TL-WR841N/TL-WR841ND

300Mbps Wireless N Router User Guide

- 52 -

•

Internal Port

-

The Internal port the Router opens for local host.

•

IP Address

-

The IP address of the UPnP device that is currently accessing the Router.

•

Status -

The status of the port is displayed here. “Enabled” means that the port is still

active. Otherwise, the port is inactive.

Click

Refresh

to update the Current UPnP Settings List.

4.9 Security

Figure 4-38 The Security menu

There are four submenus under the Security menu as shown in Figure 4-38:

Basic Security

,

Advanced Security

,

Local Management

and

Remote Management.

Click any of them, and you

will be able to configure the corresponding function.

4.9.1 Basic Security

Choose menu “

Security

→

Basic Security

”, you can configure the basic security in the screen

as shown in Figure 4-39.

Figure 4-39 Basic Security

¾

Firewall -

A firewall protects your network from the outside world. Here you can enable or

TL-WR841N/TL-WR841ND

300Mbps Wireless N Router User Guide

- 53 -

disable the Router’s firewall.

z

SPI Firewall -

SPI (Stateful Packet Inspection, also known as dynamic packet filtering)

helps to prevent cyber attacks by tracking more state per session. It validates that the

traffic passing through the session conforms to the protocol. SPI Firewall is enabled by

factory default. If you want all the computers on the LAN exposed to the outside world,

you can disable it.

¾

VPN -

VPN Passthrough must be enabled if you want to allow VPN tunnels using IPSec,

PPTP, or L2TP protocols to pass through the Router’s firewall.

z

PPTP Passthrough -

Point-to-Point Tunneling Protocol (PPTP) allows the Point-to-Point

Protocol (PPP) to be tunneled through an IP network. To allow PPTP tunnels to pass

through the Router, keep the default,

Enabled

.

z

L2TP Passthrough

-

Layer 2 Tunneling Protocol (L2TP) is the method used to enable

Point-to-Point sessions via the Internet on the Layer 2 level. To allow L2TP tunnels to

pass through the Router, keep the default,

Enabled

.

z

IPSec Passthrough

-

Internet Protocol Security (IPSec) is a suite of protocols for

ensuring private, secure communications over Internet Protocol (IP) networks, through

the use of cryptographic security services. To allow IPSec tunnels to pass through the

Router, keep the default,

Enabled

.

¾

ALG -

It is recommended to enable Application Layer Gateway (ALG) because ALG allows

customized Network Address Translation (NAT) traversal filters to be plugged into the

gateway to support address and port translation for certain application layer "control/data"

protocols such as FTP, TFTP, H323 etc.

z

FTP ALG -

To allow FTP clients and servers to transfer data across NAT, keep the

default

Enable

.

z

TFTP ALG -

To allow TFTP clients and servers to transfer data across NAT, keep the

default

Enable

.

z

H323 ALG -

To allow Microsoft NetMeeting clients to communicate across NAT, keep

the default

Enable

.

z

RTSP ALG

- To allow some media player clients to communicate with some streaming

media servers across NAT, click Enable.

Click the

Save

button to save your settings.

4.9.2 Advanced Security

Choose menu “

Security

→

Advanced Security

”, you can protect the Router from being

attacked by TCP-SYN Flood, UDP Flood and ICMP-Flood in the screen as shown in Figure 4-40.

•

RTSP ALG

- To allow some media player clients to communicate with some streaming media servers

across NAT, click Enable.

TL-WR841N/TL-WR841ND

300Mbps Wireless N Router User Guide

- 54 -

Figure 4-40

Advanced Security

¾

Packets Statistics Interval (5~60) -

The default value is 10. Select a value between 5 and

60 seconds from the drop-down list. The Packets Statistics Interval value indicates the time

section of the packets statistics. The result of the statistics is used for analysis by SYN Flood,

UDP Flood and ICMP-Flood.

¾

DoS Protection -

Denial of Service protection. Check the Enable or Disable button to

enable or disable the DoS protection function. Only when it is enabled, will the flood filters be

enabled.

)

Note:

Dos Protection will take effect only when the

Traffic Statistics

in “

System Tool

→

Traffic

Statistics

” is enabled.

¾

Enable ICMP-FLOOD Attack Filtering

-

Enable or Disable the ICMP-FLOOD Attack

Filtering.

¾

ICMP-FLOOD Packets Threshold (5~3600)

-

The default value is 50. Enter a value

between 5

~

3600. When the current ICMP-FLOOD Packets number is beyond the set value,

the Router will startup the blocking function immediately.

¾

Enable UDP-FLOOD Filtering

-

Enable or Disable the UDP-FLOOD Filtering.

¾

UDP-FLOOD Packets Threshold (5~3600)

-

The default value is 500. Enter a value

between 5

~

3600. When the current UPD-FLOOD Packets number is beyond the set value,

the Router will startup the blocking function immediately.

TL-WR841N/TL-WR841ND

300Mbps Wireless N Router User Guide

- 55 -

¾

Enable TCP-SYN-FLOOD Attack Filtering

-

Enable or Disable the TCP-SYN-FLOOD

Attack Filtering.

¾

TCP-SYN-FLOOD Packets Threshold (5~3600)

-

The default value is 50. Enter a value

between 5

~

3600. When the current TCP-SYN-FLOOD Packets numbers is beyond the set

value, the Router will startup the blocking function immediately.

¾

Ignore Ping Packet From WAN Port to Router

-

Enable or Disable Ignore Ping Packet

From WAN Port to Router. The default setting is disabled. If enabled, the ping packet from

the Internet cannot access the Router.

¾

Forbid Ping Packet From LAN Port to Router

-

Enable or Disable Forbid Ping Packet From

LAN Port to Router. The default setting is disabled. If enabled, the ping packet from LAN

cannot access the Router. This function can be used to defend against some viruses.

Click the

Save

button to save the settings.

Click the

Blocked DoS Host List

button to display the DoS host table by blocking.

4.9.3 Local Management

Choose menu “

Security

→

Local Management

”, you can configure the management rule in the

screen as shown in Figure 4-41. The management feature allows you to deny computers in LAN

from accessing the Router.

Figure 4-41 Local Management

By default, the radio button “

All the PCs on the LAN are allowed to access the Router's

Web-Based Utility

” is checked. If you want to allow PCs with specific MAC Addresses to access

the Setup page of the Router's Web-Based Utility locally from inside the network, check the radio

button “

Only the PCs listed can browse the built-in web pages to perform Administrator

tasks

”, and then enter each MAC Address in a separate field. The format for the MAC Address is

XX-XX-XX-XX-XX-XX (X is any hexadecimal digit). Only the PCs with MAC address listed can

TL-WR841N/TL-WR841ND

300Mbps Wireless N Router User Guide

- 56 -

use the password to browse the built-in web pages to perform Administrator tasks while all the

others will be blocked.

After click the

Add

button, your PC's MAC Address will be placed in the list above.

Click the

Save

button to save your settings.

)

Note:

If your PC is blocked but you want to access the Router again, use a pin to press and hold the

Reset Button

(hole) on the back panel for about 5 seconds to reset the Router’s factory defaults

on the Router’s Web-Based Utility.

4.9.4 Remote Management

Choose menu “

Security

→

Remote Management

”, you can configure the Remote Management

function in the screen as shown in Figure 4-42. This feature allows you to manage your Router

from a remote location via the Internet.

Figure 4-42

Remote Management

¾

Web Management Port -

Web browser access normally uses the standard HTTP service

port 80. This Router's default remote management web port number is 80. For greater

security, you can change the remote management web port to a custom port by entering that

number in the box provided. Choose a number between 1 and 65534 but do not use the

number of any common service port.

¾

Remote Management IP Address

-

This is the current address you will use when accessing

your Router from the Internet. This function is disabled when the IP address is set to the

default value of 0.0.0.0. To enable this function change 0.0.0.0 to a valid IP address. If set to

255.255.255.255, then all the hosts can access the Router from internet.

)

Note:

1)

To access the Router, you should type your Router's WAN IP address into your browser's

address (in IE) or Location (in Navigator) box, followed by a colon and the custom port

number. For example, if your Router's WAN address is 202.96.12.8, and the port number

used is 8080, please enter

in your browser. Later, you may be asked

for the Router's password. After successfully entering the username and password, you will

be able to access the Router's web-based utility.