2.1 Important Notes...................................................................................................................................................7
2.3 The Fr ont LEDs...................................................................................................................................................8
3.1 Before Configuration.........................................................................................................................................12
3.3 LAN and WAN Port Addresses ..........................................................................................................................16
3.4 Information from your ISP ................................................................................................................................ 17
3.5Configuring with your Web Browser..................................................................................................................18
4.1.5 System Log .....................................................................................................................................................25
4.1.7 VoIP Log........................................................................................................................................................27
4.3.1 LAN (Local Area Network)............................................................................................................................. 32
4.3.2 WAN (Wide Area Network).............................................................................................................................39
4.3.5 QoS (Quality of Service) ................................................................................................................................61
4.3.6 V irtual Server.................................................................................................................................................73
4.4 Save Configuration to Flash .............................................................................................................................99
5.2.2 LINE Settings ...............................................................................................................................................106
5.3 How to make a call from FXS to FXO.............................................................................................................107
5.4 General Tone T able.........................................................................................................................................108
6.2 CE Mark Warning ........................................................................................................................................... 112
1
Page 4
Chapter 1
Introduction
1.1 Introducing the 11g Wireless ADSL2+ VoIP Router
Thank you for purchasing the 11g Wireless ADSL2+ VoIP Router. Your new router is an
all-in-one unit that combines an ADSL modem, ADSL router and Ethernet network switch to
provide everything you need to get the machines on your network connected to the Internet
over an ADSL broadband connection.
The 11g Wireless ADSL2+ VoIP Router complies with ADSL2+ standards for deployment
worldwide and supports downstream rates of up to 24 Mbps and upstream rates of up to 1
Mbps. Designed for small office, home office and residential users, the router enables even
faster Internet connections. You can enjoy ADSL services and broadband multimedia
applications such as interactive gaming, video streaming and real-time audio much easier
and faster than ever before.
The 11g Wireless ADSL2+ VoIP Router supports PPPoA (RFC 2364 – PPP (Point-to-Point
Protocol) over ATM Adaptation Layer 5), RFC 1483 encapsulation over ATM (bridged or
routed), PPP over Ethernet (RFC 2516), and IPoA (RFC1577) to establish a connection with
your ISP. Your new router also supports VC-based and LLC-based multiplexing.
The perfect solution for connecting a small group of PCs to a high-speed broadband Internet
connection, the 11g Wireless ADSL2+ VoIP Router allows multiple users to have high-speed
Internet access simultaneously.
Your new router also serves as an Internet firewall, protecting your network from access by
outside users. Not only does it provide a natural firewall function with Network Address
Translation (NAT), it also provides rich firewall features to secure your network. All incoming
data packets are monitored and filtered. You can also configure your new router to block
internal users from accessing the Internet.
2
Page 5
The 11g Wireless ADSL2+ VoIP Router provides two levels of security support. First, it
masks LAN IP addresses making them invisible to outside users on the Internet, so it is
much more difficult for a hacker to target a machine on your network. Second, it can block
and redirect certain ports to limit the services that outside users can access. To ensure that
games and other Internet applications run properly, you can open specific ports for outside
users to access internal services on your network.
The Integrated DHCP (Dynamic Host Control Protocol) client and server services allow
multiple users to get IP addresses automatically when the router boots up. Simply set local
machines as a DHCP client to accept a dynamically assigned IP address from the DHCP
server and reboot. Each time a local machine is powered up; the router recognizes it and
assigns an IP address to instantly connect it to the
LAN.
For advanced users, Virtual Service (port forwarding) functions allow the product to provide
limited visibility to local machines with specific services for outside users. You can set an
ISP (Internet Service Provider) provided IP address on the 11g Wireless ADSL2+ VoIP
Router and then you can reroute specific services to individual computers on your local
network. For instance, a dedicated web server can be connected to the Internet via the
router and then incoming requests for web pages that are received by the router can be
rerouted to your dedicated local web server, even though the server now has a different IP
address.
Virtual Server can also be used to re-task services to multiple servers. For instance, you can
set the router to allow separated FTP, Web, and Multiplayer game servers to share the same
Internet-visible IP address while still protecting the servers and LAN users from hackers.
3
Page 6
1.2 Features
Express Internet Access – ADSL2/2+ capable
The 11g Wireless ADSL2+ VoIP Router complies with ADSL worldwide standards.
Supporting downstream rates of 8Mbps with ADSL, the router is capable of up to 12/24
Mbps with ADSL2/2+, and upstream rates of up to 1 Mbps. Users enjoy not only high-speed
ADSL services but also broadband multimedia applications such as interactive gaming,
video streaming and real-time audio which are easier and faster than ever. The router is
compliant with Multi-Mode standard (ANSI T1.413, Issue 2; G.dmt (ITU G.992.1); G.hs (ITU
G994.1); G.dmt.bis (ITU G.992.3); and G.dmt.bisplus (ITU G.992.5)
Voice over IP compliance with SIP standard
The router supports cost-effective, toll-quality voice calls over the Internet. It complies with
the most popular industrial standard, SIP protocol, to ensure the interoperability with SIP
devices and major VoIP Gateways. The VoIP ADSL router supports call waiting, silence
802.11g Wireless AP with WPA/WPA2 Support (Wireless G router only)
With integrated 802.11g Wireless Access Point in the router, the device offers a quick and
easy access among wired network, wireless network and broadband connection (ADSL)
with single device simplicity, and as a result, mobility to the users. In addition to 54 Mbps
802.11g data rate, it also interoperates backward with existing 802.11b equipment. The
Wireless Protected Access (WPA) and Wireless Encryption Protocol (WEP) supported
features enhance the security level of data protection and access control via Wireless LAN.
Fast Ethernet Switch
A 4-port 10/100Mbps fast Ethernet switch is built-in with automatic switching between MDI
and MDI-X for 10Base-T and 100Base-TX ports, with auto detection allowing you to use
either straight or cross-over Ethernet cables.
Multi-Protocol to Establish a Connection
The router supports PPPoA (RFC 2364 - PPP over ATM Adaptation Layer 5), RFC 1483
encapsulation over ATM (bridged or routed), PPP over Ethernet (RFC 2516) and IPoA
(RFC1577) to establish a connection with an ISP. The router also supports VC-based and
LLC-based multiplexing.
Quick Installation Wizard
A web-based GUI and quick installation wizard help you easily install the VoIP/802.11g
ADSL2+ Router. Enter your ISP’s information and begin browsing the Internet immediately.
Universal Plug and Play (UPnP) and UPnP NAT Traversal
4
Page 7
This protocol is used to enable simple and robust connectivity among stand-alone devices
and PCs from many different vendors, and it makes setting up a network simple and
affordable. UPnP architecture leverages TCP/IP and the Web to enable proximity
networking in addition to control and data transfer among networked devices. With this
feature enabled, you can seamlessly connect to Net Meeting or MSN Messenger.
Network Address Translation
Network Address Translation (NAT) allows multiple users to access outside resources such
as the Internet simultaneously with one IP address/one Internet access account. Many
application layer gateways (ALG) are supported such as web browser, ICQ, FTP, Telnet,
E-mail, News, Net2phone, Ping, NetMeeting, IP phone and others.
Firewall
NAT technology supports simple firewalls and provides options for blocking access from the
Internet, like Telnet, FTP, TFTP, WEB and IGMP.
Domain Name System Relay
Domain Name System (DNS) relay provides an easy way to map a domain name with a
user-friendly name such as www.level1.com with an IP address. When a local machine sets
its DNS server to the router’s IP address, every DNS conversion request packet from the PC
to this router is forwarded to the real DNS on the outside network.
Dynamic Domain Name System (DDNS)
The Dynamic DNS service allows you to alias a dynamic IP address to a static hostname.
This dynamic IP address is the WAN IP address. To use the service, you must first apply for
an account from a DDNS service such as http://www.dyndns.org/.
PPP over Ethernet (PPPoE)
The 11g Wireless ADSL2+ VoIP Router provides an embedded PPPoE client function to
establish a connection. You get greater access speed without changing the operation
concept, while sharing the same ISP account and paying for one access account. No
PPPoE client software is required for the local computer. Automatic Reconnect and
Disconnect Timeout (Idle Timer) functions are also provided.
Quality of Service (QoS)
QoS gives you full control over which types of outgoing data traffic should be given priority
by the router, ensuring important data like gaming packets, customer information, or
management information move through the router ay lightning speed, even under heavy
load. The QoS features are configurable by source IP address, destination IP address,
protocol, and port. You can throttle the speed at which different types of outgoing data pass
through the router, to ensure P2P users don’t saturate upload bandwidth, or office browsing
doesn’t bring client web serving to a halt. In addition, or alternatively, you can simply change
5
Page 8
the priority of different types of upload data and let the router sort out the actual speeds.
Virtual Server:
You can specify which services are visible to outside users. The router detects an incoming
service request and forwards it to the specific local computer for handling. For example, you
can assign a PC in a LAN to act as a Web server inside and expose it to the outside network.
Outside users can browse inside the web server directly while it is protected by NAT. A DMZ
host setting is also provided for local computers exposed to the outside Internet network.
Dynamic Host Configuration Protocol (DHCP) Client and Server
On a WAN site, the DHCP client obtains an IP address from the Internet Service Provider
(ISP) automatically. On a LAN site, the DHCP server allocates a range of client IP
addresses, including subnet masks and DNS IP addresses and distributes them to local
computers. This provides an easy way to manage the local IP network.
Rich Packet Filtering
This feature filters the packet based on IP addresses as well as Port numbers. Filtering
packets to and from the Internet provides a higher level of security control.
Web-based GUI
A web-based GUI offers easy configuration and management. User-friendly and with on-line
help, it also supports remote management capability for remote users to configure and
manage this product.
Firmware Upgradeable
You can upgrade the router with the latest firmware through its web-based GUI.
6
Page 9
Chapter 2
Product Overview
2.1 Important Notes
Do not use the 11g Wireless ADSL2+ VoIP Router in high humidity or high
temperatures.
Do not use the same power source for the 11g Wireless ADSL2+ VoIP Router as other
equipment.
Do not open or repair the case yourself. If the 11g Wireless ADSL2+ VoIP Router is too
hot, turn off the power immediately and have it repaired at a qualified service center.
Avoid using this product and all accessories outdoors.
Place the 11g ADSL2+ VoIP Router on a stable surface.
Only use the power adapter that comes with the package. Using a different voltage
rating power adaptor may damage the router.
2.2 Package Contents
WBR-3470
AC-DC Power Adapter (12VDC, 1.2A)
RJ-11 ADSL/telephone Cable (1.8M)
CAT-5 Cable
CD Manual
Quick Installation Guide
7
Page 10
2.3 The Front LEDs
LED Description
1 PWR: Lights when the power is ON.
2 SYS:Lights when the system is ready.
3-6
LAN Port
1-4:
7 WLAN:
Steady glow when connected to an Ethernet device. Glows green for 100Mbps; Orange for 10Mbps. Blinking light when data is Transmitted / Received.
Lit green when the wireless connection is established. Flashes when sending/receiving data.
8-9 Phone: Lit green when the phone is off-hook.
10 LINE:
Lit when the inbound and outbound calls transmitted
through PSTN.
11 VoIP: Lit when SIP registration is OK.
12 PPP: Steady glow when there is a PPPoA / PPPoE connection.
13 ADSL:
Lights when successfully connected to an ADSL DSLAM
(linesync).
8
Page 11
2.4The Rear Ports
Port Description
1
2 PWR
3 RESET
4
5
6 LINE
7 ADSL
Power
Switch
LAN
Phone
Power ON/OFF switch.
Connect the supplied power adapter to this jack.
After the router is powered on, press this recessed button using
the end of paper clip or other small pointed object to reset the
router or to restore it to factory default settings.
1. Recovery procedures for non-working routers (e.g. after a
failed firmware upgrade flash):
2. Recovery procedures for a lost web interface password:
Connect a UTP Ethernet cable (Cat-5 or Cat-5e) to one of the
four LAN ports when connecting to a PC or an office/home
network of 10Mbps or 100Mbps.
Connect RJ-11 cable to this port when connecting to an analog
phone set.
Connect RJ-11 cable to this port when connecting to the
telephone wall jack
Connect the supplied RJ-11 (“telephone”) cable to this port when
connecting to the ADSL/telephone network.
8 Antenna
Connect the detachable antenna to this port.
9
Page 12
The detail instruction in Emergency/Failure Recovery Button
1. Recovery procedures for non-working routers (e.g. after a failed firmware upgrade flash):
Hold the Emergency/Failure Recovery Button on the back of the modem in. Keep this
button held in and turn on the modem. Once the lights on the modem have stopped
flashing, release the Emergency/Failure Recovery Button. The modem's
emergency-reflash web interface will then be accessible via http://192.168.1.254/ where
you can upload a firmware image to restore the modem to a functional state. Please note
that the modem will only respond via its web interface at this address, and will not
respond to ping requests from your PC or to telnet connections.
2. Recovery procedures for a lost web interface password:
After turning the router on press the Emergency/Failure Recovery Button on the back of
the modem, and hold the button in until all lights on the modem flash and it reboots with
factory default settings. The login will be reset to admin and the password will be reset to
admin, and the modem will be accessible via its default IP address at
http://192.168.1.254/
Note:
Before powered on the router to enter the recovery process. Please configure the IP
address of the PC as 192.168.1.1 and process step by step.
1. Power the router off.
2. Hold the "Emergency/Failure Recovery Button”.
3. Power on the router. Then Router's IP will reset to Default (Say 192.168.1.254)
4. Download the firmware.
10
Page 13
2.5 Cabling
One of the most common causes of problems is bad cabling or ADSL line(s). Make sure that
all connected devices are turned on. On the front of the product is a bank of LEDs. Verify that
the LAN Link and ADSL line LEDs are lit. If they are not, verify that you are using the proper
cables.
Ensure that all other devices connected to the same telephone line as your LevelOne router
(e.g. telephones, fax machines, analog modems) have a line filter connected between them
and the wall socket (unless you are using a Central Splitter or Central Filter installed by a
qualified and licensed electrician), and ensure that all line filters are correctly installed and
the right way around. Missing line filters or line filters installed the wrong way around can
cause problems with your ADSL connection, including frequent disconnections.
11
Page 14
Chapter 3
Installation
You can configure the 11g Wireless ADSL2+ VoIP Router through the convenient and
user-friendly interface of a web browser. Most popular operating systems such as Linux and
Windows 98SE/2000/XP include a web browser as a standard application.
3.1 Before Configuration
PCs must have a properly installed Ethernet interface and connect to the router directly or
through an external repeater hub. In addition, PCs must have TCP/IP installed and
configured to obtain an IP address through a DHCP server or a fixed IP address that must be
in the same subnet as the router. The default IP address of the router is 192.168.1.254 and
the subnet mask is 255.255.255.0 (i.e. any attached PC must be in the same subnet, and
have an IP address in the range of 192.168.1.1 to 192.168.1.253). The easiest way is to
configure the PC to obtain an IP address automatically from the router using DHCP. If you
encounter any problems accessing the router’s web interface you are advised to uninstall
any kind of software firewall on your PCs, as they can cause problems accessing the
192.168.1.254 IP address of the router.
Please follow the steps below for installation on your PC’s network environment. First of all,
check your PC’s network components. The TCP/IP protocol stack and Ethernet network
adapter must be installed. If not, please refer to your Windows-related or other operating
system manuals.
Note
Any TCP/IP capable workstation can be used to communicate with or through the
VoIP/(802.11g) ADSL2+ Router. To configure other types of workstations, please consult the
manufacturer’s documentation.
12
Page 15
Configuring a PC in Windows XP
1. Go to Start / Control Panel (in Classic
View). In the Control Panel, double-click on Network Connections
2. Double-click Local Area Connection.
3. In the Local Area Connection Status
window, click Properties.
4. Select Internet Protocol (TCP/IP) and click Properties.
5. Select the Obtain an IP address
automatically andthe Obtain DNS
server address automatically radio
buttons.
6. Click OK to finish the configuration.
13
Page 16
Configuring a PC in Windows 2000
1. Go to Start / Settings / Control Panel.
In the Control Panel, double-click on
Network and Dial-up Connections.
2. Double-click Local Area Connection.
3. In the Local Area Connection Status
window click Properties.
4. Select Internet Protocol (TCP/IP) and click Properties.
5. Select the Obtain an IP address
automatically andthe Obtain DNS
server address automatically radio
buttons.
6. Click OK to finish the configuration.
14
Page 17
Configuring PC in Windows 98/Me
1. Go to Start / Settings / Control Panel.
In the Control Panel, double-click on
Network and choose the
Configuration tab.
2. Select TCP/IP ->NE2000 Compatible,
or the name of your Network Interface
Card (NIC) in your PC.
3. Select the Obtain an IP address
automatically radio button.
4. Then select the DNS Configuration
tab.
5. Select the Disable DNS radio button
and click OK to finish the configuration.
15
Page 18
3.2 Factory Default Settings
Before configuring the 11g Wireless ADSL2+ VoIP Router, you need to know the following
default settings.
Web Interface:
Username: admin
Password: admin
LAN Device IP Settings:
IP Address: 192.168.1.254
Subnet Mask: 255.255.255.0
ISP setting in WAN site:
PPPoE
DHCP Server:
DHCP server is enabled.
Start IP Address: 192.168.1.100
IP pool counts: 100
3.3 LAN and WAN Port Addresses
The parameters of LAN and WAN ports are preset at the factory. The default values are
shown below.
LAN Port WAN Port
IP address
Subnet Mask
DHCP server function
IP addresses for
distribution to PCs
192.168.1.254
255.255.255.0
Enabled
100 IP addresses continuing from
192.168.1.100 through
192.168.1.199
The PPPoE function is
enabled to
automatically get the
WAN port
configuration from the
ISP, but you have to
set the username and
password first.
16
Page 19
3.4 Information from your ISP
Before configuring this device, you have to check with your ISP (Internet Service Provider)
what kind of service is provided such as PPPoE, PPPoA, RFC1483, or IPoA.
Gather the information as illustrated in the following table and keep it for reference.
MTU: Maximum Transmission Unit. The size of the largest datagram (excluding
media-specific headers) an IP attempts to send through the interface.
RFC 1483 Bridged Connections
Description: A user-definable name for this connection.
VPI/VCI: Enter the information provided by your ISP.
Encapsulation method: Select the encapsulation format, this is provided by your ISP.
Other WAN Bridge Connection
43
Page 46
Description: A user-definable name for this connection.
Using Same PVC as existing WAN connection: As the title descript it.
VPI/VCI: Enter the information provided by your ISP.
Encapsulation method: Select the encapsulation format, this is provided by your ISP.
4.3.2.2 DNS
A Domain Name System (DNS) contains a mapping table for domain name and IP
addresses. On the Internet, every host has a unique and user-friendly name (domain name)
such as www.level1.com and an IP address. An IP address is a 32-bit number in the form of
xxx.xxx.xxx.xxx, for example 192.168.1.254. You can think of an IP address as a telephone
number for devices on the Internet, and the DNS allows you to find the telephone number for
any particular domain name. Since an IP Address is hard to remember, the DNS converts
the friendly name into its equivalent IP Address.
You can obtain a Domain Name System (DNS) IP address automatically if your ISP has
44
Page 47
provided it when you logon. Usually when you choose PPPoE or PPPoA as your WAN - ISP
protocol, the ISP provides the DNS IP address automatically. You may leave the
configuration field blank. Alternatively, your ISP may provide you with an IP address of their
DNS. If this is the case, you must enter the DNS IP address.
If you choose one of the other protocols, RFC1483 Routed or Bridged, check with your ISP,
as it may provide you with an IP address for their DNS server. You must enter the DNS IP
address if you set the DNS Server address on your PC to the LAN IP address of this router.
4.3.2.3 ADSL
ADSL Mode: There are four modes for WBR-3470A “Open Annex Type and Follow
DSLAM’sSetting”, ”Annex A Only”, ”Annex L Only” and ”Annex M Only” that user can
select for this connection.
Note: For Annex B, There is only one operation mode as “Annex B”
Modulator: There are four modes “AUTO”,”ADSL multimode”,”ADSL2”and”ADSL2+”
that user can select for this connection.
DSP Firmware Version: DSP code version
DMT Status: DMT Status
Operational Mode: To show the state when user select “AUTO” on connect mode.
Upstream: Upstream rate
Downstream: Downstream rate
45
Page 48
4.3.3 System
There are six items within the System section: Time Zone, Remote Access, Firmware
Upgrade, Backup/Restore, Restart and User Management.
4.3.3.1 Time Zone
The router does not have a real time clock on board; instead, it uses the Simple Network
Time Protocol (SNTP) to get the current time from an SNTP server outside your network.
Choose your local time zone, click Enable and click the Apply button. After a successful
connection to the Internet, the router retrieves the correct local time from the SNTP server
you have specified. If you prefer to specify an SNTP server other than those in the
drop-down list, simply enter its IP address as shown above. Your ISP may provide an SNTP
server for you to use.
Resync Period (in minutes) is the periodic interval the router waits before it resynchronizes
the router’s time with that of the specified SNTP server. To avoid unnecessarily increasing
the load on your specified SNTP server you should keep the poll interval as high as
possible – at the absolute minimum every few hours or even days.
46
Page 49
4.3.3.2 Remote Access
To temporarily permit remote administration of the router (i.e. from outside your LAN), select
a time period the router permits remote access for and click Enable. You may change other
configuration options for the web administration interface using Device Management
options in the Advanced section of the GUI.
4.3.3.3 Firmware Upgrade
Your router’s “firmware” is the software that allows it to operate and provides all its
functionality. Think of your router as a dedicated computer, and the firmware as the software
it runs. Over time this software may be improved and modified. Your router allows you to
upgrade the software it runs to take advantage of these changes.
Clicking on Browse allows you to select the new firmware image file you have downloaded
to your PC. Once the correct file is selected, click Upgrade to update the firmware in your
router.
Restart Router with: To choose “Factory Default Setting” or “Current Settings” that
user want.
New Firmware Image:Type in the location of the file you wish to upload in this field or
click Browse ... to find it.
Browse...: Click Browse... to find the .afw file you wish to upload. Remember that you
must decompress compressed (.zip) files before you can upload them.
47
Page 50
Upgrade: Click upgrade to begin the upload process. This process may take up to two
minutes.
DO NOT power down the router or interrupt the firmware upgrade while it
is still in process. Improper operation may damage the router. Please see
section 2.4 for emergency recovery procedures.
4.3.3.4 Backup / Restore
These functions allow you to save and backup your router’s current settings to a file on your
PC, or to restore a previously saved backup. This is useful if you wish to experiment with
different settings, knowing that you have a backup handy in the case of any mistakes. It is
advisable to backup your router’s settings before making any significant changes to your
router’s configuration.
Press Backup to select where on your local PC to save the settings file. You may also
change the name of the file when saving if you wish to keep multiple backups.
Press Browse to select a file from your PC to restore. You should only restore settings files
that have been generated by the Backup function, and that were created when using the
current version of the router’s firmware. Settings files saved to your PC should not be
manually edited in any way.
Select the settings files you wish to use, and press Restore to load those settings into the
router.
48
Page 51
4.3.3.5 Restart Router
Click Restart with option Current Settings to reboot your router and restore your last saved
configuration.
If you wish to restart the router using the factory default settings (for example, after a
firmware upgrade or if you have saved an incorrect configuration), select Factory Default Settings to reset to factory default settings.
You may also reset your router to factory settings by pressing in the small Reset pinhole
button on the back of your router for 10-12 seconds while the router is turned on.
4.3.3.6 User Management
To prevent unauthorized access to your router’s configuration interface, all users are
required to login with a password. You can set up multiple user accounts, each with their own
password.
You are able to Edit existing users and Create new users who are able to access the
device’s configuration interface. Once you have clicked on Edit, you are shown the following
options:
49
Page 52
You can change the user’s password, whether their account is active and Valid, as well as
add a comment to each user account. These options are the same when creating a user
account, with the exception that once created you cannot change the username. You cannot
delete the default admin account; however you can delete any other created accounts by
clicking Cancel when editing the user.
You are strongly advised to change the password on the default “admin” account when you
receive your router, and any time you reset your configuration to Factory Defaults.
50
Page 53
4.3.4 Firewall
Firewall and Access Control
Your router includes a full SPI (Stateful Packet Inspection) firewall for controlling Internet
access from your LAN, as well as helping to prevent attacks from hackers. In addition to this,
when using NAT (Network Address Translation) the router acts as a “natural” Internet
firewall, since all PCs on your LAN use private IP addresses that cannot be directly
accessed from the Internet. See the WAN configuration section for more details on NAT.
Firewall: Prevents access from outside your network. The router provides three levels of
security support:
NAT natural firewall: This masks LAN users’ IP addresses, which are invisible to outside
users on the Internet, making it much more difficult for a hacker to target a machine on your
network. This natural firewall is on when the NAT function is enabled.
When using Virtual Servers (port forwarding) your PCs are exposed to the
degree specified in your Virtual Server settings provided the ports specified
are opened in your firewall packet filter settings.
Firewall Security and Policy (General Settings): Inbound direction of Packet Filter rules
prevent unauthorized computers or applications accessing your local network from the
Internet.
Intrusion Detection: Enable Intrusion Detection to detect, prevent, and log malicious
attacks.
MAC Filter rules: Prevents unauthorized computers accessing the Internet.
URL Filter: Blocks PCs on your local network from unwanted websites.
A detailed explanation of each of the following five items appears in the Firewall section
below: Packet Filter, MAC Address Filter, Intrusion detection, Block WAN Request and
URL Filter.
51
Page 54
4.3.4.1 Packet Filter
Packet filtering enables you to configure your router to block specified internal/external
users (IP address) from Internet access, or you can disable specific service requests (Port
number) to /from Internet. This configuration program allows you to set up to 6 different filter
rules for different users based on their IP addresses or their network Port number. The
relationship among all filters is “or” operation, which means that the router checks these
different filter rules one by one, starting from the first rule. As long as one of the rules is
satisfied, the specified action is taken.
Add: Click this button to add a new packet filter rule and the next figure appears.
Edit: Check the Rule No. you wish to edit, and then click “Edit”.
Delete: Check the Rule No. you wish to delete, and then click “Delete”.
Application: User can choose they want.
~ Outgoing ~ Incoming: Determine whether the rule is for outgoing packets or for
52
Page 55
incoming packets.
Active: Choose “Yes” to enable the rule, or choose “No” to disable the rule.
Packet Type: Specify the packet type (TCP, UDP, ICMP or any) that the rule applies to.
Select TCP if you wish to search for the connection-based application service on the remote
server using the port number. Or select UDP if you want to search for the connectionless
application service on the remote server using the port number.
Log: Choose “Yes” if you wish to generate logs when the filer rule is applied to a packet.
Action When Matched: If a packet matches this filter rule, Forward or Drop this packet.
Source IP Address: Enter the incoming or outgoing packet’s source IP address(es).
Source Port: Check the TCP or UDP packet’s source port number(s).
Destination IP Address: Enter the incoming or outgoing packet’s destination IP
address(es).
Destination Port: Check the TCP or UDP packet’s destination port number(s).
Schedule time: User can setup the time to use the packet filter.
If the DHCP server option is enabled, you must be very careful in assigning
IP addresses of a filtered private IP range to avoid conflicts because you do
not know which PC in the LAN is assigned which IP address. The easiest
Attention
and safest way is that the filtered IP address is assigned to a specific PC
that is not allowed to access an outside resource such as the Internet. You
configure the filtered IP address manually for this PC, but it stays in the
same subnet with the router.
53
Page 56
4.3.4.2 Ethernet MAC Filter
A Ethernet MAC (Media Access Control) address is the unique network hardware identifier
for each PC on your network’s interface (i.e. its Network Interface Card or Ethernet card).
Using your router’s MAC Address Filter function, you can configure the switch to only accept
traffic from specified machines, or else to block specific machines from accessing your LAN.
There are no pre-defined MAC address filter rules; you can add the filter rules to meet your
requirements.
Active: Select Yes from the drop down list box to enable MAC address filtering.
Action When Matched: Select “Drop” or “Forward”.
Log: Choose “Yes” if you wish to generate logs when the filer rule is applied to a packet.
MAC Address: Enter the MAC addresses you wish to manage.
Candidates: it automatically detects devices connected to the router through the
Ethernet.
54
Page 57
55
Page 58
4.3.4.3 Wireless MAC Filter
The MAC Address supports up to 30 wireless network machines and helps you to manage
your network control to accept traffic from specific authorized machines or to restrict
unwanted machine(s) to access your LAN.
There are no pre-define MAC Address filter rules; you can add the filter rules to meet your
requirements
Active: Select Yes from the drop down list box to enable MAC address filtering.
Action When Matched: Select “Drop” or “Forward”.
Log: Choose “Yes” if you wish to generate logs when the filer rule is applied to a packet.
MAC Address: Enter the MAC addresses you wish to manage.
Candidates: it automatically detects devices connected to the router through the
Ethernet.
56
Page 59
4.3.4.4 Intrusion Detection
Check “Enable” if you wish to detect intruders accessing your computer without permission.
The router automatically detects and blocks a DoS (Denial of Service) attack if a user
enables this function. This kind of attack is not to access confidential data on the network;
instead, it aims to disrupt specific equipment or the entire network. If this happens, users are
not able to access network resources.
Intrusion Detection: Check “Enable” if you wish to detect intruders accessing your
computer without permission.
Alert Mail: Select this check box to use Alert Mail.
Alert Mail Time: Set the time for receiving Alert mail.
Your E-Mail: Set your email address.
Recipient’s E-mail: Set the Recipient’s email address to which the E-<mail notification is
sent.
SMTP server: Set the SMTP (mail) server address.
57
Page 60
4.3.4.5 Block WAN Request
Check “Enable” if you wish to exclude outside PING requests from reaching this router.
4.3.4.6 URL Filter
URL (Uniform Resource Locator – e.g. an address in the form of http://www.level1.com or
http://www.example.com) filter rules allow you to prevent users on your network from
accessing particular websites from their URL. There are no pre-defined URL filter rules; you
can add filter rules to meet your requirements.
Active: Select Yes from the drop down list box to enable or disable the URL Filter feature.
58
Page 61
Always Block: Select to always check URL filter rules (i.e. at all hours of the day).
Block from: Specify the time period to check URL filter rules (e.g. during work hours).
Keywords Filtering: Allows blocking by specific keywords within a particular URL rather
than having to specify a complete URL (e.g. to block any image called “advertisement.gif”).
When enabled, your specified keywords list is checked to see if any keywords are present in
URLs accessed to determine if the connection attempt should be blocked. Note that the URL
filter blocks web browser (HTTP) connection attempts using port 80 only.
For example, the URL http://www.abc.com/abcde.html would be dropped since the keyword
“abcde” occurs in the URL.
Domains Filtering: Checks the domain name in URLs accessed against your list of
domains to block or allow. If it matches, the URL request is sent (Trusted) or dropped
(Forbidden). The checking procedure is:
1. Check the domain in the URL to determine if it is in the trusted list. If yes, the connection
attempt is sent to the remote web server.
2. If not, it is checked with the forbidden list. If present, the connection attempt is dropped.
3. If the packet matches neither of the above, it is sent to the remote web server.
4. Please note that only the domain is specified, not the full URL. For example to block
traffic to www.sex.com, enter “sex” or “sex.com” instead of “www.sex.com”. In the
example below, the URL request for www.abc.com is sent to the remote web server
because it is listed in the trusted list, while the URL request for www.sex or www.sex.com
is dropped because sex.com is in the forbidden list.
59
Page 62
Restrict URL Features
~Block Java Applet: Blocks Web content which includes the Java Applet to prevent
someone who wants to damage your system via the standard HTTP protocol.
~ Block ActiveX: Blocks ActiveX
~ Block Cookies: Blocks Cookies
~ Block Proxy: Blocks Proxy
60
Page 63
4.3.5 QoS (Quality of Service)
Quality of Service Introduction
If you’ve ever found your ‘net’ speed has slowed to a crawl because another family member
is using a P2P file sharing program, you’ll understand why the Quality of Service features in
LevelOne’s routers is such a breakthrough for home users and office users.
QoS: Keeping Your Net Connection Fast and Responsive
Configurable by source IP address, destination IP address, protocol, and port, the Quality of
Service (QoS) gives you full control over which types of outgoing data traffic should be given
priority by the router, ensuring bandwidth-consumption data like gaming packets,
latency-sensitive application like voice, or even mission critical files, move through the router
at lightning speed, even under heavy load. You can throttle the speed at which different
types of outgoing data pass through the router. In addition, you can simply change the
priority of different types of upload data and let the router sort out the actual speeds.
QoS Setup
Please choose the QoS in the Configuration item of the left window as depicted below.
After clicking the QoS item, you can Add/Edit/Delete a QoS policy. This page will show the
brief information for policies you have added or edited. This page will also display the total
available (Non-assigned) bandwidth, in percentage, can be assigned.
61
Page 64
Application: A name that identifies an existing policy.
Time Schedule: Scheduling your QoS policy to be applied.
Direction: The traffic flow direction to be controlled by the QoS policy.
There are two settings to be provided in the Router:
~ LAN to WAN: You want to control the traffic flow from the local network to the outside
world. E.g., you have a FTP server inside the local network and you want to have a limited
traffic rate controlled by the QoS policy. So, you need to add a policy with LAN to WAN
direction setting.
~WAN to LAN: Control Traffic flow from the WAN to LAN. The connection maybe either
issued from LAN to WAN or WAN to LAN.)
Assigned Bandwidth Ratio: This field shows the assigned bandwidth ratio in
percentage for a QOS policy. If WAN connection to internet is established, the estimated
transfer rate will be shown in kbps. You may specify a fixed transfer rate or Minimum
Guaranteed Rate with priority for non-used bandwidth.
Non-Assigned Bandwidth Ratio: This field shows the available bandwidth ratio, for LAN to
WAN and WAN to LAN, that has not yet assigned.
: Press this button to add a new QoS policy.
: Before using these buttons to edit or delete a policy, please select one policy
62
Page 65
you want to edit/delete from the radio option.
: After you have configured the policies, you can press this button to apply the
configuration. If you want to make the change persistent in flash, choose
in the left windows to save it into flash.
When you press or buttons described above, the following page will show up in
your browser. You can use it to define a QoS policy.
Controlled Traffic Flow: Specify the traffic flow you want to control. For GRE protocol,
there is no need to specify the IP addresses or Application ports in this page. For other
protocols, at least one value shall be given.
Packet type: The packet type will be controlled. For GRE protocol, there is no need to
specify the IP addresses or Application ports in this page. For other protocols, at least one
value shall be given.
~ ANY: No specified protocol type is specified.
~ TCP
~ UDP
~ ICMP
~ GRE: For PPTP VPN Connections.
Assigned Data rate: Assign the data ratio for this policy to be controlled. For examples,
63
Page 66
we want to only allow 20% of the total data transfer rate for the LAN-to-WAN direction to be
used for FTP server. Then we can specify here with data ratio = 20. If you have ADSL LINE
with 256K/bps.rate, the estimated data rate, in kbps, for this rule is 20%*256*0.9 = 46kbps.
(For 0.9 is an estimated factor for the effective data transfer rate for a ADSL LINE from LAN
to WAN. For WAN-to-LAN, it is 0.85 to 0.8).
Data Ratio: percentage for the data rate to be controlled by this policy. As above FTP
server examples, it is 20.
Rate Type: We provide 2 types here:.
~Fixed (Maximum): specify a fixed data rate for this policy. It also is the maximal rate for
this policy. As above FTP server example, you may want to “throttle” the outgoing FTP
speed to 20% of 256K and limit to it, you may use this type.
~ Guaranteed (Minimum): specify a minimal data rate for this policy. For example, you
want to provide a guaranteed data rate for your outside customers to access your internal
FTP server with, say at least, 20% of your total bandwidth. You can use this type. Then, if
there is available bandwidth that is not used, it will be given to this policy by following priority
assignment.
Priority for Non-used Bandwidth: Specify the priority for the bandwidth that is not used.
For examples, you may specify two different QoS policies for different applications. Both
applications need a minimal bandwidth and need more bandwidth, beside the assigned one,
if there is any available/non-used one available. So, you may specify which application can
have higher priority to acquire the non-used bandwidth.
~ High
~ Normal: The default is normal priority.
~ Low
For the sample priority assignment for different policies, it is saved in a First-In-First-Out
way.
DSCP Marking: Differentiated Services Code Point (DSCP), it is the first 6 bits in the ToS
byte. DSCP Marking allows users to classify traffic based on DSCP value and send packets
to next Router.
DSCP Mapping Table
Disabled None
Best Effort Best Effort (000000)
64
Page 67
Premium Express Forwarding (101110)
Gold service (L) Class 1, Gold (001010)
Gold service (M) Class 1, Silver (001100)
Gold service (H) Class 1, Bronze (001110)
Silver service (L) Class 2, Gold (010010)
Silver service (M) Class 2, Silver (010100)
Silver service (H) Class 2, Bronze (010110)
Bronze service (L) Class 3, Gold (011010)
Bronze service (M) Class 3, Silver (011100)
Bronze service (H) Class 3, Bronze (011110)
Local Machine IPs: The IP address values for Local LAN machines you want to control.
(For IP packets from LAN to WAN, it is the source IP address. For IP packages from WAN to
LAN, it is the destination IP address.)
Remote Machine IPs: The IP address values for Remote WAN machines you want to
control. (For IP packets from LAN to WAN, it is the destination IP address. For IP packages
from WAN to LAN, it is the source IP address.)
Local Application Ports: The Application port values for local LAN machines you want
to control. (For TCP/UDP packets from LAN to WAN, it is the source port value. For
TCP/UDP packets from WAN to LAN, it is the destination port value.)
Remote Application Ports: The Application port values for remote machines you want
to control. (For TCP/UDP packets from LAN to WAN, it is the destination port value. For
TCP/UDP packets from WAN to LAN, it is the source port value.)
Schedule Time: Schedule your QOS policy.
65
Page 68
QoS example for your Network
V
Connection Diagram
oIP
HTTP web
Normal PCs
browsing users
Restricted PC
ADSL Subscription Rate
Upstream: 256 kbps
Downstream: 2048 Mbps
Example QOS Plan
:.
Application IP or Ports Control Flow Data Rate Time Schedule
VoIP User 192.168.0.1 Outgoing Minimal 20% with high priority
for non-used bandwidth with
SDCP marking Class 1 Gold
Service
FTP Sever 192.168.0.100 Incoming and
Going
HTTP web
browsing
users
80 Incoming and
Going
outgoing :minimal 30%. Data
rate.
incoming :minimal 30%. Data
rate.
Both with low priority for
non-used bandwidth.
outgoing : limited 20%. Data
rate.
incoming : limited 30%. Data
rate.
Always
Only Working
Hours 9:00 to
17:00 Monday
to Friday.
Always
66
Page 69
Example QoS Setup
VoIP application
Voice is latency-sensitive application. Most VoIP devices are use SIP protocol and the port
number will be assigned by SIP module automatically. Better to use fixed IP address for
catching VoIP packets as high priority.
67
Page 70
Above settings will help to improve quality of your VoIP service when traffic is full loading.
68
Page 71
FTP Server Application
Some of companies will setup FTP server for customer downloading or home user sharing
their files by using FTP.
LAN to WAN direction:
69
Page 72
WAN to LAN direction:
With above settings that help to limit utilization of upstream of FTP. Time schedule also help
you to only limit utilization at day time.
70
Page 73
HTTP Web Browsing
You can control the internet web browsing by specify the HTTP 80 (8080 for some proxy
server).
LAN to WAN direction:
71
Page 74
WAN to LAN direction:
72
Page 75
4.3.6 Virtual Server
In TCP/IP and UDP networks a port is a 16-bit number used to identify which application
program (usually a server) incoming connections should be delivered to. Some ports have
numbers that are pre-assigned to them by the IANA (the Internet Assigned Numbers
Authority), and these are referred to as “well-known ports”. Servers follow the well-known
port assignments so clients can locate them.
If you wish to run a server on your network that can be accessed from the WAN (i.e. from
other machines on the Internet that are outside your local network), or any application that
can accept incoming connections (e.g. Peer-to-peer/P2P software such as instant
messaging applications and P2P file-sharing applications) and are using NAT (Network
Address Translation), then you need to configure your router to forward these incoming
connection attempts using specific ports to the PC on your network running the application.
You also need to use port forwarding if you wish to host an online game server.
The reason is that when using NAT, your publicly accessible IP address is used by and
points to your router, which needs to deliver all traffic to the private IP addresses used by
your PCs. Please see the WAN configuration section of this manual for information on NAT.
The Internet Assigned Numbers Authority (IANA) is the central coordinator for the
assignment of unique parameter values for Internet protocols. Port numbers range from 0 to
65535, but only port numbers 0 to 1023 are reserved for privileged services and are
designated as “well-known ports”. The registered ports are numbered from 1024 through
49151. The remaining ports, referred to as dynamic ports, or private ports, are numbered
from 49152 through 65535.
Examples of well-known and registered port numbers are shown below, for further
information, please see IANA’s website at: http://www.iana.org/assignments/port-numbers
For help on determining which private port numbers are used by common applications on
this list, please see the FAQs (Frequently Asked Questions) at: http://www.level1.com
73
Page 76
Well-known and Registered Ports
Port Number Protocol Description
20 TCP FTP Data
21 TCP FTP Control
22 TCP & UDP SSH Remote Login Protocol
23 TCP Telnet
25 TCP SMTP (Simple Mail Transfer Protocol)
53 TCP & UDP DNS (Domain Name Server)
69 UDP TFTP (Trivial File Transfer Protocol)
80 TCP World Wide Web HTTP
110 TCP POP3 (Post Office Protocol Version 3)
119 TCP NEWS (Network News Transfer Protocol)
123 UDP NTP (Network Time Protocol)
443 TCP & UDP HTTPS