1. Manuals
  2. Brands
  3. Abocom Manuals
  4. Gateway
  5. MH350
  6. User manual

Abocom MH350 User Manual

Multi-homing gateway
Hide thumbs
Table of Contents

Advertisement

Quick Links

MH350
Multi-Homing Gateway
User's Manual
©2006 AboCom Systems, Inc. All rights reserved

Advertisement

Table of Contents
loading

Related Manuals for Abocom MH350

Summary of Contents for Abocom MH350

  • Page 1 MH350 Multi-Homing Gateway User's Manual ©2006 AboCom Systems, Inc. All rights reserved...

  • Page 2: Table Of Contents

    CHAPTER 1 ADMINISTRATOR................. 5 ........................... 7 DMIN ........................10 OGOUT ...................... 11 OFTWARE PDATE CHAPTER 2 CONFIGURE..................12 ........................17 ETTING ......................... 22 ....................... 23 ULTIPLE UBNET ......................26 OUTE ABLE DDNS.......................... 32 ......................... 34 ABLE ........................35 ANGUAGE CHAPTER 3 INTERFACE..................36 LAN ..........................
  • Page 3 ........................88 XAMPLE CHAPTER 9 CONTENT BLOCKING ..............92 URL..........................96 SCRIPT ........................99 P2P ..........................101 IM..........................103 ....................... 105 OWNLOAD CHAPTER 10 VIRTUAL SERVER ................107 ........................111 XAMPLE CHAPTER 11 VPN ..................... 126 ........................134 XAMPLE CHAPTER 12 POLICY....................159 ........................
  • Page 4 CHAPTER 17 STATISTICS ................... 227 WAN S ....................... 229 TATISTICS ..................... 231 OLICY TATISTICS CHAPTER 18 STATUS ................... 233 ......................... 234 NTERFACE ...................... 236 UTHENTICATION ARP T ........................ 237 ABLE DHCP C ......................238 LIENTS...

  • Page 5: Chapter 1 Administrator

    Administration “System” is the managing of settings such as the privileges of packets that pass through the MH350 and monitoring controls. The System Administrators can manage, monitor, and configure MH350 settings. But all configurations are “read-only” for all users other than the System Administrator; those users are not...
  • Page 6 Define the required fields of Administrator Administrator Name: The username of Administrators and Sub Administrator for the MH350. The admin user name cannot be removed; and the sub-admin user can be removed or configure. The default Account: admin; Password: admin Privilege: The privileges of Administrators (Admin or Sub Admin).

  • Page 7: Admin

    Admin Adding a new Sub Administrator STEP 1﹒In the Admin WebUI, click the New Sub Admin button to create a new Sub Administrator. STEP 2﹒In the Add New Sub Administrator WebUI (Figure 1-1) and enter the following setting: Sub Admin Name: sub_admin Password: 12345 Confirm Password: 12345 STEP 3﹒Click OK to...
  • Page 8 Modify the Administrator’s Password STEP 1﹒In the Admin WebUI, locate the Administrator name you want to edit, and click on Modify in the Configure field. STEP 2﹒The Modify Administrator Password WebUI will appear. Enter the following information: Password: admin New Password: 52364 Confirm Password: 52364 (Figure1-2) STEP 3﹒Click OK to confirm password change.
  • Page 9 To make Permitted IPs be effective, it must cancel the Ping and WebUI selection in the WebUI of MH350 that Administrator enter. (LAN, WAN, or DMZ Interface) Before canceling the WebUI selection of Interface, must set up the Permitted IPs first,...

  • Page 10: Logout

    Logout STEP 1﹒Click Logout in System to protect the system while Administrator are away. (Figure1-5) Figure1-5 Confirm Logout WebUI STEP 2﹒Click OK and the logout message will appear in WebUI. (Figure1-6) Figure1-6 Logout WebUI Message...

  • Page 11: Software Update

    To obtain the version number from Version Number and obtain the latest version from Internet. And save the latest version in the hardware of the PC, which manage the MH350 Click Browse and choose the latest software version file. Click OK and the system will update automatically. (Figure1-7) Figure1-7 Software Update It takes 3 minutes to update software.

  • Page 12: Chapter 2 Configure

    Chapter 2 Configure Configure The Configure is according to the basic setting of the MH350. In this chapter the definition is Setting, Date/Time, Multiple Subnet, Route Table, DHCP, Dynamic DNS, Hosts Table, and Language settings.
  • Page 13 Define the required fields of Settings MH350 Configuration: The Administrator can import or export the system settings. Click OK to import the file into the MH350 or click Cancel to cancel importing. You also can revive to default value here. Email Settings: Select Enable E-mail Alert Notification under E-mail Settings.
  • Page 14 Administration Packet Logging: After enable this function; the MH350 will record packet which source IP or destination address is MH350. And record in Traffic Log for System Manager to inquire about. Define the required fields of Time Settings Synchronize Time/Date: Synchronizing the MH350 with the System Clock.
  • Page 15 NAT Mode: It allows Internal Network to set multiple subnet address and connect with the Internet through different WAN IP Addresses. For example：The lease line of a company applies several real IP Addresses 168.85.88.0/24, and the company is divided into R&D department, service, sales department, procurement department, accounting department, the company can distinguish each department by different subnet for the purpose of managing conveniently.
  • Page 16 Define the required fields of DHCP Subnet: The domain name of LAN NetMask: The LAN Netmask Gateway: The default Gateway IP address of LAN Broadcast IP: The Broadcast IP of LAN Define the required fields of DDNS Domain Name: The domain name that provided by DDNS WAN IP Address: The WAN IP Address, which the domain name corresponds to.

  • Page 17: Setting

    STEP 2﹒When the File Download pop-up window appears, choose the destination place where to save the exported file and click on Save. The setting value of MH350 will copy to the appointed site instantly. (Figure2-1) Figure2-1 Select the Destination Place to Save the Exported File...
  • Page 18 STEP 1﹒In System Setting WebUI, click on the Browse button next to Import System Settings from Client. When the Choose File pop-up window appears, select the file to which contains the saved MH350 Settings, then click OK. (Figure2-2) STEP 2﹒Click OK to import the file into the MH350 (Figure2-3)

  • Page 19: Restoring Factory Default Settings

    Restoring Factory Default Settings STEP 1﹒Select Reset Factory Settings in MH350 Configuration WebUI STEP 2﹒Click OK at the bottom-right of the page to restore the factory settings. (Figure2-4) Figure2-4 Reset Factory Settings...
  • Page 20 Enabling E-mail Alert Notification STEP 1﹒Select Enable E-mail Alert Notification under E-Mail Settings. STEP 2﹒Device Name: Enter the Device Name or use the default value. STEP 3﹒Sender Address: Enter the Sender Address. (Required by some ISPs.) STEP 4﹒SMTP Server IP: Enter SMTP server’s IP address. STEP 5﹒E-Mail Address 1: Enter the e-mail address of the first user to be notified.
  • Page 21 Reboot MH350 STEP 1﹒Reboot MH350：Click Reboot button next to Reboot MH350 Appliance. STEP 2﹒A confirmation pop-up page will appear. STEP 3﹒Follow the confirmation pop-up page; click OK to restart MH350. (Figure2-6) Figure2-6 Reboot MH350...

  • Page 22: Date / Time

    STEP 4﹒Set the interval time to synchronize with outside servers. Figure2-7 System Time Setting Click on the Sync button and then the MH350’s date and time will be synchronized to the Administrator’s PC The value of Set Offset From GMT and Server IP / Name can be looking for from...

  • Page 23: Multiple Subnet

    Connect to the Internet through Multiple Subnet NAT or Routing Mode by the IP address that set by the LAN user’s network card Preparation MH350 WAN1 (10.10.10.1) connect to the ISP Router (10.10.10.2) and the subnet that provided by ISP is 162.172.50.0/24 To connect to Internet, WAN2 IP (211.22.22.22) connects with ATUR.
  • Page 24 Adding Multiple Subnet Add the following settings in Multiple Subnet of System function: Click on New Entry Alias IP of LAN Interface： Enter 162.172.50.1 Netmask：Enter 255.255.255.0 WAN1: Enter Interface IP 10.10.10.1, and choose Routing in Forwarding Mode WAN2：Enter Interface IP 211.22.22.22, and choose NAT in Forwarding Mode Click OK Complete Adding Multiple Subnet (Figure2-8)
  • Page 25 ˙162.172.50.xx, it uses Routing mode through WAN1 (The Internet Server can see your IP 162.172.50.xx directly). And uses NAT mode through WAN2 (The Internet Server can see your IP as WAN2 IP)(Figure2-9) Figure 2-9 Multiple Subnet Network The MH350’s Interface Status: WAN1 IP： 10.10.10.1 WAN2 IP：211.22.22.22 LAN Port IP：192.168.1.1...

  • Page 26: Route Table

    Route Table To connect two different subnet router with the MH350 and makes them to connect to Internet through MH350 Preparation Company A: WAN1 (61.11.11.11) connects with ATUR to Internet WAN2 (211.22.22.22) connects with ATUR to Internet LAN subnet: 192.168.1.1/24 The Router1 which connect with LAN (10.10.10.1, support RIPv2)
  • Page 27 Route Table STEP 1﹒Enter the following settings in Route Table in System function: 【Destination IP】: Enter 192.168.10.1 【Netmask】: Enter 255.255.255.0。 【Gateway】: Enter 192.168.1.252 【Interface】: Select LAN Click OK (Figure 2-10) Figure2-10 Add New Static Route1 STEP 2﹒Enter the following settings in Route Table in System function: 【Destination IP】: Enter 192.168.20.1 【Netmask】: Enter 255.255.255.0 【Gateway】: Enter 192.168.1.252...
  • Page 28 STEP 3﹒Enter the following setting in Route Table in System function: 【Destination IP】: Enter 10.10.10.0 【Netmask】: Enter 255.255.255.0 【Gateway】: Enter 192.168.1.252 【Interface】: Select LAN Click OK (Figure 2-12) Figure2-12 Add New Static Route3...
  • Page 29 STEP 4﹒Adding successful. At this time the computer of 192.168.10.1/24, 192.168.20.1/24 and 192.168.1.1/24 can connect with each other and connect to Internet by NAT (Figure 2-13) Figure 2-13 Route Table Setting...
  • Page 30 DHCP STEP 1﹒Select DHCP in System and enter the following settings: Domain Name：Enter the Domain Name DNS Server 1: Enter the distributed IP address of DNS Server1. DNS Server 2: Enter the distributed IP address of DNS Server2. WINS Server 1: Enter the distributed IP address of WINS Server1. WINS Server 2: Enter the distributed IP address of WINS Server2.
  • Page 31 Figure 2-14 DHCP WebUI When selecting Automatically Get DNS, the DNS Server will lock it as LAN Interface IP. (Using Occasion: When the system Administrator starts Authentication, the users’ first DNS Server must be the same as LAN Interface IP in order to enter Authentication WebUI)

  • Page 32: Ddns

    DDNS Dynamic DNS Settings STEP 1﹒Select Dynamic DNS in System function (Figure2-15). Click New Entry button Service providers：Select service providers. Automatically fill in the WAN 1/2 IP：Check to automatically fill in the WAN 1/2 IP.。 User Name：Enter the registered user name. Password：Enter the password Domain name：Enter Your host domain name Click OK to add Dynamic DNS.
  • Page 33 Chart Meaning Update Incorrect Connecting Unknown error successfully username or to server password If System Administrator had not registered a DDNS account, click on Sign up then can enter the website of the provider. If you do not select Automatically fill in the WAN IP and then you can enter a specific IP in WAN IP.

  • Page 34: Host Table

    Click OK to add Host Table. (Figure2-17) Figure2-17 Add New Host Table To use Host Table, the user PC’s first DNS Server must be the same as the LAN Port or DMZ Port IP of MH350. That is, the default gateway.

  • Page 35: Language

    Language Select the Language version (English Version/ Traditional Chinese Version or Simplified Chinese Version) and click OK. (Figure2-18) Figure2-18 Language Setting WebUI...

  • Page 36: Chapter 3 Interface

    Chapter 3 Interface Interface In this section, the Administrator can set up the IP addresses for the office network. The Administrator may configure the IP addresses of the LAN network, the WAN 1/2 network, and the DMZ network. The Netmask and gateway IP addresses are also configured in this section.
  • Page 37 Select this function to allow the LAN users to ping the Interface IP Address. HTTP: Select to enable the user to enter the WebUI of MH350 from Interface IP. WAN: The System Administrator can set up the WAN network of MH350.
  • Page 38 Dynamic IP Address (Cable Modem User) Static IP Address Saturated Connections: Set the number for saturation whenever session numbers reach it, the MH350 switches to the next agent on the list. Priority: Set priority of WAN for Internet Access. Connection Test: To test if the WAN network can connect to Internet or not.
  • Page 39 DMZ: The Administrator uses the DMZ Interface to set up the DMZ network. The DMZ includes: NAT Mode：In this mode, the DMZ is an independent virtual subnet. This virtual subnet can be set by the Administrator but cannot be the same as LAN Interface.
  • Page 40 We set up four Interface Address examples in this chapter: Suitable Example Page Situation Modify LAN Interface Settings Setting WAN Interface Address Setting DMZ Interface Address (NAT Mode) Setting DMZ Interface Address (Transparent Mode)

  • Page 41: Lan

    LAN IP Address on the computer , he/she have to restart the System to make the new IP address effective. (when the computer obtain IP by DHCP) Do not cancel WebUI selection before not setting Permitted IPs yet. It will cause the Administrator cannot be allowed to enter the MH350’s WebUI from LAN.

  • Page 42: Wan

    Setting WAN Interface Address STEP 1﹒Select WAN in Interface and click Modify in WAN1 Interface. The setting of WAN2 Interface is almost the same as WAN1. The difference is that WAN2 has a selection of Disable. The System Administrator can close WAN2 Interface by this selection.
  • Page 43 Figure3-3 ICMP Connection Figure 3-4 DNS Service Connection test is used for MH350 to detect if the WAN can connect or not. So the Alive Indicator Site IP, DNS Server IP Address, or Domain Name must be able to use permanently. Or it will cause judgmental mistakes of the device.
  • Page 44 STEP 3﹒Select the Connecting way: PPPoE (ADSL User) (Figure3-5): 1. Select PPPoE 2. Enter User Name as an account 3. Enter Password as the password 4. Select Dynamic or Fixed in IP Address provided by ISP. If you select Fixed, please enter IP Address, Netmask, and Default Gateway.
  • Page 45 Figure3-5 PPPoE Connection Figure3-6 Complete PPPoE Connection Setting If the connection is PPPoE, you can choose Service-On-Demand for WAN Interface to connect automatically when disconnect; or to set up Auto Disconnect if idle (not recommend)
  • Page 46 Dynamic IP Address (Cable Modem User) (Figure3-7): 1. Select Dynamic IP Address (Cable Modem User) 2. Click Renew in the right side of IP Address and then can obtain IP automatically. 3. If the MAC Address is required for ISP then click on Clone MAC Address to obtain MAC IP automatically.
  • Page 47 Figure3-7 Dynamic IP Address Connection Figure3-8 Complete Dynamic IP Connection Setting...
  • Page 48 Static IP Address (Figure3-9) 1. Select Static IP Address 2. Enter IP Address, Netmask, and Default Gateway that provided by ISP 3. Enter DNS Server1 and DNS Server2 In WAN2, the connecting of Static IP Address does not need to set DNS Server 4.
  • Page 49 When selecting Ping and WebUI on WAN network Interface, users will be able to ping the MH350 and enter the WebUI WAN network. It may influence network security. The suggestion is to Cancel Ping and WebUI after all the settings have finished. And if the System Administrator needs to enter UI from WAN, he/she can use Permitted IPs to enter.

  • Page 50: Dmz

    Setting DMZ Interface Address (NAT Mode) STEP 1﹒Click DMZ Interface STEP 2﹒Select NAT Mode in DMZ Interface Select NAT in DMZ Interface Enter IP Address and Netmask STEP 3﹒Select Ping and HTTP STEP 4﹒Click OK (Figure3-11) Figure3-11 Setting DMZ Interface Address (NAT Mode) WebUI...
  • Page 51 Setting DMZ Interface Address (Transparent Mode) STEP 1﹒Select DMZ Interface STEP 2﹒Select Transparent Mode in DMZ Interface Select DMZ_Transparent in DMZ Interface STEP 1﹒Select Ping and HTTP STEP 2﹒Click OK (Figure3-12) Figure 3-12 Setting DMZ Interface Address (Transparent Mode) WebUI In WAN, the connecting way must be Static IP Address and can choose Transparent Mode in DMZ.

  • Page 52: Chapter 4 Address

    Chapter 4 Address Address The MH350 allows the Administrator to set Interface addresses of the LAN network, LAN network group, WAN network, WAN network group, DMZ and DMZ group. An IP address in the Address Table can be an address of a computer or a sub network.
  • Page 53 Define the required fields of Address Name: The System Administrator set up a name as IP Address that is easily recognized. IP Address: It can be a PC’s IP Address or several IP Address of Subnet. Different network area can be: Internal IP Address, External IP Address, and DMZ IP Address.
  • Page 54 We set up two Address examples in this chapter: Suitable Example Page Situation Under DHCP circumstances, assign the specific IP to static users and restrict them to access FTP net service only through policy. LAN Group Set up a policy that only allows partial users to connect with specific IP (External Specific IP)

  • Page 55: Example

    Example Under DHCP situation, assign the specific IP to static users and restrict them to access FTP net service only through policy STEP 1﹒Select LAN in Address and enter the following settings: Click New Entry button (Figure4-1) Name: Enter Rayearth IP Address: Enter 192.168.3.2 Netmask: Enter 255.255.255.255 MAC Address : Enter the user’s MAC Address...
  • Page 56 STEP 2﹒Adding the following setting in Outgoing Policy: (Figure4-3) Figure 4-3 Add a Policy of Restricting the Specific IP to Access to Internet STEP 3﹒Complete assigning the specific IP to static users in Outgoing Policy and restrict them to access FTP net service only through policy: (Figure4-4) Figure 4-4 Complete the Policy of Restricting the Specific IP to Access to Internet...
  • Page 57 MH350 to fill out the user’s MAC Address automatically. In LAN of Address function, the MH350 will default an Inside Any address represents the whole LAN network automatically. Others like WAN, DMZ also have the Outside Any and DMZ Any default address setting to represent the whole subnet.
  • Page 58 Setup a policy that only allows partial users to connect with specific IP (External Specific IP) STEP 1﹒Setting several LAN network Address. (Figure4-5) Figure4-5 Setting Several LAN Network Address...
  • Page 59 STEP 2﹒Enter the following settings in LAN Group of Address: Click New Entry (Figure 4-6) Enter the Name of the group Select the users in the Available Address column and click Add Click OK (Figure 4-7) Figure4-6 Add New LAN Address Group Figure4-7 Complete Adding LAN Address Group The setting mode of WAN Group and DMZ Group of Address are the same as LAN Group.
  • Page 60 STEP 3﹒Enter the following settings in WAN of Address function: Click New Entry (Figure4-8) Enter the following data (Name, IP Address, Netmask) Click OK (Figure4-9) Figure4-8 Add New WAN Address Figure4-9 Complete the Setting of WAN Address...
  • Page 61 STEP 4﹒To exercise STEP1~3 in Policy (Figre4-10, 4-11) Figure4-10 To Exercise Address Setting in Policy Figure4-11 Complete the Policy Setting The Address function really take effect only if use with Policy.

  • Page 62: Chapter 5 Service

    TCP and UDP protocols support varieties of services, and each service consists of a TCP Port or UDP port number, such as TELNET (23), SMTP (21), SMTP (25), POP3 (110), etc. The MH350 includes two services: Pre-defined Service and Custom Service.
  • Page 63 it takes only one control policy to achieve the same effect as the 50 control policies.
  • Page 64 Define the required fields of Service Pre-defined WebUI’s Chart and Illustration: Chart Illustration Any Service TCP Service, For example：FTP, FINGER, HTTP, HTTPS , IMAP, SMTP, POP3, ANY, AOL, BGP, GOPHER, Inter Locator, IRC, L2TP, LDAP, NetMeeting, NNTP, PPTP, Real Media, RLOGIN, SSH, TCP ANY, TELNET, VDO Live, WAIS, WINFRAME, X-WINDOWS, …etc.
  • Page 65 We set up two Service examples in this chapter: Suitable Example Page Situation Allow external user to communicate with internal Custom user by VoIP through policy. (VoIP Port: TCP 1720, TCP 15325-15333, UDP 15325-15333) Group Setting service group and restrict the specific users only can access to service resource that provided by this group through policy.

  • Page 66: Custom

    Custom Allow external user to communicate with internal user by VoIP through policy. (VoIP Port: TCP 1720, TCP 15328-15333, UDP 15328-15333) STEP 1﹒Set LAN and LAN Group in Address function as follows: (Figure5-1, 5-2) Figure5-1 Setting LAN Address Book WebUI Figure5-2 Setting LAN Group Address Book WebUI...
  • Page 67 STEP 2﹒Enter the following setting in Custom of Service function: Click New Entry (Figure5-3) Service Name: Enter the preset name VoIP Protocol#1 select TCP, need not to change the Client Port, and set the Server Port as: 1720:1720 Protocol#2 select TCP, need not to change the Client Port, and set the Server Port as: 15328:15333 Protocol#3 select UDP, need not to change the Client Port, and set the Server Port as: 15328:15333...
  • Page 68 Under general circumstances, the range of port number of client is 1024-65535. Change the client range in Custom of is not suggested. If the port numbers that enter in the two spaces are different port number, then enable the port number under the range between the two different port numbers (for example: 15328:15333).
  • Page 69 STEP 3﹒Compare Service to Virtual Server. (Figure5-5) Figure5-5 Compare Service to Virtual Server STEP 4﹒Compare Virtual Server to Incoming Policy. (Figure5-6) Figure5-6 Complete the Policy for External VoIP to Connect with Internal VoIP STEP 5﹒In Outgoing Policy, complete the setting of internal users using VoIP to connect with external network VoIP: (Figure5-7) Figure5-7 Complete the Policy for Internal VoIP to Connect with External VoIP Service must cooperate with Policy and Virtual Server that the function can take...

  • Page 70: Group

    Group Setting service group and restrict the specific users only can access to service resource that provided by this group through policy (Group: HTTP, POP3, SMTP, DNS) STEP 1﹒Enter the following setting in Group of Service: Click New Entry (Figure 5-8) Name: Enter Main_Service Select HTTP, POP3, SMTP, DNS in Available Service and click Click OK (Figure 5-9)
  • Page 71 Figure5-9 Complete the setting of Adding Service Group If you want to remove the service you choose from Selected Service, choose the service you want to delete and click Remove.
  • Page 72 STEP 2﹒In LAN Group of Address function, Setting an Address Group that can include the service of access to Internet. (Figure5-10) Figure5-10 Setting Address Book Group STEP 3﹒Compare Service Group to Outgoing Policy. (Figure5-11) Figure5-11 Setting Policy...

  • Page 73: Chapter 6 Schedule

    Chapter 6 Schedule Schedule In this chapter, the MH350 provides the Administrator to configure a schedule for policy to take effect and allow the policies to be used at those designated times. And then the Administrator can set the start time and stop time or VPN connection in Policy or VPN.

  • Page 74: Example

    Example To configure the valid time periods for LAN users to access to Internet in a day STEP 1﹒Enter the following in Schedule: Click New Entry (Figure6-1) Enter Schedule Name Set up the working time of Schedule for each day Click OK (Figure6-2) Figure6-1 Setting Schedule WebUI Figure6-2 Complete the Setting of Schedule...
  • Page 75 STEP 2﹒Compare Schedule with Outgoing Policy (Figure6-3) Figure6-3 Complete the Setting of Comparing Schedule with Policy The Schedule must compare with Policy .

  • Page 76: Chapter 7 Qos

    QoS Priority：To configure the priority of distributing Upstream/Downstream and unused bandwidth. The MH350 configures the bandwidth by different QoS, and selects the suitable QoS through Policy to control and efficiently distribute bandwidth. The MH350 also makes it convenient for the administrator to make the Bandwidth to reach the best utility.
  • Page 77 Figure7-2 the Flow After Using QoS (Max. Bandwidth: 400Kbps, Guaranteed Bandwidth: 200Kbps)
  • Page 78 Define the required fields of QoS WAN: Display WAN1 and WAN2 Downstream Bandwidth: To configure the Guaranteed Bandwidth and Maximum Bandwidth according to the bandwidth range you apply from ISP Upstream Bandwidth: To configure the Guaranteed Bandwidth and Maximum Bandwidth according to the bandwidth range you apply from ISP Priority: To configure the priority of distributing Upstream/Downstream and unused...
  • Page 79 We set up two QoS examples in this chapter: No Suitable Example Page Situation Setting a policy that can restrict the user’s downstream and upstream bandwidth.

  • Page 80: Example

    Example Setting a policy that can restrict the user’s downstream and upstream bandwidth STEP 1﹒Enter the following settings in QoS: Click New Entry (Figure7-3) Name: The name of the QoS you want to configure. Enter the bandwidth in WAN1, WAN2 Select QoS Priority Click OK (Figure7-4) Figure7-3 QoS WebUI Setting...
  • Page 81 STEP 2﹒Use the QoS that set by STEP1 in Outgoing Policy. (Figure7-5, 7-6) Figure7 -5 Setting the QoS in Policy Figure7-6 Complete Policy Setting When the administrator are setting QoS, the bandwidth range that can be set is the value that system administrator set in the WAN of Interface. So when the System Administrator sets the downstream and upstream bandwidth in WAN of Interface, he/she must set up precisely.

  • Page 82: Chapter 8 Authentication

    Authentication By configuring the Authentication, you can control the user’s connection authority. The user has to pass the authentication to access to Internet. The MH350 configures the authentication of LAN’s user by setting account and password to identify the privilege.
  • Page 83 Define the required fields of Authentication Authentication Management Provide the Administrator the port number and valid time to setup MH350 authentication. (Have to setup the Authentication first) Authentication Port: The internal user have to pass the authentication to access to the Internet when enable MH350.
  • Page 84 When the user connect to external network by Authentication, the following page will be displayed: (Figure8-2) Figure8-2 Authentication Login WebUI...
  • Page 85 It will connect to the appointed website after passing Authentication: (Figure8-3) Figure8-3 Connecting to the Appointed Website After Authentication If the user ask for authentication positively, can enter the LAN IP by the Authentication port number. And then the Authentication WebUI will be displayed.
  • Page 86 Auth-User Name: The user account for Authentication you want to set. Password: The password when setting up Authentication. Confirm Password: Enter the password that correspond to Password...
  • Page 87 We set up four Authentication examples in this chapter: Suitable Example Page Situation Auth User Setting specific users to connect with external Auth Group network only before passing the authentication of policy. （Adopt the built-in Auth User and Auth Group Function）...

  • Page 88: Example

    （Adopt the built-in Auth User and Auth Group Function） STEP 1﹒Setup several Auth User in Authentication. (Figire8-4) Figure8-4 Setting Several Auth Users WebUI To use Authentication, the DNS Server of the user’s network card must be the same as the LAN Interface Address of MH350.
  • Page 89 STEP 2﹒Add Auth User Group Setting in Authentication function and enter the following settings: Click New Entry Name: Enter laboratory Select the Auth User you want and Add to Selected Auth User Click OK Complete the setting of Auth User Group (Figure8-5) Figure8-5 Setting Auth Group WebUI...
  • Page 90 STEP 3﹒Add a policy in Outgoing Policy and input the Address and Authentication of STEP 2 (Figure8-6, 8-7) Figure8-6 Auth-User Policy Setting Figure8-7 Complete the Policy Setting of Auth-User...
  • Page 91 STEP 4﹒When user is going to access to Internet through browser, the authentication UI will appear in Browser. After entering the correct user name and password, click OK to access to Internet. (Figure8-8) STEP 5﹒If the user does not need to access to Internet anymore and is going to logout, he/she can click LOGOUT Auth-User to logout the system.

  • Page 92: Chapter 9 Content Blocking

    Chapter 9 Content Blocking Content Filtering Content Filtering includes「URL」,「Script」,「P2P」,「IM」,「Download」. 【URL Blocking】 ： The administrator can set up to “Allow” or “Restrict” entering the specific website by complete domain name, key words, and met character (～and＊). 【Script Blocking】 ： The access authority of Popup, ActiveX, Java, Cookies 【P2P Blocking】...
  • Page 93 Define the required fields of Content Blocking URL String: The domain name that restricts to enter or only allow entering. Popup Blocking: Prevent the pop-up WebUI appearing ActiveX Blocking: Prevent ActiveX packets Java Blocking: Prevent Java packets Cookies Blocking: Prevent Cookies packets eDonkey Blocking: Prevent users to deliver files by eDonkey and eMule BitTorrent Blocking:...
  • Page 94 Sub-name file Blocking: Prevent users to deliver specific sub-name file by http All Type: Prevent users to send the Audio, Video types, and sub-name file…etc. by http protocol.
  • Page 95 We set up five Content Blocking examples in this chapter: Suitable Example Page Situation URL Blocking Restrict the Internal Users only can access to some specific Website Script Restrict the Internal Users to access to Script Blocking file of Website. P2P Blocking Restrict the Internal Users to access to the file on Internet by P2P.

  • Page 96: Url

    Restrict the Internal Users only can access to some specific Website ※URL Blocking: Symbol: ～ means open up; ＊ means metacharacter Restrict not to enter specific website: Enter the 「complete domain name」 or 「key word」 of the website you want to restrict in URL String. For example: www.kcg.gov.tw or gov.
  • Page 97 STEP 1﹒Enter the following in URL of Content Filtering function: Click New Entry URL String: Enter ~yahoo, and click OK Click New Entry URL String: Enter ~google, and click OK Click New Entry URL String: Enter ＊, and click OK Complete setting a URL Blocking policy (Figure9-1) Figure9-1 Content Filtering Table...
  • Page 98 STEP 2﹒Add a Outgoing Policy and use in Content Blocking function: (Figure9-2) Figure9-2 URL Blocking Policy Setting STEP 3﹒Complete the policy of permitting the internal users only can access to some specific website in Outgoing Policy function: (Figure9-3) Figure9-3 Complete Policy Settings Afterwards the users only can browse the website that include “yahoo”...

  • Page 99: Script

    SCRIPT Restrict the Internal Users to access to Script file of Website STEP 1﹒Select the following data in Script of Content Blocking function: Select Popup Blocking Select ActiveX Blocking Select Java Blocking Select Cookies Blocking Click OK Complete the setting of Script Blocking (Figure9-4) Figure9-4 Script Blocking WebUI...
  • Page 100 STEP 2﹒Add a new Outgoing Policy and use in Content Blocking function: (Figure9-5) Figure9-5 New Policy of Script Blocking Setting STEP 3﹒Complete the policy of restricting the internal users to access to Script file of Website in Outgoing Policy: (Figure9-6) Figure9-6 Complete Script Blocking Policy Setting The users may not use the specific function (like JAVA, cookie…etc.) to browse the website through this policy.

  • Page 101: P2P

    Restrict the Internal Users to access to the file on Internet by P2P STEP 1﹒Select the following data in P2P of Content Blocking function: Select eDonkey Blocking Select BitTorrent Blocking Select WinMX Blocking Click OK Complete the setting of P2P Blocking (Figure9-7) Figure9-7 P2P Blocking WebUI...
  • Page 102 STEP 2﹒Add a new Outgoing Policy and use in Content Blocking function: (Figure9-8) Figure9-8 Add New Policy of P2P Blocking STEP 3﹒Complete the policy of restricting the internal users to access to the file on Internet by P2P in Outgoing Policy: (Figure9-9) Figure9-9 Complete P2P Blocking Policy Setting P2P Transfer will occupy large bandwidth so that it may influence other users.
  • Page 103 Restrict the Internal Users to send message, files, video and audio by Instant Messaging STEP 1﹒Enter as following in IM Blocking of Content Blocking function: Select MSN Messenger, Yahoo Messenger, ICQ Messenger, QQ Messenger and Skype. Click OK Complete the setting of IM Blocking. (Figure9-10) Figure9-10 IM Blocking WebUI...
  • Page 104 STEP 2﹒Add a new Outgoing Policy and use in Content Blocking function: (Figire9-11) Figure9-11 Add New IM Blocking Policy STEP 3﹒Complete the policy of restricting the internal users to send message, files, audio, and video by instant messaging in Outgoing Policy: (Figure9-12) Figure9-12 Complete IM Blocking Policy Setting...

  • Page 105: Download

    Download Restrict the Internal Users to access to video, audio, and some specific sub-name file from http or ftp protocol directly STEP 1﹒Enter the following settings in Download of Content Blocking function: Select All Types Blocking Click OK Complete the setting of Download Blocking. (Figure9-13) Figure9-13 Download Blocking WebUI...
  • Page 106 STEP 2﹒Add a new Outgoing Policy and use in Content Blocking function: (Figure9-14) Figure9-14 Add New Download Blocking Policy Setting STEP 3﹒Complete the Outgoing Policy of restricting the internal users to access to video, audio, and some specific sub-name file by http protocol directly: (Figure9-15) Figure9-15 Complete Download Blocking Policy Setting...

  • Page 107: Chapter 10 Virtual Server

    IP address. The MH350’s Virtual Server function can solve this problem. A Virtual Server has set the real IP address of the MH350’s WAN network interface to be the Virtual Server IP. Through the Virtual Server function, the MH350 translates the Virtual Server’s IP address into the private IP address in the LAN network.
  • Page 108 IP Address directly. The user must connect to the MH350’s WAN subnet’s Real IP and then map Real IP to Private IP of LAN by the MH350. It is a one-to-one mapping. That is, to map all the service of one WAN Real IP Address to one LAN Private IP Address.
  • Page 109 Define the required fields of Virtual Server WAN IP： WAN IP Address (Real IP Address) Map to Virtual IP： Map the WAN Real IP Address into the LAN Private IP Address Virtual Server Real IP： The WAN IP address which mapped by the Virtual Server. Service name (Port Number)：...
  • Page 110 We set up four Virtual Server examples in this chapter: Suitable Example Page Situation Mapped IP Make a single server that provides several services such as FTP, Web, and Mail, to provide service by policy. Virtual Server Make several servers that provide a single service, to provide service through policy by Virtual Server.

  • Page 111: Example

    Example Make a single server that provides several services such as FTP, Web, and Mail, to provide service by policy STEP 1﹒Setting a server that provide several services in LAN, and set up the network card’s IP as 192.168.1.100. DNS is External DNS Server. STEP 2﹒Enter the following setting in LAN of Address function: (Figure10-1) Figure10-1 Mapped IP Settings of Server in Address STEP 3﹒Enter the following data in Mapped IP of Virtual Server function:...
  • Page 112 STEP 4﹒Group the services (DNS, FTP, HTTP, POP3, SMTP…) that provided and used by server in Service function. And add a new service group for server to send mails at the same time. (Figure10-3) Figure10-3 Service Setting STEP 5﹒Add a policy that includes settings of STEP3, 4 in Incoming Policy. (Figure10-4) Figure10-4 Complete the Incoming Policy STEP 6﹒Add a policy that includes STEP2, 4 in Outgoing Policy.
  • Page 113 STEP 7﹒Complete the setting of providing several services by mapped IP. (Figure10-6) Figure10-6 A Single Server that Provides Several Services by Mapped IP Strong suggests not to choose ANY when setting Mapped IP and choosing service. Otherwise the Mapped IP will be exposed to Internet easily and may be attacked by Hacker.
  • Page 114 Make several servers that provide a single service, to provide service through policy by Virtual Server (Take Web service for example) STEP 1﹒Setting several servers that provide Web service in LAN network, which IP Address is 192.168.1.101, 192.168.1.102, 192.168.1.103, and 192.168.1.104...
  • Page 115 STEP 2﹒Enter the following data in Server 1 of Virtual Server function: Click the button next to Virtual Server Real IP (“click here to configure”) in Server 1 Virtual Server Real IP: Enter 211.22.22.23 (click Assist for assistance) Click OK (Figure10-7) Figure10-7 Virtual Server Real IP Setting Click New Entry Service: Select HTTP (80)
  • Page 116 STEP 3﹒Add a new policy in Incoming Policy, which includes the virtual server, set by STEP2. (Figure10-9) Figure10-9 Complete Virtual Server Policy Setting In this example, the external users must change its port number to 8080 before entering the Website that set by the Web server. STEP 4﹒Complete the setting of providing a single service by virtual server.
  • Page 117 The external user use VoIP to connect with VoIP of LAN (VoIP Port: TCP 1720, TCP 15328-15333, UDP 15328-15333) STEP 1﹒Set up VoIP in LAN network, and its IP is 192.168.1.100 STEP 2﹒Enter the following setting in LAN of Address function: (Figure10-11) Figure10-11 Setting LAN Address WebUI STEP 3﹒Add new VoIP service group in Custom of Service function.
  • Page 118 STEP 4﹒Enter the following setting in Server1 of Virtual Server function: Click the button next to Virtual Server Real IP (“click here to configure”) in Server1 Virtual Server Real IP: Enter 61.11.11.12 (click Assist for assistance) (Use WAN) Click OK (Figure10-13) Figure10-13 Virtual Server Real IP Setting WebUI Click New Entry Service: Select (Custom Service) VoIP_Service...
  • Page 119 STEP 5﹒Add a new Incoming Policy, which includes the virtual server that set by STEP4: (Figure10-15) Figure10-15 Complete the Policy includes Virtual Server Setting STEP 6﹒Enter the following setting of the internal users using VoIP to connect with external network VoIP in Outgoing Policy: (Figure10-16) Figure10-16 Complete the Policy Setting of VoIP Connection...
  • Page 120 STEP 7﹒Complete the setting of the external/internal user using specific service to communicate with each other by Virtual Server. (Figure10-17) Figure10-17 Complete the Setting of the External/Internal User using specific service to communicate with each other by Virtual Server...
  • Page 121 Make several servers that provide several same services, to provide service through policy by Virtual Server. (Take HTTP, POP3, SMTP, and DNS Group for example) STEP 1﹒Setting several servers that provide several services in LAN network. Its network card’s IP is 192.168.1.101, 192.168.1.102, 192.168.1.103, 192.168.1.104 and the DNS setting is External DNS server.
  • Page 122 STEP 3﹒Group the service of server in Custom of Service. Add a Service Group for server to send e-mail at the same time. (Figure10-20) Figure10-20 Add New Service Group...
  • Page 123 STEP 4﹒Enter the following data in Server1 of Virtual Server: Click the button next to Virtual Server Real IP (“click here to configure”) in Server1 Virtual Server Real IP: Enter 211.22.22.23 (click Assist for assistance) Click OK (Figure10-21) Figure10-21 Virtual Server Real IP Setting Click New Entry Service: Select (Group Service) Main_Service External Service Port: From-Service (Group)
  • Page 124 STEP 5﹒Add a new Incoming Policy, which includes the virtual server that set by STEP 3: (Figure10-23) Figure10-23 Complete Incoming Policy Setting STEP 6﹒Add a new policy that includes the settings of STEP2, 3 in Outgoing Policy. It makes server can send e-mail to external mail server by mail service.
  • Page 125 STEP 7﹒Complete the setting of providing several services by Virtual Server. (Figure10-25) Figure10-25 Complete the Setting of Providing Several Services by Several Virtual Server...

  • Page 126: Chapter 11 Vpn

    Chapter 11 VPN The MH350 adopts VPN to set up safe and private network service. And combine the remote Authentication system in order to integrate the remote network and PC of the enterprise. Also provide the enterprise and remote users a safe encryption way to have best efficiency and encryption when delivering data.
  • Page 127 Define the required fields of VPN: RSA: A public-key cryptosystem for encryption and authentication. Preshared Key: The IKE VPN must be defined with a Preshared Key. The Key may be up to 128 bytes long. ISAKMP (Internet Security Association Key Management Protocol): An extensible protocol-encoding scheme that complies to the Internet Key Exchange (IKE) framework for establishment of Security Associations (SAs).
  • Page 128 DES (Data Encryption Standard): The Data Encryption Standard developed by IBM in 1977 is a 64-bit block encryption block cipher using a 56-bit key. Triple-DES (3DES): The DES function performed three times with either two or three cryptographic keys. AES (Advanced Encryption Standard): An encryption algorithm yet to be decided that will be used to replace the aging DES encryption algorithm and that the NIST hopes will last for the next 20 to 30 years.
  • Page 129 Define the required fields of IPSec Function To display the VPN connection status via icon。 Chart Meaning Not be applied Disconnect Connecting Name: The VPN name to identify the IPSec Autokey definition. The name must be the only one and cannot be repeated. Gateway IP: The WAN interface IP address of the remote Gateway.
  • Page 130 Define the required fields of PPTP Server Function PPTP Server: To select Enable or Disable Client IP Range: Setting the IP addresses range for PPTP Client connection To display the VPN connection status via icon。 Chart Meaning Not be applied Disconnect Connecting User Name: Display the PPTP Client user’s name when connecting to PPTP Server.
  • Page 131 Define the required fields of PPTP Client Function To display the VPN connection status via icon。 Chart Meaning Not be applied Disconnect Connecting User Name: Displays the PPTP Client user’s name when connecting to PPTP Server. Server IP or Domain Name: Display the PPTP Server IP addresses or Domain Name when connecting to PPTP Server.
  • Page 132 Define the required fields of Tunnel Function To display the VPN connection status via icon。 Chart Meaning Not be applied Disconnect Connecting Name: The VPN name to identify the VPN tunnel definition. The name must be the only one and cannot be repeated. Source Subnet: Displays the Source Subnet.
  • Page 133 We set up two VPN examples in this chapter: No. Suitable Example Page Situation Ex1 IPSec Autokey Setting IPSec VPN connection between two MH350 Ex2 PPTP Setting PPTP VPN connection between two MH350...

  • Page 134: Example

    VPN connection with Company B 192.168.20.100 downloading the sharing file. The Default Gateway of Company A is the LAN IP of the MH350 192.168.10.1. Follow the steps below: STEP 1﹒Enter the default IP of Gateway of Company A’s MH350, 192.168.10.1 and select IPSec Autokey in VPN.
  • Page 135 STEP 3﹒Select Remote Gateway-Fixed IP or Domain Name In To Destination list and enter the IP Address.(Figure11-7) Figure11-7 IPSec To Destination Setting STEP 4﹒Select Preshare in Authentication Method and enter the Preshared Key (max: 100 bits) (Figure11-8) Figure11-8 IPSec Authentication Method Setting STEP 5﹒Select ISAKMP Algorithm in Encapsulation list.
  • Page 136 STEP 6﹒You can choose Data Encryption + Authentication or Authentication Only to communicate in IPSec Algorithm list: ENC Algorithm: 3DES/DES/AES/NULL AUTH Algorithm: MD5/SHA1 Here we select 3DES for ENC Algorithm and MD5 for AUTH Algorithm to make sure the encapsulation way for data transmission (Figure11-10) Figure11-10 IPSec Algorithm Setting STEP 7﹒After selecting GROUP1 in Perfect Forward Secrecy, enter 3600 seconds in ISAKMP Lifetime, enter 28800 seconds in IPSec Lifetime, and...
  • Page 138 STEP 9﹒Enter the following setting in Tunnel of VPN function: (Figure11-13) Enter a specific Tunnel Name. From Source: Select LAN From Source Subnet / Mask: Enter 192.168.10.0 / 255.255.255.0. To Destination: Select To Destination Subnet / Mask. To Destination Subnet / Mask: Enter 192.168.20.0 / 255.255.255.0.
  • Page 139 STEP 10﹒Enter the following setting in Outgoing Policy:(Figure11-15) Authentication User: Select All_NET. Schedule: Select Schedule_1. QoS: Select QoS_1. Tunnel: Select IPSec_VPN_Tunnel. Click OK.(Figure11-16) Figure11-15 Setting the VPN Tunnel Outgoing Policy Figure11-16 Complete the VPN Tunnel Outgoing Policy Setting...
  • Page 140 STEP 11﹒Enter the following setting in Incoming Policy: (Figure11-17) Schedule: Select Schedule_1. QoS: Select QoS_1. Tunnel: Select IPSec_VPN_Tunnel. Click OK.(Figure11-18) Figure11-17 Setting the VPN Tunnel Incoming Policy Figure11-18 Complete the VPN Tunnel Incoming Policy Setting...
  • Page 141 The Default Gateway of Company B is the LAN IP of the MH350 192.168.20.1. Follow the steps below: STEP 1.Enter the following setting in Multiple Subnet of System Configure function: (Figure11-19) Figure11-19 Multiple Subnet Setting STEP 2.Enter the default IP of Gateway of Company B’s MH350, 192.168.20.1 and select IPSec Autokey in VPN.
  • Page 142 STEP 4.Select Remote Gateway-Fixed IP or Domain Name In To Destination list and enter the IP Address.(Figure11-22) Figure11-22 IPSec To Destination Setting STEP 5.Select Preshare in Authentication Method and enter the Preshared Key (max: 100 bits) (Figure11-23) Figure11-23 IPSec Authentication Method Setting STEP 6.Select ISAKMP Algorithm in Encapsulation list.
  • Page 143 STEP 7.You can choose Data Encryption + Authentication or Authentication Only to communicate in IPSec Algorithm list: ENC Algorithm: 3DES/DES/AES/NULL AUTH Algorithm: MD5/SHA1 Here we select 3DES for ENC Algorithm and MD5 for AUTH Algorithm to make sure the encapsulation way for data transmission. (Figure11-25) Figure11-25 IPSec Algorithm Setting STEP 8.After selecting GROUP1 in Perfect Forward Secrecy, enter 3600 seconds in ISAKMP Lifetime, enter 28800 seconds in IPSec Lifetime, and...
  • Page 144 STEP 10.Enter the following setting in Tunnel of VPN function: (Figure11-28 Enter a specific Tunnel Name. From Source: Select LAN From Source Subnet / Mask: Enter 192.168.20.0 / 255.255.255.0. To Destination: Select To Destination Subnet / Mask. To Destination Subnet / Mask: Enter 192.168.10.0 / 255.255.255.0.
  • Page 145 STEP 11.Enter the following setting in Outgoing Policy: (Figure11-30 Authentication User: Select All_NET. Schedule: Select Schedule_1. QoS: Select QoS_1. Tunnel: Select IPSec_VPN_Tunnel. Click OK.(Figure11-31) Figure11-30 Setting the VPN Tunnel Outgoing Policy Figure11-31 Complete the VPN Tunnel Outgoing Policy Setting...
  • Page 146 STEP 12.Enter the following setting in Incoming Policy: (Figure11-32) Schedule: Select Schedule_1. QoS: Select QoS_1. Tunnel: Select IPSec_VPN_Tunnel. Click OK.(Figure11-33) Figure11-32 Setting the VPN Tunnel Incoming Policy Figure11-33 Complete the VPN Tunnel Incoming Policy Setting...
  • Page 147 STEP 13.Complete IPSec VPN Connection. (Figure11-34) Figure 11-34 IPSec VPN Connection Deployment...
  • Page 148 Company A WAN IP: 61.11.11.11 LAN IP: 192.168.10.X Company B WAN IP: 211.22.22.22 LAN IP: 192.168.20.X This example takes two MH350 as flattop. Suppose Company B 192.168.20.100 is going to have VPN connection with Company A 192.168.10.100 and download the resource.
  • Page 149 The Default Gateway of Company A is the LAN IP of the MH350 192.168.10.1. Follow the steps below: STEP 1.Enter PPTP Server of VPN function in the MH350 of Company A. Select Modify and enable PPTP Server: Select Encryption. Client IP Range: Enter 192.44.75.1-254.
  • Page 150 STEP 2.Add the following settings in PPTP Server of VPN function in the MH350 of Company A: Select New Entry. (Figure11-36) User Name: Enter PPTP_Connection. Password: Enter 123456789. Client IP assigned by: Select IP Range. Click OK. (Figure11-37) Figure 11-36 PPTP VPN Server Setting...
  • Page 151 STEP 3.Enter the following setting in Tunnel of VPN function: (Figure11-38) Enter a specific Tunnel Name. From Source: Select LAN From Source Subnet / Mask: Enter 192.168.10.0 / 255.255.255.0. To Destination: Select To Destination Subnet / Mask. To Destination Subnet / Mask: Enter 192.168.20.0 / 255.255.255.0.
  • Page 152 STEP 4.Enter the following setting in Outgoing Policy: (Figure11-40) Authentication User: Select All_NET. Schedule: Select Schedule_1. QoS: Select QoS_1. Tunnel: Select PPTP_VPN_Tunnel. Click OK.(Figure11-41) Figure11-40 Setting the VPN Tunnel Outgoing Policy Figure11-41 Complete the VPN Tunnel Outgoing Policy Setting...
  • Page 153 STEP 5.Enter the following setting in Incoming Policy: (Figure11-42) Schedule: Select Schedule_1. QoS: Select QoS_1. Tunnel: Select PPTP_VPN_Tunnel. Click OK.(Figure11-43) Figure11-42 Setting the VPN Tunnel Incoming Policy Figure11-43 Complete the VPN Tunnel Incoming Policy Setting...
  • Page 154 The Default Gateway of Company B is the LAN IP of the MH350 192.168.20.1. Follow the steps below: STEP 1.Add the following settings in PPTP Client of VPN function in the MH350 of Company B: Click New Entry Button. (Figure11-44) User Name: Enter PPTP_Connection.
  • Page 155 STEP 2.Enter the following setting in Tunnel of VPN function: (Figure11-46) Enter a specific Tunnel Name. From Source: Select LAN From Source Subnet / Mask: Enter 192.168.20.0 / 255.255.255.0. To Destination: Select To Destination Subnet / Mask. To Destination Subnet / Mask: Enter 192.168.10.0 / 255.255.255.0.
  • Page 156 STEP 3.Enter the following setting in Outgoing Policy: (Figure11-48) Authentication User: Select All_NET. Schedule: Select Schedule_1. QoS: Select QoS_1. Tunnel: Select PPTP_VPN_Tunnel. Click OK.(Figure11-49) Figure11-48 Setting the VPN Tunnel Outgoing Policy Figure11-49 Complete the VPN Tunnel Outgoing Policy Setting...
  • Page 157 STEP 4.Enter the following setting in Incoming Policy: (Figure11-50) Schedule: Select Schedule_1. QoS: Select QoS_1. Tunnel: Select PPTP_VPN_Tunnel. Click OK.(Figure11-51) Figure11-50 Setting the VPN Tunnel Incoming Policy Figure11-51 Complete the VPN Tunnel Incoming Policy Setting...
  • Page 158 STEP 5.Complete PPTP VPN Connection. (Figure11-52 Figure 11-52 PPTP VPN Connection Deployment...

  • Page 159: Chapter 12 Policy

    Every packet has to be detected if it corresponds with Policy or not when it passes the MH350. When the conditions correspond with certain policy, it will pass the MH350 by the setting of Policy without being detected by other policy. But if the packet cannot correspond with any Policy, the packet will be intercepted.
  • Page 160 WAN network. The system manager can set all the policy rules of DMZ to WAN packets in this function All the packets that go through MH350 must pass the policy permission (except VPN). Therefore, the LAN, WAN, and DMZ network have to set the applicable policy...
  • Page 161 Define the required fields of Policy Source and Destination: Source IP and Destination IP is according to the MH350’s point of view. The active side is the source; passive side is destination. Service: It is the service item that controlled by Policy. The user can choose default value or the custom services that the system manager set in Service function.
  • Page 162 Option: To display if every function of Policy is enabled or not. If the function is enabled and then the chart of the function will appear (See the chart and illustration below) Chart Name Illustration Traffic Log Enable traffic log Statistics Enable traffic statistics Authentication User Enable Authentication User...
  • Page 163 (the bandwidth is shared by the users who correspond to the Policy) Move: Every packet that passes the MH350 is detected from the front policy to the last one. So it can modify the priority of the policy from the selection.
  • Page 164 We set up six Policy examples in this chapter: No. Suitable Example Page Situation Outgoing Set up the policy that can monitor the internal users. (Take Logging, Statistics, Alarm Threshold for example) Outgoing Forbid the users to access to specific network. (Take specific WAN IP and Content Blocking for example) Only allow the users who pass Authentication to...

  • Page 165: Example

    Example Set up the policy that can monitor the internal users. (Take Logging, Statistics, and Alarm Threshold for example) STEP 1﹒Enter the following setting in Outgoing Policy: Click New Entry Select Logging Select Statistics Click OK (Figure12-1) Figure12-1 Setting the different Policies...
  • Page 166 STEP 2﹒Complete the setting of Logging, Statistics, and Alarm Threshold in Outgoing Policy: (Figure12-2) Figure12-2 Complete Policy Setting STEP 3﹒Obtain the information in Traffic of Log function if you want to monitor all the packets of the MH350. (Figure12-3) Figure12-3 Traffic Log Monitor WebUI...
  • Page 167 STEP 4﹒To display the traffic record that through Policy to access to Internet in Policy Statistics of Statistics function. (Figure12-4) Figure12-4 Statistics WebUI...
  • Page 168 Forbid the users to access to specific network. (Take specific WAN IP and Content Blocking for example) STEP 1﹒Enter the following setting in URL Blocking, Script Blocking, P2P Blocking, IM Blocking, and Download Blocking in Content Blocking function: (Figure12-5, 12-6, 12-7, 12-8, 12-9) Figure12-5 URL Blocking Setting Figure12-6 Script Blocking Setting Figure12-7 P2P Blocking Setting...
  • Page 169 Figure12-8 IM Blocking Setting Figure12-9 Download Blocking Setting 1. URL Blocking can restrict the Internal Users only can access to some specific Website. 2. Script Blocking can restrict the Internal Users to access to Script file of Website. (Java, Cookies…etc.) 3.
  • Page 170 STEP 2﹒Enter as following in WAN and WAN Group of Address function: (Figure12-10, 12-11) Figure12-10 Setting the WAN IP that going to block Figure12-11 WAN Address Group The Administrator can group the custom address in Address. It is more convenient when setting policy rule.
  • Page 171 STEP 3﹒Enter the following setting in Outgoing Policy: Click New Entry Destination Address: Select WAN_Group that set by STEP 2. (Blocking by IP) Action, WAN Port: Select Deny Click OK (Figure12-12) Figure12-12 Setting Blocking Policy...
  • Page 172 STEP 4﹒Enter the following setting in Outgoing Policy: Click New Entry Select Content Blocking Click OK (Figure12-13) Figure12-13 Setting Content Blocking Policy STEP 5﹒Complete the setting of forbidding the users to access to specific network. (Figure12-14) Figure12-14 Complete Policy Setting Deny in Policy can block the packets that correspond to the policy rule.
  • Page 173 Only allow the users who pass Authentication to access to Internet in particular time STEP 1﹒Enter the following in Schedule function: (Figure12-15) Figure12-15 Add New Schedule STEP 2﹒Enter the following in Auth User and Auth User Group in Authentication function: (Figure12-16) Figure12-16 Setting Auth User Group The Administrator can use group function the Authentication and Service.
  • Page 174 STEP 3﹒Enter the following setting in Outgoing Policy: Click New Entry Authentication User: Select laboratory Schedule: Select WorkingTime Click OK (Figure12-17) Figure12-17 Setting a Policy of Authentication and Schedule STEP 4﹒Complete the policy rule of only allows the users who pass authentication to access to Internet in particular time.
  • Page 175 The external user control the internal PC through remote control software (Take pcAnywhere for example) STEP 1﹒Set up a Internal PC controlled by external user, and Internal PC’s IP Address is 192.168.1.2 STEP 2﹒Enter the following setting in Virtual Server1 of Virtual Server function: (Figure12-19) Figure12-19 Setting Virtual Server...
  • Page 176 STEP 3﹒Enter the following in Incoming Policy: Click New Entry Destination Address: Select Virtual Server1 (61.11.11.12) Service: Select PC-Anywhere (5631-5632) Click OK (Figure12-20) Figure12-20 Setting the External User Control the Internal PC Policy STEP 4﹒Complete the policy for the external user to control the internal PC through remote control software.
  • Page 177 Set a FTP Server under DMZ NAT Mode and restrict the download bandwidth from external and MAX. Concurrent Sessions. STEP 1﹒Set a FTP Server under DMZ, which IP is 192.168.3.2 (The DMZ Interface Address is192.168.3.1/24) STEP 2﹒Enter the following setting in Virtual Server1 of Virtual Server function: (Figure12-22) Figure12-22 Setting up Virtual Server Corresponds to FTP Server When using the function of Incoming or WAN to DMZ in Policy, strong suggests...
  • Page 178 STEP 4﹒Enter the following in WAN to DMZ Policy: Click New Entry Destination Address: Select Virtual Server1 (61.11.11.12) Service: Select FTP (21) QoS: Select FTP_QoS MAX. Concurrent Sessions: Enter 100 Click OK (Figure12-24) Figure12-24 Add New Policy STEP 5﹒Complete the policy of restricting the external users to access to internal network server (which may occupy the resource of network) (Figure12-25) Figure12-25 Complete the Policy Setting...
  • Page 179 Set a Mail Server to allow the internal and external users to receive and send e-mail under DMZ Transparent Mode STEP 1﹒Set a Mail Server in DMZ and set its network card’s IP Address as 61.11.11.12. The DNS setting is external DNS Server. STEP 2﹒Add the following setting in DMZ of Address function: (Figure12-26) Figure12-26 the Mail Server’s IP Address Corresponds to Name Setting in Address Book of Mail Server...
  • Page 180 STEP 4﹒Enter the following setting in WAN to DMZ Policy: Click New Entry Destination Address: Select Mail_Server Service: Select E-mail Click OK (Figure12-28) Figure12-28 Setting a Policy to access Mail Service by WAN to DMZ STEP 5﹒Complete the policy to access mail service by WAN to DMZ. (Figure12-29) Figure12-29 Complete the Policy to access Mail Service by WAN to DMZ...
  • Page 181 STEP 6﹒Add the following setting in LAN to DMZ Policy: Click New Entry Destination Address: Select Mail_Server Service: Select E-mail Click OK (Figure12-30) Figure12-30 Setting a Policy to access Mail Service by LAN to DMZ STEP 7﹒Complete the policy to access mail service by LAN to DMZ (Figure12-31) Figure12-31 Complete the Policy to access Mail Service by LAN to DMZ...
  • Page 182 STEP 8﹒Add the following setting in DMZ to WAN Policy: Click New Entry Source Address: Select Mail_Server Service: Select E-mail Click OK (Figure12-32) Figure12-32 Setting the Policy of Mail Service by DMZ to WAN STEP 9﹒Complete the policy access to mail service by DMZ to WAN. (Figure12-33) Figure12-33 Complete the Policy access to Mail Service by DMZ to WAN...

  • Page 183: Chapter 13 Alert Setting

    Chapter 13 Alert Setting Alert Setting When the MH350 had detected attacks from hackers and the internal PC sending large DDoS attacks. The Internal Alert and External Alert will start on blocking these packets to maintain the whole network. In this chapter, we will have the detailed illustration about Internal Alert and...
  • Page 184 【ICMP Flood Threshold( Total) Pkts/Sec】: The System Administrator can enter the maximum number of ICMP packets per second that is allow to enter the network/MH350. If the value exceeds the setting one, and then the device will determine it as an attack.
  • Page 185 Administrator can enter the maximum number of ICMP packets per second from attacking source IP Address that is allow to enter the network / MH350. If the value exceeds the setting one, and then the device will determine it as an attack.
  • Page 186 Select this option to detect spoof attacks. Hackers disguise themselves as trusted users of the network in Spoof attacks. They use a fake identity to try to pass through the MH350 System and invade the network. Detect Port Scan Attack:...
  • Page 187 SYN on the TCP header is marked. Enable this function to detect such abnormal packets. After System Manager enable External Alert, if the MH350 has detected any abnormal situation, the alarm message will appear in External Alarm in Attack Alarm.

  • Page 188: Internet Alert

    Internet Alert MH350 Alarm and to prevent the computer which being attacked to send DDoS packets to LAN network STEP 1﹒Select Internal Alert in Alert Setting and enter the following settings: Enter The threshold sessions of infected Blaster (per Source...
  • Page 189 Internal Alarm in Attack Alarm or send NetBIOS Alert notification to the infected PC Administrator’s PC (Figure16-2, 16-3, 16-4) If the Administrator starts the E-Mail Alert Notification in Setting, the MH350 will send e-mail to Administrator automatically. (Figure16-5)
  • Page 190 Figure16-4 NetBIOS Alert Notification to Administrator’s PC...
  • Page 191 Figure16-5 E-mail Virus Alert...

  • Page 192: Chapter 14 Attack Alarm

    Attack Alarm MH350 has two alarm forms: Internal Alarm, and External Alarm. Internal Alarm: When the MH350 had detected the internal PC sending large DDoS attacks and then the Internal Alarm will start on blocking these packets to maintain the whole network.
  • Page 193 We set up two Alarm examples in the chapter: Suitable Example Page Situation Ex 1 Internal To record the DDoS attack alarm from internal Alarm Ex 2 External To record the attack alarm about Hacker Alarm attacks the MH350 and Intranet...

  • Page 194: I Nternal A Larm

    Internal Alarm To record the DDoS attack alarm from internal PC STEP 1﹒Select Internal Alarm in Attack Alarm when the device detects DDoS attacks, and then can know which computer is being affected. (Figure17-1) Figure17-1 Internal Alarm WebUI...

  • Page 195: E Xternal A Larm

    External Alarm To record the attack alarm about Hacker attacks the MH350 and Intranet STEP 1﹒Select the following settings in External Alert in Alert Setting function: (Figure17-2) Figure17-2 External Alert Setting WebUI...
  • Page 196 STEP 2﹒When Hacker attacks the MH350 and Intranet, select External Alarm in Attack Alarm function to have detailed records about the hacker attacks. (Figure17-3) Figure17-3 External Alarm WebUI...

  • Page 197: Chapter 15 Log

    Administrator such as the time of change, settings that change, the IP address used to log in…etc. Connection Log records all of the connections of MH350. When the connection occurs some problem, the Administrator can trace back the problem from the information.
  • Page 198 Internet or Intranet by MH350. Ex 2 Event Log To record the detailed management events (such as Interface and event description of MH350) of the Administrator Ex 3 Connection To detect event description of WAN Connection...

  • Page 199: Traffic Log

    Traffic Log To detect the information and Protocol port that users use to access to Internet or Intranet by MH350 STEP 1﹒Add new policy in DMZ to WAN of Policy and select Enable Logging: (Figure18-1) Figure18-1 Logging Policy Setting STEP 2﹒Complete the Logging Setting in DMZ to WAN Policy: (Figrue18-2)
  • Page 200 STEP 3﹒Click Traffic Log. It will show up the packets records that pass this policy. (Figure18-3) Figure18-3 Traffic Log WebUI...
  • Page 201 STEP 4﹒Click on a specific IP of Source IP or Destination IP in Figure18-3, it will prompt out a WebUI about Protocol and Port of the IP. (Figure18-4) Figure18-4 The WebUI of detecting the Traffic Log by IP Address...
  • Page 202 STEP 5﹒Click on Download Logs and select Save in File Download WebUI. And then choose the place to save in PC and click OK; the records will be saved instantly. (Figure18-5) Figure18-5 Download Traffic Log Records WebUI...
  • Page 203 STEP 6﹒Click Clear Logs and click OK on the confirm WebUI; the records will be deleted from the MH350 instantly. (Figure18-6) Figure18-6 Clearing Traffic Log Records WebUI...

  • Page 204: Event Log

    Event Log To record the detailed management events (such as Interface and event description of MH350) of the Administrator STEP 1﹒Click Event log of LOG. The management event records of the administrator will show up (Figure18-7) Figure18-7 Event Log WebUI...
  • Page 205 STEP 2﹒Click on Download Logs and select Save in File Download WebUI. And then choose the place to save in PC and click OK; the records will be saved instantly. (Figure18-8) Figure18-8 Download Event Log Records WebUI...
  • Page 206 STEP 3﹒Click Clear Logs and click OK on the confirm WebUI; the records will be deleted from the MH350. (Figure18-9) Figure18-9 Clearing Event Log Records WebUI...

  • Page 207: C Onnection L Og

    Connection Log To Detect Event Description of WAN Connection STEP 1﹒Click Connection in LOG. It can show up WAN Connection records of the MH350. (Figure18-10) Figure18-10 Connection records WebUI...
  • Page 208 STEP 2﹒Click on Download Logs and select Save in File Download WebUI. And then choose the place to save in PC and click OK; the records will be saved instantly. (Figure18-11) Figure18-11 Download Connection Log Records WebUI...
  • Page 209 STEP 3﹒Click Clear Logs and click OK on the confirm WebUI, the records will be deleted from the MH350 instantly. (Figure18-12) Figure18-12 Clearing Connection Log Records WebUI...

  • Page 210: Log Backup

    Log Backup To save or receive the records that sent by the MH350 STEP 1﹒Enter Setting in System, select Enable E-mail Alert Notification function and set up the settings. (Figrue18-13) Figure18-13 E-mail Setting WebUI STEP 2﹒Enter Log Backup in Log, select Enable Log Mail Support and click...
  • Page 211 STEP 3﹒Enter Log Backup in Log, enter the following settings in Syslog Settings: Select Enable Syslog Messages Enter the IP in Syslog Host IP Address that can receive Syslog Enter the receive port in Syslog Host Port Click OK Complete the setting (Figure18-15) Figure18-15 Syslog Messages Setting WebUI...

  • Page 212: Chapter 16 Accounting Report

    Accounting Report Administrator can use this Accounting Report to inquire the LAN IP users and WAN IP users, and to gather the statistics of Downstream/Upstream, First packet/Last packet/Duration and the Service of all the user’s IP that passes the MH350.
  • Page 213 Source IP： The IP address used by LAN users who use MH350 Destination IP： The IP address used by WAN service server which uses MH350. Service： The communication service which listed in the menu when LAN users use MH350 to connect to WAN service server.
  • Page 214 Source IP： The IP address used by WAN users who use MH350 Destination IP： The IP address used by LAN service server who use MH350 Service： The communication service which listed in the menu when WAN users use MH350 to connect to LAN Service server.

  • Page 215: O Utbound

    TOP: Select the data you want to view, it presents 10 results in one page. Pull-down menu selection Source IP ： The IP address used by LAN users who use MH350 to connect to WAN service server. Downstream：The percentage of downstream and the value of each WAN service server which uses MH350 to LAN user.
  • Page 216 Figure19-1 Outbound Source IP Statistics Report...
  • Page 217 LAN user who uses MH350 to WAN service server. First Packet：When the first packet is sent from WAN service server to LAN users, the sent time will be recorded by the MH350. Last Packet：When the last packet from LAN user is sent to WAN service server, the sent time will be recorded by the MH350.
  • Page 218 Figure19-2 Outbound Destination IP Statistics Report...
  • Page 219 Service：The report of Communication Service when LAN users use the MH350 to connect to WAN service server. Downstream：The percentage of downstream and the value of each WAN service server who uses MH350 to connect to LAN user. Upstream：The percentage of upstream and the value of each LAN user who uses MH350 to WAN service server.
  • Page 220 Figure19-3 Outbound Services Statistics Report Figure19-4 According to the downstream / upstream report of the selected TOP numbering to draw the Protocol Distribution chart Press to return to Accounting Report window.

  • Page 221: I Nbound

    LAN service server who uses MH350 to WAN users. First Packet：When the first packet is sent from WAN users to LAN service server, the sent time will be recorded by the MH350. Last Packet：When the last packet is sent from LAN service server to WAN users, the sent time will be recorded by the MH350.
  • Page 222 Figure19-5 Inbound Top Users Statistics Report...
  • Page 223 LAN service server who uses MH350 to WAN users. First Packet：When the first packet is sent from WAN users to LAN service server, the sent time will be recorded by the MH350. Last Packet：When the last packet is sent from LAN service server to WAN users, the sent time will be recorded by the MH350.
  • Page 224 Figure19-6 Inbound Destination IP Statistics Report...
  • Page 225 Duration：The period of time starts from the first packet to the last packet to be recorded. Total Traffic：The MH350 will record the sum of time and show the percentage of each Communication Service’s upstream / downstream to LAN service server.
  • Page 226 Figure19-7 Inbound Services Statistics Report Figure19-8 According to the downstream / upstream report of the selected TOP numbering to draw the Protocol Distribution chart...

  • Page 227: Chapter 17 Statistics

    Policy Statistics: The statistics of Downstream / Upstream packets and Downstream/Upstream traffic record that pass Policy In this chapter, the Administrator can inquire the MH350 for statistics of packets and data that passes across the MH350. The statistics provides the...
  • Page 228 Define the required fields of Statistics: Statistics Chart: Y-Coordinate：Network Traffic（Kbytes/Sec） X-Coordinate：Time（Hour/Minute） Source IP, Destination IP, Service, and Action: These fields record the original data of Policy. From the information above, the Administrator can know which Policy is the Policy Statistics belonged to. Time: To detect the statistics by minutes, hours, days, months, or years.

  • Page 229: Wan S Tatistics

    WAN Statistics STEP 1﹒Enter WAN in Statistics function, it will display all the statistics of Downstream/Upstream packets and Downstream/Upstream record that pass WAN Interface. (Figure20-1) Figure20-1 WAN Statistics function Time: To detect the statistics by minutes, hours, days, months, or years.
  • Page 230 STEP 3﹒Statistics Chart (Figure20-2) Y-Coordinate：Network Traffic（Kbytes/Sec） X-Coordinate：Time（Hour/Minute） Figure20-2 To Detect WAN Statistics...

  • Page 231: P Olicy S Tatistics

    Policy Statistics STEP 1﹒If you had select Statistics in Policy, it will start to record the chart of that policy in Policy Statistics. (Figure20-3) Figure20-3 Policy Statistics Function If you are going to use Policy Statistics function, the System Manager has to enable the Statistics in Policy first.
  • Page 232 STEP 3﹒Statistics Chart (Figure20-4) Y-Coordinate：Network Traffic（Kbytes/Sec） X-Coordinate：Time（Hour/Minute/Day） Figure20-4 To Detect Policy Statistics...

  • Page 233: Chapter 18 Status

    The users can know the connection status in Status. For example: LAN IP, WAN IP, Subnet Netmask, Default Gateway, DNS Server Connection, and its IP…etc. Interface: Display all of the current Interface status of the MH350 Authentication: The Authentication information of MH350...

  • Page 234: I Nterface

    STEP 1﹒Enter Interface in Status function; it will list the setting for each Interface: (Figure21-1) PPPoE Con. Time: The last time of the MH350 to be enabled MAC Address: The MAC Address of the Interface IP Address/ Netmask: The IP Address and its Netmask of the Interface Rx Pkts, Err.
  • Page 235 Figure21-1 Interface Status...

  • Page 236: A Uthentication

    Authentication STEP 1﹒Enter Authentication in Status function, it will display the record of login status: (Figure21-2) IP Address: The authentication user IP Auth-User Name: The account of the auth-user to login Login Time: The login time of the user (Year/Month/Day Hour/Minute/Second) Figrue21-2 Authentication Status WebUI...

  • Page 237: Arp Table

    STEP 1﹒Enter ARP Table in Status function; it will display a table about IP Address, MAC Address, and the Interface information which is connecting to the MH350: (Figure21-3) NetBIOS Name: The identified name of the network IP Address: The IP Address of the network...

  • Page 238: Dhcp C Lients

    DHCP Clients STEP 1﹒In DHCP Clients of Status function, it will display the table of DHCP Clients that are connected to the MH350: (Figure21-4) IP Address: The dynamic IP that provided by DHCP Server MAC Address: The IP that corresponds to the dynamic IP...

Table of Contents