26

Chapter 5: Configuring the Gateway

The Security Tab

ADSL2 Gateway with 4-Port Switch

•

Key Life Time. In the Key Lifetime field, you may optionally select to have the key expire at the end of a time

period of your choosing.

Enter the number of seconds you’d like the key to be used until a re-key negotiation

between each endpoint is completed.

Phase 2

•

Encryption. The encryption method selected in Phase 1 will be displayed.

•

Authentication. The authentication method selected in Phase 1 will be displayed.

•

PFS. The status of PFS will be displayed.

•

Group. There are two Diffie-Hellman Groups to choose from: 768-bit and 1024-bit. Diffie-Hellman refers to a

cryptographic technique that uses public and private keys for encryption and decryption.

•

Key Life Time. In the Key Lifetime field, you may select to have the key expire at the end of a time period of

your choosing.

Enter the number of seconds you’d like the key to be used until a re-key negotiation between

each endpoint is completed.

Other Setting

•

NetBIOS broadcast. Check the box next to NetBIOS broadcast to enable NetBIOS traffic to pass through the

VPN tunnel.

•

Anti-replay. Check the box next to Anti-replay to enable the Anti-replay protection. This feature keeps track of

sequence numbers as packets arrive, ensuring security at the IP packet-level.

•

Keep-Alive. If you select this option, the Gateway will periodically check your Internet connection. If you are

disconnected, then the Gateway will automatically re-establish your connection.

•

Check this box to block unauthorized IP addresses. Enter in the field to specify how many times IKE must fail

before blocking that unauthorized IP address. Enter the length of time that you specify (in seconds) in the

field.

When finished making your changes on this tab, click the

Save Settings

button to save these changes, or click

the

Cancel Changes

button to undo your changes. For further help on this tab, click the

Help

button.

Figure 5-19: Advanced VPN Tunnel Setup

27

Chapter 5: Configuring the Gateway

The Access Restrictions Tab

ADSL2 Gateway with 4-Port Switch

The Access Restrictions Tab

Internet Access

The Access Restrictions tab allows you to block or allow specific kinds of Internet usage. You can set up Internet

access policies for specific computers and set up filters by using network port numbers.

•

Internet Access Policy. Multiple Filters can be saved as Internet Access Policies. When you wish to edit one,

select the number of the Policy from the drop-down menu. The tab will change to reflect the settings of this

Policy. If you wish to delete this Policy, click the

Delete

button. To see a summary of all Policies, click the

Summary

button.

The summaries are listed on this screen with their name and settings. To return to the Filters tab, click the

Close

button.

•

Enter Policy Name. Policies are created from the fields presented here.

To create an Internet Access policy:

1.

Enter a Policy Name in the field provided. Select

Internet Access

as the Policy Type.

2.

Click the

Edit List of PCs

button. This will open the List of PCs screen. From this screen, you can enter the IP

address or MAC address of any computer to which this policy will apply. You can even enter ranges of

computers by IP address. Click the

Save Settings

button to save your settings, the

Cancel Changes

button

to undo any changes and return to the Filters tab.

Figure 5-20: Internet Access

Figure 5-21: Internet Policy Summary

28

Chapter 5: Configuring the Gateway

The Access Restrictions Tab

ADSL2 Gateway with 4-Port Switch

3.

If you wish to Deny or Allow Internet access for those computers you listed on the List of PCs screen, click the

option.

4.

You can filter access to various services accessed over the Internet, such as FTP or Telnet, by selecting a

service from the drop-down menus next to Blocked Services. If a service isn’t listed, you can click the

Add/

Edit Service

button to open the Port Services screen and add a service to the list. You will need to enter a

Service name, as well as the Protocol and Port Range used by the service.

5.

By selecting the appropriate setting next to Days and Time, choose when Internet access will be filtered.

6.

Click the

Save Settings

button to activate the policy.

Internet Access can also be filtered by URL Address, the address entered to access Internet sites, by entering the

address in one of the Website Blocking by URL Address fields. If you do not know the URL Address, filtering can

be done by Keyword by entering a keyword in one of the Website Blocking by Keyword fields.

When finished making your changes on this tab, click the

Save Settings

button to save these changes, or click

the

Cancel Changes

button to undo your changes.

Figure 5-22: List of PCs

Figure 5-23: Port Services

29

Chapter 5: Configuring the Gateway

The Applications and Gaming Tab

ADSL2 Gateway with 4-Port Switch

The Applications and Gaming Tab

Single Port Forwarding

The Single Port Forwarding screen provides options for customization of port services for common applications.

When users send this type of request to your network via the Internet, the Gateway will forward those requests to

the appropriate computer. Any computer whose port is being forwarded should have its DHCP client function

disabled and should have a new static IP address assigned to it because its IP address may change when using

the DHCP function.

Choose or enter the Application in the field. Then, enter the External and Internal Port numbers in the fields.

Select the type of protocol you wish to use for each application:

TCP

or

UDP

. Enter the IP Address in the field.

Click

Enabled

to enable Forwarding for the chosen application.

When finished making your changes on this tab, click the

Save Settings

button to save these changes, or click

the

Cancel Changes

button to undo your changes.

Port Range Forwarding

The Port Forwarding screen sets up public services on your network, such as web servers, ftp servers, e-mail

servers, or other specialized Internet applications. (Specialized Internet applications are any applications that use

Internet access to perform functions such as videoconferencing or online gaming. Some Internet applications

may not require any forwarding.)

When users send this type of request to your network via the Internet, the Gateway will forward those requests to

the appropriate computer. Any computer whose port is being forwarded should have its DHCP client function

disabled and should have a new static IP address assigned to it because its IP address may change when using

the DHCP function.

•

Application. Enter the name you wish to give each application.

•

Start and End. Enter the starting and ending numbers of the port you wish to forward.

•

TCP UDP. Select the type of protocol you wish to use for each application:

TCP

,

UDP

, or

Both

.

•

IP Address. Enter the IP Address and Click

Enabled

.

When finished making your changes on this tab, click the

Save Settings

button to save these changes, or click

the

Cancel Changes

button to undo your changes.

Figure 5-24: Single Port Forwarding

Figure 5-25: Port Range Forwarding

30

Chapter 5: Configuring the Gateway

The Applications and Gaming Tab

ADSL2 Gateway with 4-Port Switch

Port Triggering

Port Triggering is used for special applications that can request a port to be opened on demand. For this feature,

the Gateway will watch outgoing data for specific port numbers. The Gateway will remember the IP address of the

computer that sends a transmission requesting data, so that when the requested data returns through the

Gateway, the data is pulled back to the proper computer by way of IP address and port mapping rules.

•

Application. Enter the name you wish to give each application.

•

Start Port and End Port. Enter the starting and ending Triggered Range numbers and the Incoming Forwarded

Range numbers of the port you wish to forward.

When finished making your changes on this tab, click the

Save Settings

button to save these changes, or click

the

Cancel Changes

button to undo your changes.

DMZ

The DMZ screen allows one local user to be exposed to the Internet for use of a special-purpose service such as

Internet gaming and videoconferencing through DMZ Hosting. DMZ hosting forwards all the ports for one

computer at the same time, which differs from Port Range Forwarding, which can only forward a maximum of 10

ranges of ports.

•

DMZ Hosting. This feature allows one local user to be exposed to the Internet for use of a special-purpose

service such as Internet gaming and videoconferencing. To use this feature, select

Enabled

. To disable DMZ ,

select

Disabled

.

•

DMZ Host IP Address. To expose one computer, enter the computer’s IP address. To get the IP address of a

computer, refer to “Appendix D: Finding the MAC Address and IP Address for Your Ethernet Adapter.”

When finished making your changes on this tab, click the

Save Settings

button to save these changes, or click

the

Cancel Changes

button to undo your changes.

Figure 5-26: Port Triggering

Figure 5-27: DMZ