The contents of this publication may not be reproduced in any part or as a whole, stored, transcribed in
an information retrieval system, translated into any language, or transmitted in any form or by any means,
mechanical, magnetic, electronic, optical, photocopying, manual, or otherwise, without the prior written
permission of 4IPNET, INC.
Disclaimer
4IPNET, INC. does not assume any liability arising out the application or use of any products, or software
described herein. Neither does it convey any license under its parent rights not the parent rights of others.
4IPNET further reserves the right to make changes in any products described herein without notice. The
publication is subject to change without notice.
Trademarks
4IPNET (4ipnet) is a registered trademark of 4IPNET, INC. Other trademarks mentioned in this publication
are used for identification purposes only and may be properties of their respective owners.
4ipnet WHG301
User’s Manual
FCC CAUTION
Any changes or modifications (including the antennas) made to this device that are not
expressly approved by the manufacturer may void the user's authority to operate the equipment.
This equipment has been tested and proven to comply with the limits for a class B digital device, pursuant
to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful
interference in a residential installation. This equipment generates uses and can radiate radio frequency
energy and, if not installed and used in accordance with the instructions, may cause harmful interference to
radio communications. However, there is no guarantee that interference will not occur in a particular
installation. If this equipment does cause harmful interference to radio or television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the interference by
one or more of the following measures:
---Reorient or relocate the receiving antenna.
---Increase the separation between the equipment and receiver.
---Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
---Consult the dealer or an experienced radio/TV technician for help.
Before You Start.................................................................................................................................................1
System Overview ...............................................................................................................................................2
2.1 Introduction of 4ipnet WHG301..............................................................................................................2
2.2 System Concept.....................................................................................................................................2
Web Interface Configuration...........................................................................................................................19
4.1 System Configuration...........................................................................................................................21
4.1.5 WAN Traffic Settings....................................................................................................................29
4.1.6 LAN Port Mapping........................................................................................................................31
4.1.7 Service Zones..............................................................................................................................34
4.2 User Authentication..............................................................................................................................39
4.3 AP Management...................................................................................................................................81
4.3.1 AP List..........................................................................................................................................82
4.3.2 AP Discovery...............................................................................................................................86
4.4.7 IP Mobility...................................................................................................................................101
Appendix A. Accepting Payment via Authorize.Net.......................................................................................123
Appendix B. Accepting Payment via PayPal ..................................................................................................132
Appendix C. Service Zone Deployment Example...........................................................................................141
Appendix D. Proxy Setting................................................................................................................................150
Appendix E. Session Limit and Session Log .................................................................................................155
Appendix F. Network Configuration on PC & User Login.............................................................................157
Appendix G. Console Interface ........................................................................................................................173
Appendix H. Local VPN.....................................................................................................................................176
Appendix I. Customizable Pages....................................................................................................................180
This manual is for hotspot owners or network administrators to set up a network environment using the 4ipnet
WHG301 system. It contains step-by-step procedures and graphic examples to guide MIS staff or individuals with
slight network system knowledge to complete the installation.
1.2 Document Conventions
Represents essential steps, actions, or messages that should not be ignored.
8 Note:
Contains related information that corresponds to a topic.
Indicates that clicking this button will return to the homepage of this section.
Indicates that clicking this button will return to the previous page.
Indicates that clicking this button will apply all of your settings.
Indicates that clicking this button will clear what you have set before these settings are applied.
4ipnet WHG301 is an all-in-one product specially designed for wired and wireless data network environments in
small to middle scaled businesses and hotspots. It features integrated management, secured data transmission, and
enhanced accounting and billing. System administrators can effectively monitor wired or wireless users, including
employees and guest users via its user management interface. Moreover, administrators can discover, configure,
monitor, and upgrade all managed Access Points (APs) from a single, centralized AP management interface.
2.2 System Concept
4ipnet WHG301 is capable of managing user authentication, authorization and accounting. The user account
information is stored in the local database or a specified external database server. Featured with user authentication
and integrated with external payment gateway, WHG301 allows users to easily pay the fee and enjoy the Internet
service using credit cards through Authorize.net or PayPal. With centralized AP management feature, the
administrator does not need to worry about how to manage multiple wireless access point devices. Furthermore,
WHG301 introduces the concept of Service Zones - multiple virtual networks, each with its own definable access
control profiles. This is very useful for hotspot owners seeking to provide different customers or staff with different
levels of network services. The following diagram is an example of WHG301 set to manage the Internet and network
access services at a hotspot venue.
Ø Form Factor: Mini-desktop
Ø Dimensions (W x D x H): 9.6" x 5.9" x 1.8" (243 mm x 150 mm x 45.5 mm)
Ø Weight: 2.8 lbs (1.29 kg)
Ø Operating Temperature: 0 ~ 45 ℃
Ø Storage Temperature: 0 ~ 65 ℃
Ø Power: 110~220 VAC, 50/60 Hz
Ø Ethernet Interfaces: 10 x Fast Ethernet (10/100 Mbps)
Connectors and Display
Ø WAN Ports: 2 x 10BASE-T/100BASE-TX RJ-45
Ø LAN Ports: 8 x 10BASE-T/100BASE-TX RJ-45
Ø Console Port: 1 x RJ-11
Ø LED Indicators: 1 x Power, 1 x Status, 2 x WAN, 8 x LAN
2.3.2 Technical Specification
Networking
Ø Support NAT or Router mode
Ø Support Static IP, DHCP, PPPoE on WAN interface
Ø Choose freely which LAN is authentication-enabled LAN
Ø Support NAT (a) IP/Port destination redirection (b) DMZ server mapping (c) virtual server mapping (d) H.323
pass-through
Ø Built-in with DHCP Server and support DHCP relay
Ø Support walled garden (free surfing zone)
Ø Support SMTP redirection
Ø Support MAC-address and IP-address pass-through
Ø Support HTTP Proxy
Ø Support IP Plug and Play (IP PnP)
Ø Support configurable static routes
Ø Contain built-in hardware-based VPN accelerator
Ø Support dual uplinks, outbound load balancing and failover for more reliable Internet connection
Ø Support SIP pass-through NAT
Service Zones
Ø The network is divided into maximum eight Service Zones (plus one default zone), each defined by a pair of
VLAN tag and ESSID
Ø Each service zone has its own (a) login portal page (b) redirected home page (c) authentication options (d)
Ø Each service zone allows access to the selected groups
Ø Each service zone assigns a network policy to each user group
User Management and Guest Accounts
Ø Authentication methods supported: Local and On-demand accounts, POP3, LDAP, RADIUS, Windows
Domain, and SIP authentication
Ø Single-Sign-On for Windows Domain
Ø Allow MAC address and user identity binding for local user authentication
Ø Support MAC Access Control List
Ø Support auto-expired guest accounts
Ø Users can be divided into user groups
Ø Each user group has its own network properties, including bandwidth, QoS, accessible service zones, and
other privileges
Ø Support QoS and WMM traffic types: Voice, Video, Best Effort and Background
Ø Each group (role) may get different network policies in different service zones
Ø Max concurrent user session (tcp/udp) limit
Ø A setting for user-idle-timeout
Ø Configurable user Black List
Ø Instant guest account generation by authorized users
Ø Export/Import local users list to/from a text file
Ø Definable session limit in policy puts a cap to each user’s concurrent sessions (tcp/udp)
Security Features
Ø Support data encryption: WEP(64/128-bit), WPA, WPA2, IPSec VPN
Ø Support various authentication methods: WPA-PSK, WPA2-PSK, IEEE 802.1x (EAP-MD5, EAP-TLS, CHAP,
PEAP)
Ø Provide VPN termination of IPSec tunnels
Ø Support VPN pass-through (IPSec and PPTP)
Ø Built-in DoS attack protection
Ø AP Management
Ø Provide centralized remote management via HTTP/SNMP interface
Ø Auto Discovery for Managed APs
Ø Enable or disable APs easily via user interface
Ø Templates for Managed APs
Ø Monitoring Managed AP for its status, the number of associated clients, and RF info
Ø Recover APs automatically when the system fails
Ø Upgrade managed APs centrally, including bulk upgrade
Ø Monitor 3rd party non-integrated AP
Ø Status monitoring of online users
Ø IP-based monitoring of network devices
Ø Uplink (WAN) connection failure alert
Ø Support Syslog for diagnosis and troubleshooting
Ø User traffic history logging
Ø Traffic history report via email to administrator
Ø Users’ session log can be sent to ftp or Syslog server
Accounting and Billing
Ø Support local on-demand and external RADIUS server
Ø Contain ten configurable billing plans for on-demand accounts
Ø Support credit card billing system by Authorize.net and PayPal
Ø Provide session expiration control for on-demand accounts
Ø Provide detailed per-user network traffic history for both local and on-demand user accounts
Ø Support automatic e-mail to report network traffic history
System Administration
Ø Support web-based management user interface
Ø Provide customizable login and logout portal page
Ø SSH remote management
Ø Remote firmware upgrade
Ø NTP time synchronization
Ø Menu driven console management interface
Ø
Utilities to backup and restore the system database
Ÿ Standard 10/100BaseT including five network cables with RJ-45 connectors
Ÿ All PCs need to install the TCP/IP network protocol
3.1.2 Package Contents
The standard package of 4ipnet WHG301 includes:
Ÿ 4ipnet WHG301 x 1
Quick Installation Guide (QIG) x 1
Ÿ
Ÿ CD-ROM (with User’s Manual and QIG) x 1
Ÿ DC 12V Power Adaptor x 1
Ÿ Console Cable x 1
Ÿ Core x 1
It is highly recommended to use all the supplies in the package instead of substituting any components by
other suppliers to guarantee best performance.
While system power is on, status OFF indicates BIOS is running; BLINKING indicates the OS is
LED ON indicates connection to the WAN port.
LED ON indicates connection to the LAN port.
Power, Status, WAN
and
LAN
, to indicate different status of the system.
② WAN1/WAN2:
LAN1~LAN8:
③
8 Note:
Two WAN ports (10 Base-T / 100Base-TX RJ-45) are available on the system.
Client machines connect to WHG301 via LAN ports (10 Base-T / 100Base-TX RJ-45).
By default, all LAN ports are set with Port-based Default Service Zone; for Service Zone
configuration, please refer to
4.1.7. Service Zones
.
Rear Panel
① Reset:
② Console:
③ Power Socket:
Press this button to restart the system
The system can be configured via a serial console port. The administrator can use a terminal
emulation program such as Microsoft’s HyperTerminal to login to the configuration console interface to change
admin password or monitor system status, etc.
Please follow the steps below to install 4ipnet WHG301:
1. Connect the 12V power adapter to the power socket on the rear panel. The Power LED should be on to indicate
a proper connection.
2. Connect an Ethernet cable to the WAN1 Port on the front panel. Connect the other end of the Ethernet cable to
an xDSL/cable modem, or a switch/hub on the LAN of a company/organization. The LED of this port should be
on to indicate a proper connection.
3. Connect an Ethernet cable to one of the LAN1~LAN8 Ports on the front panel. Per your needs, connect the
other end of the Ethernet cable to an administrator PC for configuring the WHG301 system, an AP for extending
wireless coverage, a switch for connecting more wired clients, or a client PC. The LED of the connected port
should be on to indicate a proper connection.
WHG301 supports Auto Sensing MDI/MDIX. You may use either a straight-through or a cross-over
Ethernet cable to connect the Ethernet port.
4ipnet WHG301 supports web-based configuration. Upon the completion of hardware installation, WHG301 can be
configured via web browsers with JavaScript enabled such as Internet Explorer version 6.0 and above or Firefox.
There are two ways to configure the 4ipnet WHG301 system: using the online Configuration Wizard or changing
the settings by commands manually. The Configuration Wizard comprises of six basic steps as follows. Follow the
instructions of Configuration Wizard to enter the required information step by step, save your settings, and restart
WHG301. The 6 steps of Configuration Wizard are listed below:
Step 1. Change Admin’s Password
Step 2. Choose System’s Time Zone
Step 3. Set System Information
Step 4. Select Connection Type for WAN Port
Step 5. Add Local User Account (Optional)
Step 6. Save and Restart 4ipnet WHG301
Please follow the following steps to complete the quick configuration:
1.
To access the web management interface, connect a PC to one of the LAN1~8 ports, and then launch a
browse.
Make sure you have set DHCP in TCP/IP of your PC to get an IP address dynamically.
Next, enter the gateway IP address of WHG301 at the address field. The default gateway IP address
is“ https://192.168.1.254” (“https” is used for a secured connection).
The administrator login page will appear. Enter “ admin” , the default username, and “ admin” , the default
password, in the User Name and Password fields. Click Enter to log in.
After a successful login, a “Welcome to System Administration” page will appear on the screen.
because the browser treats WHG301 as an illegal website. Please press
“Continue to this website”
“Certificate Error”
continue. The default user login page will then appear in the browser. For more information, please see
Additional Configuration
.
,
to
4.2.5
If you can’t get the login screen, the reasons may be: (1) The PC is set incorrectly so that the PC can’t
obtain the IP address automatically from the LAN port; (2) The IP address and the default gateway are not
under the same network segment. Please use default IP address such as 192.168.1.xx in your network
and then try it again. For the configuration on PC, please refer to
Appendix F.
4ipnet WHG301 supports three kinds of account interface. You can log in as
default usernames and passwords show as follows:
Admin:
The administrator can access all configuration pages of WHG301.
User Name:
Password:
Please do NOT interrupt WHG301 restart process until the Configuration Wizard pop-up window has
disappeared— which indicates the restart process has been completed. If all steps are done properly, you can
start working on the system or refer to the user’s manual for advanced settings.
After finishing the configuration of the settings, please click
Apply
and pay attention to see if a RESTART
message appears on the screen. If such message appears, the system must be restarted to allow the new
settings to take effect. All on-line users will be disconnected during restart.
This section includes the following functions: Configuration Wizard, System Information, WAN1 Configuration,
WAN2 Configuration, WAN Traffic Settings, LAN Port Mapping and Service Zones.
There are two ways to configure the 4ipent WHG301 system: using the online Configuration Wizard or changing
the settings by commands manually. The Configuration Wizard comprises of 6 basic steps, providing a simple and
easy way to go through the basic setups of WHG301. Please refer to 3.2 Quick Software Configuration for the
detailed description of Configuration Wizard.
Main information about 4ipnet WHG301 is shown as follows:
Ÿ System Name: Set the system’s name or use the default.
Ÿ Device Name: FQDN (Fully-Qualified Domain Name). This is the domain name of the WHG301 as seen on
client machines connected on LAN ports. A user on client machine can use this domain name to access
WHG301 instead of its IP address. In addition, when “Use the name on the security certificate” option is
checked, the system will use the CN (Common Name) value of the uploaded SSL certificate as the domain
name.
Ÿ Home Page: Enter the URL of a Web server as the homepage. Once logged in successfully, users will be
directed to this homepage, such as http://www.4ipnet.com, regardless of the original homepage set in their
computers.
Ÿ Access History IP: Specify an IP address of the administrator’s computer or a billing system to get billing
history information of WHG301with the predefined URLs. An example is provided as follows:
The IP address or subnet of remote management PCs. Only PCs within this IP
range on the list are allowed to access the system's web management interface. For example, 10.2.3.0/24
means that as long as an administrator is using a computer with the IP address range of 10.2.3.0/24, he or she
can access the web management page. Another example is 10.0.0.3: if an administrator is using a computer
with the IP address of 10.0.0.3, he or she can access the web management page.
SNMP:
Ÿ
If this function is enabled, the Manager IP and the community can be assigned to access to access the
Management Information Base (MIB) of the system.
User logon SSL:
Ÿ
Ÿ
Time:
NTP (Network Time Protocol) communication protocol can be used to synchronize the system time with
Enable to activate https (encryption) or disable to activate http (non encryption) login page.
remote time server. Please specify the local time zone and the IP address of at least one NTP server for
adjusting the time automatically (Universal Time is Greenwich Mean Time, GMT). The time can also be
manually configured by selecting
There are 4 connection types for the WAN1 Port: Static IP Address, Dynamic IP Address, PPPoE and PPTP
Client.
Ÿ Static IP Address: Manually specifying the IP address of the WAN Port. The fields with red asterisks are
required to be filled in.
IP Address: The IP address of the WAN1 port.
Subnet Mask: The subnet mask of the WAN1 port.
Default Gateway: The gateway of the WAN1 port.
Preferred DNS Server: The primary DNS server used by the system.
Alternate DNS Server: The substitute DNS server used by the system. This is an optional field.
Ÿ Dynamic IP Address: It is only applicable for the network environment where the DHCP server is available on
the network. Click the Renew button to get an IP address automatically.
Ÿ PPPoE Client: When selecting PPPoE to connect to the network, please set the “User Name”, “Password”,
“MTU” and “CLAMPMSS”. There is a Dial on demand function under PPPoE. If this function is enabled, a
Maximum Idle Time can be set. When the idle time is reached, the system will automatically disconnect itself.