the router, as well as a contact number or e-mail address. Get Community: Enter the password that allows read-only access to the router’s SNMP information. The default password is public.
Figure 3-91 Interface Traffic Statistics The following items are displayed on this screen: Interface Traffic Statistics Interface: Displays the interface. Rate Rx： Displays the rate for receiving data frames. Rate Tx: Displays the rate for transmitting data frames. Packets Rx: Displays the number of packets received on the interface. Packets Tx: Displays the number of packets transmitted on the interface. Bytes Rx: Displays the bytes of packets received on the interface.
Figure 3-92 IP Traffic Statistics The following items are displayed on this screen: General Enable IP Traffic Statistics: Allows you to enable or disable IP Traffic Statistics. Enable Auto-refresh: Allows you to enable/disable refreshing the IP Traffic Statistics automatically. The default refresh interval is 10 seconds. Traffic Statistics Direction: Select the direction in the drop-down list to get the Flow Statistics of the specified direction.
Figure 3-93 Diagnostics The following items are displayed on this screen: Ping Destination IP/Domain: Enter destination IP address or Domain name here. Then select a port for testing, if you select “Auto”, the router will select the interface of destination automatically. After clicking button, the router will send Ping packets to test the network connectivity and reachability of the host and the results will be displayed in the box below.
Tracert Destination IP/Domain: Enter destination IP address or Domain name here. Then select a port for testing, if Auto is selected, the router will select the interface of destination automatically. After clicking the button, the router will send Tracert packets to test the connectivity of the gateways during the journey from the source to destination of the test data and the results will be displayed in the box below. 3.8.5.
DNS Lookup: Enter the IP address of DNS server in Manual mode. 0.0.0.0 means DNS Lookup is disabled. List of WAN status Port: Displays the detected WAN port. Detection: Displays whether the Online Detection is enabled. WAN Status: Display the detecting results. 3.8.6 Time 3.8.6.1 Time System Time is the time displayed while the router is running. On this page you can configure the system time and the settings here will be used for other time-based functions like Access Rule, PPPoE and Logs.
Config Get UTC: When this option is selected, you can configure the time zone and the IP address for the NTP server. The router will get UTC automatically if it has connected to an NTP server. Time Zone: Select the time zone for the router. Primary/Secondary NTP Server: Enter the IP address or domain name of the NTP server. Manual: With this option selected, you can set the date and time manually.
Daylight Saving Time(DST) Config DST Status: Enable or disable the DST. Predefined Mode: Select a predefined DST configuration. Recurring Mode: Date Mode: USA: Second Sunday in March, 02:00 ~ First Sunday in November, 02:00. European: Last Sunday in March, 01:00 ~ Last Sunday in October, 01:00. Australia: First Sunday in October, 02:00 ~ First Sunday in April, 03:00. New Zealand: Last Sunday in September, 02:00 ~ First Sunday in April, 03:00.
Figure 3-97 Logs List of Logs List of Logs displays the system log information in log buffer. Config Enable Auto-refresh: With this option selected, the page will refresh automatically every 5 seconds. Severity: Displays the severity level of the log information. You can select a severity level to display the log information with the same level. Send System Logs: Select Send System Logs and specify the server IP, then the new added logs will be sent to the specified server.
3.8.8 NAT Table NAT Table corresponds to a mapping relation, which displays the connection sessions in network to help user check forwarding status and troubleshoot network. Choose the menu Maintenance→NAT Table→NAT Table to load the following page. Figure 3-98 NAT Table The following items are displayed on this screen: Filter Setting Out Link: Select an interface for forwarding data packets. Protocol: Select the protocol used in the link. Local IP Address: Optional.
Chapter 4 Application 4.1 Network Requirements The company has established the server farms in the headquarters to provide the Web, Mail and FTP services for all the staff in the headquarters and the branch offices, and to transmit the commercial confidential data to its partners. The dedicated line access service was used by this company, which costs greatly in network maintain and cable layout.
4.2 Network Topology 4.3 Configurations You can configure the router via the PC connected to the LAN port of this router. To log in to the router, the IP address of your PC should be in the same subnet of the LAN port of this router. (The default subnet of LAN port is 192.168.0.0/24.). The IP address of your PC can be obtained automatically or configured manually. To access the configuration utility, open a web-browser and type in the default address http://192.168.0.
Choose the menu Network→System Mode to load the following page. Select the NAT mode and the button to apply. Figure 4-1 System Mode 4.3.1.2 Internet Connection Configure the Static IP connection type for the WAN1 and WAN2 ports of the router. Choose the menu Network→WAN→WAN1 to load the following page. Select the Static IP connection type and enter the IP address, Subnet Mask and Default Gateway provided by your ISP.
Figure 4-3 Link Backup 4.3.2 VPN Setting To enable the hosts in the remote branch office (WAN: 116.31.85.133, LAN: 172.35.10.1) to access the servers in the headquarters, you can create the VPN tunnel via the TP-LINK VPN routers between the headquarters and the remote branch office to guarantee a secured communication. The following takes IPsec settings of the router in the headquarters for example.
DH Group: DH2 Click the button to apply. Figure 4-4 IKE Proposal ● IKE Policy Choose the menu VPN→IKE→IKE Policy to load the configuration page. Settings: Policy Name: IKE_1 Exchange Mode: Main IKE Proposal: proposal_IKE_1 (you just created) Pre-shared Key: aabbccddee SA Lifetime: 3600 DPD: Enable DPD Interval: 10 Click the button to apply.
Figure 4-5 IKE Policy Tips: For the VPN router in the remote branch office, the IKE settings should be the same as the router in the headquarters. 2) IPsec Setting To configure the IPsec function, you should create an IPsec Proposal firstly. ● IPsec Proposal Choose the menu VPN→IPsec→IPsec Proposal to load the following page.
Click the button to apply. Figure 4-6 IPsec Proposal ● IPsec Policy Choose the menu VPN→IPsec→IPsec Policy to load the configuration page. Settings: IPsec: Enable Policy Name: IPsec_1 Mode: LAN-to-LAN Local Subnet: 192.168.0.0/24 Remote Subnet: 172.35.10.0/24 WAN: WAN1 Remote Gateway: 116.31.85.
Figure 4-7 IPsec Policy Tips: For the VPN router in the remote branch office, the IPsec settings should be consistent with the router in the headquarters. The Remote Gateway of the remote router should be set to the IP address of the router in the headquarters. After the IPsec VPN tunnel of the two peers is established successfully, you can view the connection information on the VPN→IPsec→IPsec SA page. Figure 4-8 List of IPsec SA 4.3.2.
it must configure an extra multi-nets NAT entry. Only in this way, the remote VPN clients can access the Internet via the VPN router in the headquarters. The following contents will respectively introduce the two situations. 1) ● In the Same Subnet IP Address Pool Choose the menu VPN→L2TP/PPTP→IP Address Pool to load the following page. Enter the Pool Name and the IP Address Range as the following figure shows. Click the button to apply.
Click the button to add the new entry to the list and click the button to apply. Figure 4-10 L2TP/PPTP Tunnel1 2) ● In the Different Subnet IP Address Pool Choose the menu VPN→L2TP/PPTP→IP Address Pool to load the following page. Enter the Pool Name and the IP Address Range as the following figure shows. Click the button to apply. Figure 4-11 IP Address Pool2 ● Multi-Nets NAT Choose the menu Advanced→NAT→Multi-Nets NAT to load the following page.
Figure 4-12 Multi-Nets NAT for PPTP2 ● L2TP/PPTP Tunnel Choose the menu VPN→L2TP/PPTP→L2TP/PPTP Tunnel to load the following page. Settings: Hello Interval: 60 Primary DNS: 202.96.128.86 Secondary DNS: 202.96.128.
Figure 4-13 L2TP/PPTP Tunnel2 4.3.3 Network Management To manage the enterprise network effectively and forbid the Hosts within the IP range of 192.168.0.30-192.168.0.50 to use IM/P2P application, you can set up a User Group and specify the network bandwidth limit and session limit for this group. The detailed configurations are as follows. 4.3.3.1 User Group Create a User Group with all the Hosts in the IP range of 192.168.0.30-192.168.0.50 as its group members.
● User Choose the menu User Group→User to load the configuration page. Click the button to enter the batch processing screen. Then continue with the following settings: Settings: Action: Add Start IP Address: 192.168.0.30 End IP Address: 192.168.0.50 Prefix Username: User Start No.: 1 Step: 1 Click the button to add the Users in bulk. Figure 4-15 User Config - Batch ● View Choose the menu User Group→View to load the configuration page.
Application: Click the button and select the applications desired to be blocked on the popup window. Status: Activate Figure 4-16 App Rules 4.3.3.3 Bandwidth Control To enable Bandwidth Control, you should configure the total bandwidth of interfaces and the detailed bandwidth control rule first. 1) Enable Bandwidth Control Choose the menu Advanced→Traffic Control→Setup to load the configuration page.
2) Interface Bandwidth Choose the menu Network→WAN→WAN1 to load the configuration page. Configure the Upstream Bandwidth and Downstream Bandwidth of the interface as Figure 4-17 shows. The entered bandwidth value should be consistent with the actual bandwidth value. 3) Bandwidth Control Rule Choose the menu Advanced→Traffic Control→Bandwidth Control to load the configuration page.
Max. Sessions: 250 Status: Activate Click the button to apply. Figure 4-19 Session Limit 4.3.4 Network Security You can enable the IP-MAC Binding function to defend the ARP attack from local or public network and enable Sending GARP packets function to defend ARP attack. Moreover, you can enable DoS Defense function to implement flood defense and Packet Anomaly Defense. Moreover, you can enable Port Mirror function and Statistics function to monitor the real-time traffic of the local network.
Figure 4-21 Scanning Result Choose the menu Firewall→Anti ARP Spoofing→IP-MAC Binding to load the configuration page. Select the ARP entries needed to be bound or click the
Figure 4-23 IP-MAC Binding 4.3.4.2 WAN ARP Defense To prevent the WAN ARP attack, you can bind the default gateway and IP address of WAN port. Obtain the MAC address of WAN port by ARP Scanning first. Choose the menu Firewall→Anti ARP Spoofing→ARP Scanning to load the configuration page. Enter the default gateway of the WAN port such as 58.51.128.254 in the Scanning Range field and click the button, the MAC address of the WAN port will display in the Scanning Result table.
Figure 4-24 Attack Defense 4.3.4.4 1) Traffic Monitoring Port Mirror Choose the menu Network→Switch→Port Mirror to load the configuration page. Check the box before Enable Port Mirror and select the Ingress&Egress mode. Select the Port 5 for the Mirroring Port and the Port 3 and the Port 4 for the Mirrored ports. Click the button to apply.
Figure 4-25 Port Mirror 2) Statistics Choose the menu Maintenance→Statistics to load the page. Load the Interface Traffic Statistics page to view the traffic statistics of each physical interface of the router as Figure 4-26 shows. Figure 4-26 Interface Traffic Statistics Load the IP Traffic Statistics page, and Check the box before Enable IP Traffic Statistics and Enable Auto-refresh, then click the button to apply.
Figure 4-27 IP Traffic Statistics After all the above steps, the enterprise network will be operated based on planning.
Appendix A Hardware Specifications General Standards IEEE 802.3, IEEE 802.3u, IEEE 802.3ab, IEEE 802.3x, IEEE 802.11b, IEEE 802.11g, IEEE 802.
Appendix B FAQ Q1. What can I do if I cannot access the web-based configuration page? 1. 2. For the first login, please try the following steps: 1) Make sure the cable is well connected to the LAN port of the router. The corresponding LED should flash or be solid light. 2) Make sure the IP address of your PC is set in the same subnet addresses of the router. It’s recommended to set your PC to get the IP address automatically.
management address of the router is http://192.168.0.1, and the default username and the password are both admin. Q3: What can I do if the router with the remote management function enabled cannot be accessed by the remote computer? 1. Make sure that the IP address of the remote computer is in the subnet allowed to remotely access the router. 2. If the router’s management port has been modified, please log into the router with the new address, such as http://192.168.0.
Appendix C Glossary Glossary ALG Description (Application Gateway) A Application Level Gateway (ALG) is application specific Layer translation agent that allows an application on a host in one address realm to connect to its counterpart running on a host in different realm transparently. ARP (Address Resolution Protocol) Internet protocol used to map an IP address to a MAC address. A security protocol that provides data authentication and AH (Authentication Header) optional anti-replay services.
Glossary Description H.323 allows dissimilar communication devices to communicate H.323 H with each other by using a standardized communication protocol. H.323 defines a common set of CODECs, call setup and negotiating procedures, and basic data transport methods. HTTP (Hypertext Transfer The protocol used by Web browsers and Web servers to transfer files, such as text and graphic files.
Glossary Description Standardized data link layer address that is required for every port or device that connects to a LAN. Other devices in the MAC address (Media network use these addresses to locate specific ports in the Access Control address) network and to create and update routing tables and data M structures. MAC addresses are 6 bytes long and are controlled by the IEEE. MTU (Maximum The size in bytes of the largest packet that can be transmitted.
T Glossary Description TCP (Transfer Control Connection-oriented transport layer protocol that provides Protocol) reliable full-duplex data transmission. TCP/IP (Transmission Common name for the suite of protocols to support the Control Protocol/ Internet construction of worldwide Internet works. TCP and IP are the Protocol) two best-known protocols in the suite.
