Page 1
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
NETGEAR, Inc.
4500 Great America Parkway
Santa Clara, CA 95054 USA
November 2007
202-10289-01
v1.0
Page 2
© 2007 by NETGEAR, Inc. All rights reserved.
Trademarks
NETGEAR and the NETGEAR logo are registered trademarks and ProSafe is a trademark of NETGEAR, Inc.
Microsoft, Windows, and Wi ndows NT are registered trademarks of Microsoft Corporation. Other brand and product
names are registered trademarks or trademarks of their respective holders.
Statement of Conditions
In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to
make changes to the products described in this document without notice.
NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit
layout(s) described herein.
Federal Communications Commission (FCC) Compliance Notice: Radio Frequency
Notice
This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to
part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a
residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and
used in accordance with the instruct ions, may cause harmf ul interference to radio communications. However, there is no
guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to
radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try
to correct the interference by one or more of the following measures:
• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and receiver.
• Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
• Consult the dealer or an experienced radio/TV technician for help.
EU Regulatory Compliance Statement
ProSafe Quad WAN Gigabit Firewall is compliant with the following EU Council Directives: 89/336/EEC and LVD 73/
23/EEC. Compliance is verified by testing to the following standards: EN55022 Class B, EN55024 and EN60950-1.
Bestätigung des Herstellers/Importeurs
Es wird hiermit bestätigt, daß das ProSafe Quad WAN Gigabit Firewall gemäß der im BMPT-AmtsblVfg 243/1991 und
Vfg 46/1992 aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte (z.B. T e stsender)
kann jedoch gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung.
Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt
gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.
Certificate of the Manufacturer/Importer
It is hereby certified that the ProSafe Quad WAN Gigabit Firewall has been suppressed in accordance with the
conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example,
test transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please refer to the
notes in the operating instructions.
ii
1.0, November 2007
Page 3
Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market
and has been granted the right to test the series for compliance with the regulations.
Additional Copyrights
AES Copyright (c) 2001, Dr Brian Gladman <brg@gladman.uk.net>, Worcester, UK.
All rights reserved.
TERMS
Redistribution and use in source and binary forms, with or without modification, are permitted
subject to the following conditions:
1. Redistributions of source code must retain the above copyright notice, this list of
conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions and the following disclaimer in the documentation and/or other materials
provided with the distribution.
3. The copyright holder's name must not be used to endorse or promote any products
derived from this software without his specific prior written permission.
This software is provided 'as is' with no express or implied warranties of correctness or fitness
for purpose.
1.0, November 2007
iii
Page 4
Open SSL Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted
provided that the following conditions * are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions
and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions and the following disclaimer in the documentation and/or other materials
provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the
following acknowledgment: “This product includes software developed by the OpenSSL
Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)”
4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to endorse or
promote products derived from this software without prior written permission. For written
permission, please contact openssl-core@openssl.org.
5. Products derived from this software may not be called "OpenSSL" nor may "OpenSSL"
appear in their names without prior written permission of the OpenSSL Project.
6. Redistributions of any form whatsoever must retain the following acknowledgment: "This
product includes software developed by the OpenSSL Project for use in the OpenSSL
Toolkit (http://www.openssl.org/)"
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This
product includes software written by Tim Hudson (tjh@cryptsoft.com).
iv
1.0, November 2007
Page 5
MD5 Copyright (C) 1990, RSA Data Security, Inc. All rights reserved.
License to copy and use this software is granted provided that it is identified as the "RSA Data
Security, Inc. MD5 Message-Digest Algorithm" in all material mentioning or referencing this
software or this function. License is also granted to make and use derivative works provided
that such works are identified as "derived from the RSA Data Security, Inc. MD5 MessageDigest Algorithm" in all material mentioning or referencing the derived work.
RSA Data Security, In c. makes no representations concerning either the merchantability of
this software or the suitability of this software for any particular purpose. It is provided "as is"
without express or implied warranty of any kind.
These notices must be retained in any copies of any part of this documentation and/or
software.
PPP Copyright (c) 1989 Carnegie Mellon University. All rights reserved.
Redistribution and use in source and binary forms are permitted provided that the above
copyright notice and this paragraph are duplicated in all such forms and that any
documentation, advertising materials, and other materials related to such distribution and use
acknowledge that the software was developed by Carnegie Mellon University. The name of
the University may not be used to endor s e or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
Zlib zlib.h -- interface of the 'zlib' general purpose compression library version 1.1.4, March 11th,
2002. Copyright (C) 1995-2002 Jean-loup Gailly and Mark Adler.
This software is provided 'as-is', without any express or implied warranty. In no event will the
authors be held liable for any damages arising from the use of this software. Permission is
granted to anyone to use this software for any purpose, including commercial applications,
and to alter it and redistribute it freely, subject to the following restrictions:
1. The origin of this software must not be misrepresented; you must not claim that you wrote
the original software. If you use this software in a product, an acknowledgment in the
product documentation would be appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be misrepresented
as being the original software.
3. This notice may not be removed or altered from any source distribution.
Jean-loup Gailly: jloup@gzip.org; Mark Adler: madler@alu mni.caltech.edu
The data format used by the zlib library is described by RFCs (Request for Comments) 1950
to 1952 in the files ftp://ds.internic.net/rfc/rfc1950.txt (zlib format), rfc1951.txt (deflate format)
and rfc1952.txt (gzip format)
1.0, November 2007
v
Page 6
Safety Precautions
Use the following safety guidelines to ensure your own personal safety and to help protect your system from potential
damage. To reduce the risk of bodily injury, electrical shock, fire, and damage to the equipment, observe the following
precautions:
• Observe and follow service markings.
– Do not service any product except as explained in the documentation.
– Opening or removing covers that are marked with the triangular symbol with a lightning bolt may expose you
to electrical shock. Only a trained service technician should service components inside these compartments.
• If any of the following conditions occur, unplug the product from the electrical outlet and replace the part or contact
your trained service provider:
– The power cable, extension cable, or plug is damaged.
– An object has fallen into the product.
– The product has been exposed to water.
– The product has been dropped or damaged.
– The product does not operate correctly when you follow the operating instructions.
• Keep your system away from radiators and heat sources. Also, do not block cooling vents.
• Do not spill food or liquids on your system components, and never operate the product in a wet environment. If the
system gets wet, see the appropriate section in your troubleshooting guide or contact your trained service provider.
• Do not push any objects into the openings of your system. Doing so can cause fire or electric shock by shorting out
interior components.
• Use the product only with approved equipment.
• Allow the product to cool before removing covers or touching internal components.
• Operate the product only from the type of external power source indicated on the electrical ratings label. If you are
not sure of the type of power source required, consult your service provider or local power company.
Product and Publication Details
Model Number: FR538G
Publication Date: November 2007
Product Family: Quad WAN gigabit Firewall
Product Name: ProSafe Quad WAN Gigabit Firewall
Home or Business Product: Business
Language: English
Publication Part Number: 202-10289-01
Publication Version Number 1.0
vi
1.0, November 2007
Page 7
Contents
About This Manual
Conventions, Formats and Scope ...................................................................................xiii
How to Use This Manual ..................................................................................................xiv
How to Print this Manual ..................................................................................................xiv
Revision History .................. ... ... ... .... ... ... ... ....................................... ... .... ... ... ... ... .............xv
Chapter 1
Introduction
Key Features ..................................................................................................................1-1
Quad WAN Ports for Increased Reliability or Outbound Load Balancing .................1-2
A Powerful, True Firewall with Content Filtering ......................................................1-2
Security Features .....................................................................................................1-2
Autosensing Ethernet Connections with Auto Uplink ...............................................1-3
Extensive Protocol Support ......................................................................................1-3
Easy Installation and Management ..........................................................................1-4
Maintenance and Support ............... ... .... ... ... ... ... .... ... ... ... .... ... ... ... .... ... ... ..................1-4
Package Contents ..........................................................................................................1-5
Router Front Panel ...................................................................................................1-5
Router Rear Panel ...................................................................................................1-7
Rack Mounting Hardware .........................................................................................1-7
The Router’s IP Address, Login Name, and Password ............................................1-8
Default Log In Settings .............................................................................................1-8
Chapter 2
Connecting the FR538G
Logging into the Quad WAN Gigabit Firewall .................................................................2-1
Connecting Your Router to the Internet ..........................................................................2-1
Configuring the WAN Port Internet Connections ............................................................2-2
Setting the Router’s MAC Address .................... .... ... ... ... .... ... ... ... .... ... ... ... ... .... ... ... ..2-5
Manually Configuring Your Internet Connection . .......................... .......................... .. 2-5
Contents vii
v1.0, November 2007
Page 8
Connecting Your Router in Transparent Bridge Mode ....................................................2-7
Programming the Traffic Meter (if Desired) ....................................................................2-9
Configuring the WAN Mode (Required for Quad WAN) ................................................2-11
Setting Up Auto-Rollover Mode .......................... ....... ...... ....... ...... ....... ...... ....... ... ...2-12
Setting Up Load Balancing .....................................................................................2-14
Configuring Dynamic DNS (If Needed) .........................................................................2-17
Configuring the Advanced WAN Options (If Needed) ................................................ ...2-20
Chapter 3
LAN Configuration
Using the Firewall as a DHCP server .............................................................................3-1
Configuring the LAN Setup Options ................ ......................................................... 3-2
Configuring Multi Home LAN IPs .............................................................................3-4
Configuring Port Mirror .............................................................................................3-6
Port Management ................................... ... ... ... ... .... ...................................... .... ... ... ..3-7
Managing Groups and Hosts (LAN Groups) ...................................................................3-8
Creating the Network Database ... ... ... .... ... ... ... ... .... ... ... ... .... ... ... ... .... ........................3-9
Setting Up Address Reservation .................. .......................................................... 3-12
Configuring and Enabling the DMZ Port .......................................................................3-12
Static Routes ................................................................................................................3-15
Configuring Static Routes .......................................................................................3-15
Routing Information Protocol (RIP) ........................................................................3-17
Static Route Example .............................................................................................3-19
Network Binding ...........................................................................................................3-19
Chapter 4
Firewall Protection and Content Filtering
Using Rules to Block or Allow Specific Kinds of Traffic ..................................................4-1
Services-Based Rules ..................................... ... .... ... ... ... .... ... ... ... .... ... .....................4-2
Outbound Rules (Service Blocking) ...................................................................4-2
Inbound Rules (Port Forwarding) ......................................................................4-4
Order of Precedence for Rules ................................................................................4-7
Setting LAN WAN Rules ................. ... .... ... ....................................... ... ... ... ... .... ... ..... 4-7
LAN WAN Outbound Services Rules .................................................................4-9
LAN WAN Inbound Services Rules ...................................................................4-9
Setting DMZ WAN Rules .................................... .... ... .............................................4-10
Setting LAN DMZ Rules .........................................................................................4-12
viii Contents
v1.0, November 2007
Page 9
LAN DMZ Outbound Services Rules ...............................................................4-13
LAN DMZ Inbound Services Rules ..................................................................4-13
Inbound Rules Examples .......................................................................................4-14
LAN WAN Inbound Rule: Hosting A Local Public Web Server ........................4-14
LAN WAN Inbound Rule: Allowing Videoconference from Restricted Addresses 4-14
LAN WAN or DMZ WAN Inbound Rule: Setting Up One-to-One NAT Mapping 4-15
LAN WAN or DMZ WAN Inbound Rule: Specifying an Exposed Host .............4-17
Outbound Rules Example ......................................................... ... .... ... ... ... ... ..........4-18
LAN WAN Outbound Rule: Blocking Instant Messenger .................................4-18
Implementing DoS and DDoS ................................................................................4-19
Imposing Session Limits ........................................................................................4-21
Setting Up P2P Software Prevention ..................................................................... 4-22
Adding Customized Services .................................................................................4-24
Setting a Schedule to Block or Allow Specific Traffic .................................... ... .............4-26
Setting Block Sites (Content Filtering) ................ .................................................... ......4-27
Enabling IP/MAC Binding .............................................................................................4-29
Setting Up Port Triggering (in NAT mode) ....................................................................4-31
E-Mail Notifications of Event Logs and Alerts ......................................... ......................4-34
Administrator Tips .........................................................................................................4-38
Chapter 5
Router and Network Management
Performance Management ................................................................. .... ... ... ..................5-1
Bandwidth Capacity .................................................. ... ... .... ... ... ...............................5-1
Quad WAN Gigabit Firewall Features That Reduce Traffic ......................................5-2
Service Blocking ........................................................... ... ... ... .... ... ... ... ...............5-2
Block Sites .........................................................................................................5-4
IP/MAC Binding .................................................................................................5-5
Quad WAN Gigabit Firewall Features That Increase Traffic ....................................5-5
Port Forwarding ..................................................................... .... ... ... ... ...............5-5
Port Triggering .......................................................... .... ... ... ... .... ........................5-6
DMZ Port ...........................................................................................................5-7
Using QoS to Shift the Traffic Mix ............................................................................5-7
Tools for Traffic Management ....... ... ... .... ... ....................................... ... ... ... ... .... ... ..... 5-8
Administration ..................................... ............................................. ...............................5-8
Changing Passwords and Settings ..........................................................................5-8
Contents ix
v1.0, November 2007
Page 10
Enabling Remote Management Access .................................................................5-10
Using a SNMP Manager ........................................................................................5-11
Enabling UPnP (Universal Plug and Play) .............................................................5-13
Settings Backup and Firmware Upgrade ...............................................................5-14
Backup and Restore Settings ..........................................................................5-14
Router Upgrade ...............................................................................................5-15
Setting the Time Zone ........ ... .... ... ... ....................................... ... ... .... ... ... ... ... .... ... ...5-17
Monitoring the Router ......................................................................... .... ... ... ... .............5-18
Enabling the Traffic Meter ......................................................................................5-18
Setting Login Failures and Attacks Notification ................................ ...................... 5-20
Monitoring Attached Devices .................... .............................................................5-21
Viewing Port Triggering Status ...............................................................................5-23
Viewing Router Configuration and System Status .................................................5-24
Monitoring WAN Ports Status ....................... .......................................... ................5-25
DHCP Log ..............................................................................................................5-26
Configuring QoS (Quality of Service) .....................................................................5-27
Maximum Bandwidth for WAN Ports ......................................................................5-32
Performing Diagnostics ...... ... .... ... ... ... .... ................................................................5-33
Chapter 6
Troubleshooting
Basic Functions ..............................................................................................................6-1
Power LED Not On ...................................................................................................6-1
LEDs Never Turn Off ................................................................................................6-2
LAN or Internet Port LEDs Not On ......... ...................................... .... ... ... ... ... .... ... ... ..6-2
Troubleshooting the Web Configuration Interface ..........................................................6-2
Troubleshooting the ISP Connection ..............................................................................6-4
Troubleshooting a TCP/IP Network Using a Ping Utility .................................................6-5
Testing the LAN Path to Your Firewall ......................................................................6-5
Testing the Path from Your PC to a Remote Device ................................................6-6
Restoring the Default Configuration and Password ............... .........................................6-7
Problems with Date and Time .........................................................................................6-7
x Contents
v1.0, November 2007
Page 11
Appendix A
Default Settings and Technical Specifications
Appendix B
Command Line Interface Guide
Common ........................................................................................................................ B-2
System ................................... ................ ................ ................ ................. ................ ....... B-3
Firewall .......................................................................................................................... B-3
Network Configuration ................................................................................................... B-7
Diagnostic/Monitor ................................. ................................................. ..................... B-12
Appendix C
Related Documents
Appendix D
Network Planning for Quad WAN Ports
What You Will Need to Do Before You Begin ................................................................ D-1
Cabling and Computer Hardware Requirements ....................................................D-3
Computer Network Configuration Requirements ................... ... ... .... ... ... ... ... .... ... ... . D-3
Internet Configuration Requirements ...................................................................... D-4
Where Do I Get the Internet Configuration Parameters? ........................................D-4
Internet Connection Information Form ....................................................................D-5
Overview of the Planning Process ................................................................................. D-6
Inbound Traffic ........................................................................................................ D-6
The Roll-over Case for Firewalls With Quad WAN Ports ........................................ D-6
The Load Balancing Case for Firewalls With Quad WAN Ports .............................. D-7
Inbound Traffic ...............................................................................................................D-7
Inbound Traffic to Single WAN Port (Reference Case) ........................................... D-7
Inbound Traffic to Quad WAN Port Systems ............................. ..............................D-8
Inbound Traffic: Quad WAN Ports for Improved Reliability ...............................D-8
Inbound Traffic: Quad WAN Ports for Load Balancing .....................................D-9
Index
Contents xi
v1.0, November 2007
Page 12
xii Contents
v1.0, November 2007
Page 13
About This Manual
The NETGEAR® ProSafe™ Quad WAN Gigabit Firewall describes how to install, configure and
troubleshoot the ProSafe Quad WAN Gigabit Firewall. The information in this manual is intended
for readers with intermediate computer and Internet skills.
Conventions, Formats and Scope
The conventions, formats, and scope of this manual are described in the following paragraphs.
• Typographical Conventions. This manual uses the following typographical conventions:
Italics Emphasis, books, CDs, file and server names, extensions
Bold User input, IP addresses, GUI screen text
Fixed Command prompt, CLI text, code
italics URL links
• Formats. This manual uses the following formats to highlight special messages:
Note: This format is used to highlight information of importance or special interest.
Tip: This format is used to highlight a procedure that will save time or resources.
Warning: Ignoring this type of note may result in a malfunction or damage to the
equipment.
v1.0, November 2007
xiii
Page 14
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Danger: This is a safety warning. Failure to take heed of this notice may result in
personal injury or death.
• Scope. This manual is written for the quad WAN gigabit firewall according to the following
specifications:
Product Version ProSafe Quad WAN Gigabit Firewall
Manual Publication Date November 2007
For more information about network, Internet, firewall, and VPN technologies, see the links to the
NETGEAR website in Appendix C, “Related Documents.”
Note: Updates to this product are available on the NETGEAR, Inc. website at
http://kbserver.netgear.com/products/FR538G.asp.
How to Use This Manual
The HTML version of this manual includes the following:
• B uttons, and , for browsing forward or backward through the manual one page
at a time.
• A button that displays the table of contents and a button that displays the Index.
Double-click on a link in the table of contents or index to navigate directly to where the topic
is described in the manual.
• A button to access the full NETGEAR, Inc. online knowledge base for the product
model.
• Links to PDF versions of the full manual and individual chapters.
How to Print this Manual
To print this manual you can choose one of the following options, according to your needs.
• Printing a Page from HTML. Each page in the HTML version of the manual is dedicated to
a major topic. Select File > Print from the browser menu to print the page contents.
xiv
v1.0, November 2007
Page 15
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• Printing from PDF. Your computer must have the free Adobe Acrobat reader installed in
order to view and print PDF files. The Acrobat reader is available on the Adobe Web site at
http://www.adobe.com.
– Printing a PDF Chapter. Use the PDF of This Chapter link at the top left of any page.
• Click the PDF of This Chapter link at the top left of any page in the chapter you want
to print. The PDF version of the chapter you were viewing opens in a browser
window.
• Click the print icon in the upper left of your browser window.
– Printing a PDF version of the Complete Manual. Use the Complete PDF Manual link
at the top left of any page.
• Click the Complete PDF Manual link at the top left of any page in the manual. The
PDF version of the complete manual opens in a browser window.
• Click the print icon in the upper left of your browser window.
Tip: If your printer supports printing two pages on a single sheet of paper, you can
save paper and printer ink by selecting this feature.
Revision History
202
Part Number
202-10289-01 1.0 Oct. 2007 Product introduction.
Version
Number
Date Description
v1.0, November 2007
xv
Page 16
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
xvi
v1.0, November 2007
Page 17
Chapter 1
Introduction
The ProSafe Quad WAN Gigabit Firewall with four 10/100/1000 port connects your local area
network (LAN) to the Internet through an external access device such as a cable modem or DSL
modem.
The FR538G is a complete security solution that protects your network from attacks and
intrusions. For example, the FR538G provides support for Stateful Packet Inspection, Denial of
Service (DoS) attack protection and multi-NAT support. The quad WAN gigabit firewall supports
multiple Web content filtering options, plus browsing activity reporting and instant alerts—both
via e-mail. Network administrators can establish restricted access policies based on time-of-day,
Website addresses and addres s keywords.
The FR538G is a plug-and-play device that can be installed and configured within minutes.
Key Features
The quad WAN gigabit firewall provides the following features:
• Four 10/100/1000 Mbps Ethernet WAN ports for load balancing or failover protection,
providing increased system reliability, load balancing, or link aggregation. The W AN ports do
not respond to some unsolicited traffic (for example, ping).
• Quality of Service (QoS) support for traffic prioritization, voice, and multimedia.
• One console port for local management.
• SNMP Manageable, optimized for the NETGEAR ProSafe Networ k Management Software
(NMS100).
• Easy, web-based setup for installation and management.
• Advanced SPI Firewall and Multi-NAT support.
• Extensive Protocol Support.
• Login capability.
• Front panel LEDs for easy monitoring of status and activity.
• Flash memory for firmware upgrade.
• One U Rack mountable.
Introduction 1-1
v1.0, November 2007
Page 18
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Quad WAN Ports for Increased Reliability or Outbound Load Balancing
The FR538G has four broadband WAN ports (WAN1, WAN2, WAN3 and WAN4) capable of
operating independently at speeds of 10 MBps, 100 Mbps or 1G. The four WAN ports let you
connect a second broadband Internet line that can be configured on a mutually-exclusive basis to:
• Provide backup and rollover if one line is inoperable, ensuring you are never disconnected.
• L oad balance, or use four Internet lines simultaneously for the outgoing traffic. The firewall
balances users between the four lines for maximum bandwidth efficiency.
See “Network Planning for Quad WAN Ports” on page D-1 for the planning factors to consider
when implementing the following capabilities with quad WAN port gateways:
• Single or multiple exposed hosts
A Powerful, True Firewall with Content Filtering
Unlike simple Internet sharing NAT routers, the FR538G is a true firewall, using stateful packet
inspection to defend against hacker attacks. Its firewall features include:
• DoS protection. Automatically detects and thwarts DoS attacks such as Ping of Death, SYN
Flood, LAND Attack, and IP Spoofing.
• Secure Fi rewall. Blocks unwanted traffic from the Internet to your LAN.
• Block Sites. Blocks access from your LAN to Internet locations or services that you specify as
off-limits.
• Logs security incidents. The FR538G will log security events such as blocked incoming
traffic, port scans, attacks, and administrator logins. You can configure the firewall to email
the log to you at specified intervals. You can also configure the firewall to send immediate
alert messages to your email address or email pager whenever a significant event occurs.
• Keyword Filtering. With its URL keyword filtering feature, the FR538G prevents
objectionable content from reaching your PCs. The firewall allows you to control access to
Internet content by screening for keywords within Web addresses. You can configure the
firewall to log and report attempts to access objectionable Internet sites.
Security Features
The quad WAN gigabit firewall is equipped with several features designed to maintain security, as
described in this section.
1-2 Introduction
v1.0, November 2007
Page 19
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• PCs Hidden by NAT. NAT opens a temporary path to the Internet for requests originating
from the local network. Requests originating from outside the LAN are discarded, preventing
users outside the LAN from finding and directly accessing the PCs on the LAN.
• Port Forwarding with NAT. Although NAT prevents Internet locations from directly
accessing the PCs on the LAN, the firewall allows you to direct incoming traffic to specific
PCs based on the service port number of the incoming request. You can specify forwarding of
single ports or ranges of ports.
• DMZ port. Incoming traffic from the Internet is normally discarded by the firewall unless the
traffic is a response to one of your local computers or a service for which you have configured
an inbound rule. Instead of discarding this traffic, you can have it forwarded to one computer
on your network.
Autosensing Ethernet Connections with Auto Uplink
With its internal 4-port 10/100/1000 switch, the FR538G can connect to a 10 Mbps standard
Ethernet network, or either a 100 Mbps or 1G Fast Ethernet network. Both the LAN and WAN
interfaces are autosensing and capable of full-duplex or half-duplex operation.
The firewall incorporates Auto Uplink
whether the Ethernet cable plugged into the port should have a ‘normal’ connection such as to a
PC or an “uplink” connection such as to a switch or hub. That port will then configure itself to the
correct configuration. This feature also eliminates the need to worry about crossover cables, as
Auto Uplink will accommodate either type of cable to make the right connection.
TM
technology. Each Ethernet port will automatically sense
Extensive Protocol Support
The quad WAN gigabit firewall supports the Transmission Control Protocol/Internet Protocol
(TCP/IP) and Routing Information Protocol
to “Internet Configuration Requirements” in Appendix D.”
• IP Address Sharing by NAT. The quad WAN gigabit firewall allows several networked PCs
to share an Internet account using only a single IP address, which may be statically or
dynamically assigned by your Internet service provider (ISP). This technique, know n as NAT,
allows the use of an inexpensive single-user ISP account.
• Automatic Configuration of Attached PCs by DHCP. The quad WAN giga bit firewall
dynamically assigns network configuration information, including IP, gateway, and domain
name server (DNS) addresses, to attached PCs on the LAN using the Dynamic Host
Configuration Protocol (DHCP). This feature greatly simplifies configuration of PCs on your
local network.
Introduction 1-3
(RIP). For further information about TCP/IP, refer
v1.0, November 2007
Page 20
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• DNS Proxy. When DHCP is enabled and no DNS addresses are specified, the firewall
provides its own address as a DNS server to the attached PCs. The firewall obtains actual DNS
addresses from the ISP during connection setup and forwards DNS requests from the LAN.
• PPP over Ethernet (PPPoE). PPPoE is a protocol for connecting remote hosts to the Internet
over a DSL connection by simulating a dial-up connection. This feature eliminates the need to
run a login program such as EnterNet or WinPOET on your PC.
Easy Installation and Management
You can install, configure, and operate the ProSafe Quad WAN Gigabit Firewall within minutes
after connecting it to the network. The following features simplify installation and management
tasks:
• Browser-Based Management. Browser-based configuration allows you to easily configure
your firewall from almost any type of personal computer, such as Windows, Macintosh, or
Linux. A user-friendly Setup Wizard is provided and online help documentation is built into
the browser-based Web Management Interface.
• Auto Detect. The quad WAN gigabit firewall automatically senses the type of Internet
connection, asking you only for the information required for your type of ISP account.
• SNMP. The quad WAN gigabit firewall supports the Simple Network Management Protocol
(SNMP) to let you monitor and manage log resources from an SNMP-compliant system
manager. The SNMP system configuration lets you change the system variables for MIB2.
• Diagnostic Functions. The firewall incorporates built-in diagnostic functions such as Ping,
Trace Route, DNS lookup, and remote reboot.
• Remote Management. The firewall allows you to login to the Web Management Interface
from a remote location on the Internet. For security, you can limit remote management access
to a specified remote IP address or range of addresses, and you can choose a nonstandard port
number.
• Visual monitoring. The quad WAN gigabit firewall’s front panel LEDs provide an easy way
to monitor its status and activity.
Maintenance and Support
NETGEAR offers the following features to help you maximize your use of the quad W AN gigabit
firewall:
• Flash memory for firmware upgrade
1-4 Introduction
v1.0, November 2007
Page 21
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• Free technical support seven days a week, 24 hours a day, according to the terms identified in
the Warranty and Support information card provided with your product.
Package Contents
The product package should contain the following items:
• ProSafe Quad WAN Gigabit Firewall.
• AC power cable.
• 19-inch rack mounting hardware and rubber feet.
• Category 5 (Cat5) Ethernet cable.
• Installation Guide, FR538G ProSafe Quad WAN Gigabit Firewall
• Resource CD, including:
– Reference Manual
• Warranty and Support Information Card.
If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep the
carton, including the original packing materials, in case you need to return the firewall for repair.
Router Front Panel
The ProSafe Quad WAN Gigabit Firewall front panel shown below contains the port connections,
status LEDs, and the factory defaults reset button.
1
Figure 1-1
Table 1-1 describes each item on the front panel and its operation.
Introduction 1-5
2
3
v1.0, November 2007
4
5
6
Page 22
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Table 1-1. Object Descriptions
Object Activity Description
1. Power
LED
2. Test LED
3. WAN
Ports
and
LEDs
4. LAN
Ports
and
LEDs
5. Console
Port
6. Factory
Defaults
On (Green)
Off
On (Amber)
Blinking (Amber)
Off
Four RJ-45 WAN
ports
Link/Act LED
On (Green)
Blinking (Green)
Off
Active LED
On (Green)
On (Amber)
Off
4-port RJ-45 10/100/
1000 Mbps Fast
Ethernet Switch
LAN LED
Green (On)
Amber (On)
Amber (Off) and
Green (Blinking or
Solid)
Off
DMZ (port 4)
On (Green)
Off
DB9 male connector Port for connecting to an optional console terminal. Default baud rate
Push in with a sharp
object
Power is supplied to the firewall.
Power is not supplied to the firewall.
Test mode: The system is initializing or the initialization has failed.
Writing to Flash memory (during upgrading or resetting to defaults).
The system has booted successfully.
N-way automatic speed negotiation, Auto MDI/MDIX.
The WAN port has detected a link with a connected Ethernet device.
Data is being transmitted or received by the WAN port.
The WAN port has no link.
The WAN port has a valid Internet connection.
The Internet connection is down or not being used because the port
is available for failover in case the connection on other WAN port
fails.
The WAN port is either not enabled or has no link.
N-way automatic speed negotiation, auto MDI/MDIX.
The LAN port is communicating at 1G.
The LAN port is communicating at 100M.
The LAN port is communicating at 10M.
The LAN port has no link.
Port 4 is operating as a dedicated hardware DMZ port
Port 4 is operating as a normal LAN port.
is 115.2K; pinouts: (2) Tx, (3) Rx, (5) and (7) Gnd.
Factory Defaults reset push button (see Appendix A, “Default
Settings and Technical Specifications” for the factory defaults).
1-6 Introduction
v1.0, November 2007
Page 23
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Router Rear Panel
The rear panel of the ProSafe Quad WAN Gigabit Firewall (Figure 1-2) contains the On/Off switch
and AC power connection.
1
Figure 1-2
Viewed from left to right, the rear panel contains the following elements:
1. Fan vent
2. AC power in
3. On/Off switch
2
3
Rack Mounting Hardware
The FR538G can be mounted either on a desktop (using included rubber feet) or in a 19-inch rack
(using the included rack mounting hardware illustrated in Figure 1-3).
Figure 1-3
Introduction 1-7
v1.0, November 2007
Page 24
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
The Router’s IP Address, Login Name, and Password
Check the label on the bottom of the FR538G’s enclosure if you forget the following factory
default information:
• IP Address:
•User name:
• Password:
LAN IP Address
User Name
Password
Figure 1-4
http://192.168.1.1 to reach the Web-based GUI from the LAN
admin
password
Default Log In Settings
To log in to the FR538G once it is connected:
1. Open a We b browser.
2. Enter
1-8 Introduction
http://192.168.1.1 as the URL.
Figure 1-5
v1.0, November 2007
Page 25
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
3. Once the login screen displays (Figure 1-5), enter the following information:
•
admin for User Name
•
password for Password
Introduction 1-9
v1.0, November 2007
Page 26
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
1-10 Introduction
v1.0, November 2007
Page 27
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Introduction 1-11
v1.0, November 2007
Page 28
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
1-12 Introduction
v1.0, November 2007
Page 29
Chapter 2
Connecting the FR538G
You can connect your router to the Internet directly, or set up one or more of the WAN ports in
Bridge Mode. In Bridge Mode, your router acts as a transparent bridge for connecting two network
segments. Connection your router in Bridge Mode is covered in Section “Connecting Your Router
in Transparent Bridge Mode” on page 2-7.”
Logging into the Quad WAN gigabit Firewall
To connect to the firewall, your computer needs to be configured to obtain an IP address
automatically via DHCP. If you need instructions on how to configure you computer for DHCP,
refer to the link in Appendix C, “Related Documents.
To log in to the quad WAN gigabit firewall:
1. Connect to the firewall by typing http://192.168.1.1 in the address field of Internet Explorer,
Mozilla Firefox or Netscape® Navigator.
2. When prompted, enter admin for the firewall user name and password for the firewall
password, both in lower case letters. (The firewall user name and password are not the same as
any user name or password you may use to log in to your Internet connection.)
3. Click Login.
Note: You might want to enable remote management at this time so that you can log
in remotely in the future to manage the firewall (see “Enabling Remote
Management Access” on page 5-9). If you enable remote management, you are
strongly advised to change your password (see “Changing Passwords and
Settings” on page 5-8).
Connecting Your Router to the Internet
Typically, six steps are required to complete the basic connection of your router to the Internet.
Connecting the FR538G 2-1
v1.0, November 2007
Page 30
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
1. Connect the firewall physically to your network. Connect the cables, turn on your router
and wait for the Test LED to go out. Make sure your Ethernet and LAN LEDs are lit. (See the
Installation Guide, FR538G ProSafe Quad WAN Gigabit Firewall for complete steps. A PDF
of the Installation Guide is on your Resource CD and on the NETGEAR website at:
http://kbserver.netgear.com.)
2. Log in to the firewall. After logging in, you are ready to set up and configure your firewall.
You can also change your password and enable remote management at this time.
3. Configure the Internet connections to your ISP(s). During this phase, you will connect to
your ISPs. You can also program the WAN traffic meters at this time if desired.
4. Configure the WAN mode (required for quad WAN operation). Select either auto-rollover
mode or load balancing mode (on a mutually exclusive basis). For load balancing, you can
also select the protocol bindings.
5. Configure dynamic DNS on the WAN ports (if needed). Configure your fully qualified
domain names during this phase (if required).
6. Configure the WAN options (if needed). Optionally, you can enable each WAN port to
respond to a ping. You can also change the factory default MTU size, port speed, and uplink
bandwidth. However, these are advanced features and changing them is not usually required.
Configuring the WAN Port Internet Connections
You should first configure your Internet connections to your ISPs on WAN port 1, and then
configure WAN 2, WAN 3 and WAN 4.
To automatically configure the WAN ports and connect to the Internet:
1. The WAN1 Settings screen similar to the one shown in Figure 2-1 should display when you
log in. (If the screen does not display , select the primary menu option Network Configuration
and the sub-menu option WAN Settings.
2-2 Connecting the FR538G
v1.0, November 2007
Page 31
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 2-1
2. Click Auto Detect at the bottom of the screen to automatically detect the type of Internet
connection provided by your ISP. Auto Detect will probe for different connection methods and
suggest one that your ISP will most likely support.
When Auto Detect successfully detects an active Internet service, it reports which connection
type it discovered. The options are described in the following table
Table 2-1. Internet connection methods
Connection Method Data Required
PPPoE Login (Username, Password); Account Name, Domain Name
Connecting the FR538G 2-3
v1.0, November 2007
Page 32
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Table 2-1. Internet connection methods (continued)
Connection Method Data Required
PPTP Login (Username, Password), Account Name, Local IP address, and
PPTP Server IP address;
BigPond Cable Login Username, Password), Login Server.
DHCP (Dynamic IP) No data is required.
Fixed (Static) IP Static IP address, Subnet, and Gateway IP; and related data supplied by
your ISP.
If Auto Detect does not find a connection, you will be prompted to check the physical
connection between your firewall and the cable or DSL line or to check your Router’s MAC
address (see “Setting the Router’s MAC Address” on page 2-5).
3. Click WAN Status at the top right of the screen to verify WAN Port 1 connection status. Click
Connect if connection not already present.
Figure 2-2
4. Set up the traffic meter for WAN1 Settings, if desired. See “Programming the Traffic Meter (if
Desired)” on page 2-9.
Note: At this point of the configuration process, you are now connected to the
Internet through WAN port 1. But you must continue with the configuration
process to get the complete functionality of the quad WAN interface.
2-4 Connecting the FR538G
v1.0, November 2007
Page 33
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
The configure WAN2 Settings, WAN3 Settings and WAN4 Settings:
1. Repeat the above steps to set up the parameters for WAN2, WAN3 and WAN4. Start by
selecting the WAN2 Settings tab. Next click Auto Detect on the WAN2 Settings screen and
then confirm the connection by clicking the WAN Status link.
2. Set up the traffic meter for the WAN2 port, if desired. See “Programming the Traffic Meter (if
Desired)” on page 2-9.
3. Repeat the process to connect additional ports to the Internet.
Setting the Router’s MAC Address
Each computer or router on your network has a unique 48-bit local Ethernet address. This is also
referred to as the computer's MAC (Media Access Control) address. The default is set to Use
Default Address. If your ISP requires MAC authentication and another MAC address has been
previously registered with your ISP, then you must enter that address. Setting the router’s MAC
address is controlled through the Advanced options on the WAN1 ISP Settings, WAN2 ISP
Settings, WAN3 ISP Settings and WAN4 ISP Settings screen (see“Configuring the Advanced
WAN Options (If Needed)” on page 2-20).
Manually Configuring Your Internet Connection
If you know your ISP connection type, you can bypass the Auto Detect feature and connect your
router manually. Ensure that you have all of the relevant connection information such as IP
Addresses, account information, type of ISP connection, etc., before you begin. Unless your ISP
automatically assigns your configuration automatically via DHCP, you will need the configuration
parameters from your ISP (see Figure 2-1).
Note: To enable a WAN port to respond to a Ping from the Internet, use the Rules menu
(Figure 4-14 on page 4-20).
To manually configure your WAN1 ISP Settings:
1. Does your Internet connection require a login? If you need to enter login information every
time you connect to the Internet through your ISP, select Yes. Otherwise, select No.
2. What type of IPS connection do you use? If your connection is PPPoE, PPTP or BigPond
Cable, then you must login. Check the Yes radio box. The text box fields that require data
entry will be highlighted, based on the connection that you selected. If your ISP has not
assigned any login information, then choose the No radio box and skip this section. For
example:
Connecting the FR538G 2-5
v1.0, November 2007
Page 34
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• Austria (PPTP): If your ISP is Austria T elecom or any other ISP that uses PPTP for login,
select this. Then, fill in the following highlighted fields:
– Account Name (also known as Host Name or System Name): Enter the valid account
name for the PP TP connection (usually your email “ID” assigned by your ISP). Some
ISPs require entering your full email address here.
– Domain Name: Your domain name or workgroup name assigned by your ISP, or your
ISPs domain name. You may leave this field blank.
– Idle Timeout: Check the Keep Connected radio box to keep the connection always
on. To logout after the connection is idle for a period of time, select Idle Time and
enter the number of minutes to wait before disconnecting in the timeout field. This is
useful if your ISP charges you based on the amount of time you have logged in.
– My IP Address: IP address assigned by the ISP to make the connection with the ISP
server.
– Server IP Address: IP address of the PPTP server.
• Other (PPPoE): If you have installed login software such as WinPoET or Enternet, then
your connection type is PPPoE. Select this connection and configure the following fields:
– Account Name: Valid account name for the PPPoE connection
– Domain Name: Name of your ISPs domain or your domain name if your ISP has
assigned one. You may leave this field blank.
– Idle Timeout: Select Keep Connected, to keep the connection always on. To logout
after the connection is idle for a period of time, select Idle Time and enter the number
of minutes to wait before disconnecting, in the timeout field.
• BigPond Cable : If your ISP is Telstra BigPond Cable, select this option and fill in the
Login Server and Idle Timeout fields. The Login Server is the IP address of the local
BigPond Login Server in your area. You can find login server information at
http://www.netgear.com.sg/support/bigpond.asp
3. If your ISP has assigned a fixed (static or permanent) IP address, select the Use Static IP
Address radio box and fill in the following fields:
a. IP Address: Static IP address assigned to you. This will identify the router to your ISP.
b. Subnet Mask: This is usually provided by the ISP or your network administrator.
c. Gateway IP Address: IP address of the ISP’s gateway. This is usually provided by the ISP
or your network administrator.
2-6 Connecting the FR538G
v1.0, November 2007
Page 35
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
If your ISP has not assigned a Static IP address, select the Get dynamically from ISP radio
box. The ISP will automatically assign an IP address to the router using DHCP network
protocol.
4. If your ISP has not assigned any Domain Name Servers (DNS) addresses, select the Get
dynamically from ISP radio box. If your ISP has assigned DNS addresses, select the Use
these DNS Servers radio box. Ensure that you fill in valid DNS server IP addresses in the
fields. Incorrect DNS entries may cause connectivity issues.
Note: Domain Name Servers (DNS) convert Internet names such as
www.google.com, www.netgear.com, etc. to Internet addresses called IP
addresses. Incorrect settings here will result in connectivity problems.
5. Click Apply to save the settings.
6. Click Reset to discard any changes and revert to the previous settings.
7. Click Test to try and connect to the NETGEAR W eb site. If you connect successfully and your
settings work, then you may click Logout or go on and configure additional settings.
To configure your WAN2 ISP, WAN3 ISP and WAN4 ISP settings:
1. Select the WAN ISP Settings tab to configure each WAN ISP port. The WAN ISP screen for
the port you selected will display.
2. Repeat steps 1 through 7 above to set each WAN ISP (WAN2 ISP, WAN3 ISP and WAN 4
ISP).
Connecting Your Router in Transparent Bridge Mode
The FR538G supports Transparent Bridge mode for connecting two network segments. It is
disabled by default. You do not need to change the attached network server settings, only
configure the appropriate router settings to those of your network server.
To configure a WAN port in Bridge Mode:
1. Select Network Configuration > WAN Settings. The WAN1 Settings screen will display.
2. Selection the WAN Settings tab you want to configure in Bridge Mode (in this example, we
have selected WAN1 Settings).
3. In the Bridge Mode Section, click the Enable radio box. Then, scroll down and click Reset.
The Internet (IP) Address section and Domain Name Server (DNS) Servers section become
selectable.
Connecting the FR538G 2-7
v1.0, November 2007
Page 36
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
4. Check the Use Static IP Address radio box in the Internet (IP) Address Section and fill in the
following fields:
a. IP Address: Enter the WAN IP address of the network server.
b. Subnet Mask: Enter the Subnet Mask of the server.
c. Gateway IP Address: Enter the default Gateway Address of the network server.
5. Check the Use These DNS Servers radio box in the Domain Name Server (DNS) Servers
section and enter a Primary DNS Server in the fields provided. (As an option, you may also
enter a Secondary DNS Server.)
6. Click Apply.
Figure 2-3
Enter the internal LAN IP range for the Bridge Mode on the Network Configuration > WAN
Settings screen (see “Connecting Your Router in Transparent Bridge Mode” on page 2-7).
2-8 Connecting the FR538G
v1.0, November 2007
Page 37
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Programming the Traffic Meter (if Desired)
The traffic meter is useful when an ISP charges by traffic volume ov er a given period of time or if
you want to look at traffic types over a period of time.
To enable the traffic meter:
1. From the primary menu, select Monitoring, and then select T raffic Meter from the secondary
menu. The WAN1 Traffic Meter screen will display. Fill out the information described in
Table 2-2.
Figure 2-4
2. Click Apply to apply the settings. Click Reset to return to the previous settings.
Connecting the FR538G 2-9
v1.0, November 2007
Page 38
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
3. Select the WAN2 Traffic Meter tab, WAN3 Traffic Meter tab, and WAN4 T raffic Meter tab
and repeat steps 1 through 3 to set the Traffic Meter for all the WAN ports.
Table 2-2. Traffic Meter Settings
Parameter Description
Enable Traffic Meter Check this if you wish to record the volume of Internet traffic passing through the
Router's WAN1, WAN2, WAN 3 or WAN4 port. WAN1, WAN2, WAN3 or WAN4 can
be selected by clicking the appropriate tab; the entire configuration is specific to each
WAN interface.
• No Limit – If this is selected specified restriction will not be applied when traffic limit
is reached.
• Download only – If this is selected the specified restriction will be applied to the
incoming traffic only
• Both Directions – If this is selected the specified restriction will be applied to both
incoming and outgoing traffic only
Enable Monthly Limit Use this if your ISP charges for addition al traffic. If enabled, enter the monthly
volume limit and select the desired behavior when the limit is reached.
Note: Both incoming and outgoing traffic are included in the limit.
Increase this
month's limit
This month's limit This displays the limit for the current month.
Restart traffic
counter
Restart Counter at a
Specific Time
Send E-mail Report
before restarting
counter
When limit is
reached
Use this to temporarily increase the Traffic Limit if you have reached the monthly
limit, but need to continue accessing the Internet. Check the checkbox and enter the
desired increase. (The checkbox will automatically be cleared when saved so the
increase is only applied once.)
This determines when the traffic counter restarts. Choose the desired time and day of
the month.
Check this radio button to restart the Traffic Counter at a specific time and day of the
month. Fill in the time fields and select AM or PM and the day of the month from the
pull-down menus.
If checked, an E-mail report will be sent immediately before restarting the counter.
You must configure the E-mail screen in order for this function to work (see “E-Mail
Notifications of Event Logs and Alerts” on page 4-34).
Select the desired option:
• Block all traffic - all access to and from the Internet will be blocked.
• Block all traffic except E-mail - Only E-mail traffic will be allowed. All other traffic will
be blocked.
• If using this option, you may also select the Send E-mail ale r t option. You must
configure the E-mail screen in order for this function to work.
2-10 Connecting the FR538G
v1.0, November 2007
Page 39
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Table 2-2. Traffic Meter Settings
Parameter Description
Internet Traffic
Statistics
Traffic by Protocol Click this link if you want to know more details of the Internet Traffic. The volume of
This displays statistics on Internet Traffic via the WAN port. If you have not enabled
the Traffic Meter, these statistics are not available.
traffic for each protocol will be displayed in a sub-window.Traffic counters are
updated in MBytes scale, counter starts only when traffic passed is at least 1MB.
Configuring the WAN Mode (Required for Quad WAN)
The quad WAN ports of the ProSafe Quad WAN Gigabit Firewall can be configured on a mutually
exclusive basis for either auto-rollover (for increased system reliability) or load balancing (for
maximum bandwidth efficiency).
• Auto-Rollover Mode. In this mode, the selected WAN interface is made primary and the other
is the rollover link. As long as the primary link is up, all traffic is sent over the primary link.
Once the primary WAN interface goes down, the rollover link is brought up to send the
traffic.Traffic will automatically roll back to the original primary link once the original
primary link is back up and running again.
If you want to use a redundant ISP link for backup purposes, select the WAN port that will act
as the primary link for this mode. Ensure that the backup WAN port has also been configured
and that you configure the WAN Failure Detection Method to support Auto-Rollover.
• Load Balancing Mode. In this mode the router distributes the outbound traffic equally among
the WAN interfaces that are functional.
Note: Scenarios could arise when load balancing needs to be bypassed for certain
traffic or applications. Here the traffic needs to go on a specific WAN
interface. This is done with the protocol binding rules of that WAN interface.
The rule should match the desired traffic.
For both alternatives, you must also set up Network Address Translation (NAT):
• NAT. NAT is the technology which allows all PCs on your LAN to share a single Internet IP
address. From the Internet, there is only a single device (the Router) and a single IP address.
PCs on your LAN can use any private IP address range, and these IP addresses are not visible
from the Internet.
Connecting the FR538G 2-11
v1.0, November 2007
Page 40
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
– The Router uses NAT to select the correct PC (on your LAN) to receive any incoming
data.
– If you only have a single Internet IP address, you MUST use NAT.
NAT is the default setting.
• Classical Routing. In this mode, the Router performs Routing, but without NAT. To gain
Internet access, each PC on your LAN must have a valid Internet IP address.
If your ISP has allocated many IP addresses to you, and you have assigned one of these
addresses to each PC, you can choose Classical Routing. Or, you can use Classical Routing for
routing private IP addresses within a campus environment. Otherwise, selecting this method
will not allow Internet access through this Router.
To learn the status of the WAN ports, you can view the Router Status page (see “Viewing Router
Configuration and System Status” on page 5-23) or look at the LEDs on the front panel (see
“Router Front Panel” on page 1-5).
Setting Up Auto-Rollover Mode
If you want to use a redundant ISP link for backup purposes, ensure that the backup WAN port has
already been configured. Then you select the WAN port that will act as the primary link for this
mode and configure the WAN Failure Detection Method to support Auto-Rollover.
When the router is configured in Auto-Rollover Mode, the router uses the WAN Failure
Detection Method to check the connection of the primary link at regular intervals to detect router
status. Link failure is detected in one of the following ways:
• By using DNS queries to a DNS server, or
• By a Ping to an IP address.
For each WAN interface, DNS queries or Ping requests are sent to the specified IP address. If
replies are not received, the corresponding WAN interface is considered down.
To configure the quad WAN ports for Auto-Rollover
1. Select Network Configuration from the primary menu and WAN Mode from the secondary
menu. The WAN Mode screen will display.
2. In the Port Mode section, check the Auto-Rollover Using WAN port radio box.
3. Selection the WAN port that will act as the primary link for this mode from the pull-down
menu.
4. From the WAN Failure detection Method section, select the detection failure method radio
box from one of the following choices:
2-12 Connecting the FR538G
v1.0, November 2007
Page 41
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• DNS lookup using configured DNS Servers (ISP DNS Servers) – In this case, DNS
queries are sent to the DNS server configured on the WAN ISP pages (see “Configuring
the WAN Port Internet Connections” on page 2-2).
• DNS lookup using this DNS Server (for example, a public DNS Server) – Enter any
public DNS server. DNS queries are sent to this server through the WAN interface being
monitored.
• Ping to this IP address – Enter a public IP address that will not reject the Ping request or
will not consider the traffic abuse. Queries are sent to this server through the WAN
interface being monitored.
5. Enter a Test Period in seconds. DNS query is sent periodically after every test period. The
default test period is 30 seconds.
Figure 2-5
6. Enter the Maximum Failover amount. The WAN interface is considered down after the
configured number of queries have failed to elicit a reply. The rollover link is brought up after
this. The Failover default is 4 failures.
The default time to roll over after the primary WAN interface fails is 2 minutes (a 30-second
minimum test period, times a minimum of 4 tests).
7. Click Apply to save your settings.
8. Click Reset to revert to the previous settings.
Connecting the FR538G 2-13
v1.0, November 2007
Page 42
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Once a rollover occurs, an alert will be generated (see “E-Mail Notifications of Event Logs and
Alerts” on page 4-34). When notified that the failed WAN interface has been restored, you can
force traffic back on the original primary WAN interface by reapplying the Auto-Rollover settings
in the WAN Port Mode menu.
Setting Up Load Balancing
To use multiple ISP links simultaneously, select Load Balancing. In Load Balancing mode, both
links will carry data for the protocols that are bound to them. For example, if the HTTP protocol is
bound to WAN1 and the FTP protocol is bound to WAN2, then the router will automatically
channel FTP data from and to the computers on the LAN through the WAN2 port. All HTTP
traffic will be routed through the WAN1 port.
Load Balancing can be used to segregat e traf fic betwee n links that ar e not of the same speed. High
volume traffic can be routed through the port connected to a high speed link and low volume
traffic can be routed through the port connected to the low speed link.
To configure the quad WAN ports for load balancing with protocol binding:
1. Check the Load Balancing radio button on the WAN Mode screen shown in Figure 2-5 above,
and click view protocol bindings (if protocol binding is needed). The WAN1 Protocol
Bindings screen will display.
2-14 Connecting the FR538G
v1.0, November 2007
Page 43
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 2-6
2. Enter the following data in the Add Protocol Binding section:
a. Service – From the pull-down menu, select the desired Services or applications to be
covered by this rule. If the desired service or application does not appear in the list, you
must define it using the Services menu (see “Services-Based Rules” on page 4-2).
b. Destination Network – These settings determine which Internet locations are covered by
the rule, based on their IP address. Select the desired option:
• Any – All Internet IP address are covered by this rule.
• Single address – Enter the required address in the start fields.
• Address range – If this option is selected, you must enter the start and finish fields.
c. Source Network – These settings determine which computers on your network are
affected by this rule. Select the desired options:
• Any – All PCs and devices on your LAN.
• Single address – Enter the required address and the rule will be applied to that
particular PC.
Connecting the FR538G 2-15
v1.0, November 2007
Page 44
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• Address range – If this option is selected, you must enter the start and finish fields.
• Group 1-Group 8 – If this option is selected, the devices assigned to this group will
be affected. (You may also assign a customized name to the group. See Edit Group
Names on the Groups and Hosts menu in the LAN Groups sub-menu.)
3. Click Add in the Add column adjacent to the rule. The new Protocol Binding Rule will be
enabled and added to the Protocol Binding Table for the WAN1 port.
Select the WAN2 Protocol Bindings tab, WAN3 Protocol Bindings tab, and WAN4 Protocol
Bindings tab, and then repeat steps 1 through 9, to set protocol bindings for all of the WAN
ports.
To Edit or Add additional Protocol Binding settings:
1. Select Network Configuration from the main menu and Protocol Binding from the
submenu. The WAN1 Protocol Bindings screen will display.
You can add or edit protocol bindings to either the WAN1 port or click the WAN2 Protocol
Bindings tab, WAN3 Protocol Bindings tab or WAN4 Protocol Bindings tab to access the
Protocol Bindings screen for each WAN port. To add a new protocol binding, following the
preceding procedure.
2. Check the radio button adjacent to the protocol binding rule you want to modify. Click Edit in
the Action column adjacent to the rule. The Edit Protocol Binding screen will display.
3. Modify the parameters for the protocol binding service you selected.
4. Click Apply. The modified rule will be enabled and appear in the Protocol Binding table.
5. Click Reset to return to the previously configured settings.
2-16 Connecting the FR538G
v1.0, November 2007
Page 45
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 2-7
Configuring Dynamic DNS (If Needed)
Dynamic DNS (DDNS) is an Internet service that allows routers with varying public IP addresses
to be located using Internet domain names. To use DDNS, you must setup an account with a
DDNS provider such as DynDNS.org, TZO.com or Iego.net. (Links to DynDNS, TZO and Iego
are provided for your convenience on the Dynamic DNS Configuration screen.) The quad WAN
gigabit firewall firmware includes software that notifies dynamic DNS servers of changes in the
WAN IP address, so that the services running on this network can be accessed by others on the
Internet.
If your network has a permanently assigned IP address, you can register a domain name and have
that name linked with your IP address by public Domain Name Servers (DNS). However, if your
Internet account uses a dynamically assigned IP address, you will not know in advance what your
Connecting the FR538G 2-17
v1.0, November 2007
Page 46
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
IP address will be, and the address can change frequently—hence, the need for a commercial
DDNS service, which allows you to register an extension to its domain, and restores DNS requests
for the resulting FQDN to your frequently-changing IP address.
After you have configured your account information in the firewall, whenever your ISP-assigned
IP address changes, your firewall will automatically contact your DDNS service provider, log in to
your account, and register your new IP address.
• For auto-rollover mode, you will need a fully qualified domain name (FQDN) to implement
features such as exposed hosts and virtual private networks regardless of whether you have a
fixed or dynamic IP address.
• For load balancing mode, you may still need a fully qualified domain name (FQDN) either for
convenience or if you have a dynamic IP address.
Note: If your ISP assigns a private WAN IP address such as 192.168.x.x or 10.x.x.x, the
dynamic DNS service will not work because private addresses will not be routed
on the Internet.
To configure Dynamic DNS:
1. Select Network Configuration from the primary menu and Dynamic DNS from the submenu. The Dynamic DNS Configuration screen will display.
The WAN Mode section displays the currently configured WAN mode (for example, Single
Port WAN1, Load Balancing or Auto Rollover). Only those options that match the configured
WAN Mode will be accessible.
2. Check the Dynamic DNS Service radio box you want to enable. The fields corresponding to
the selection you have chosen will be highlighted. Each DNS service provider requires its own
parameters.
3. Access the Web site of one of the DDNS service providers and set up an account. A link to
each DDNS provider is opposite the DNS Configuration screen name.
2-18 Connecting the FR538G
v1.0, November 2007
Page 47
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
DDNS
links
Figure 2-8
4. After setting up your account, return to the Dynamic DNS Configuration screen and fill in
the required fields for the DDNS service you selected:
a. In the Host and Domain Name field, enter the entire FQDN name that your dynamic DNS
service provider gave you (for example: <yourname>.dyndns.org).
Connecting the FR538G 2-19
v1.0, November 2007
Page 48
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
b. Enter the User Name, User email Address, or Account Name requested by the DDNS
Service to identify you when logging into your DDNS account.
c. Enter the Password, or User Key, for your DDNS account.
d. If your dynamic DNS provider allows the use of wild cards in resolving your URL, you
may check the Use wildcards radio box to activate this feature.
For example, the wildcard feature will cause *.yourhost.dyndns.org to be aliased
to the same IP address as yourhost.dyndns.org
5. Click Apply to save your configuration.
6. Click Reset to return to the previous settings.
Configuring the Advanced WAN Options (If Needed)
To configure the Advanced WAN options:
1. If you haven’t already, log in to the firewall at the default LAN address of http://192.168.1.1,
default user name of admin, and default password of password (or whatever password and
LAN address you have chosen for the firewall).
2. Select Network Configuration > WAN Settings from the main menu. The WAN Settings
screen will display. Click Advanced to access the WAN1 Advanced Options screen.
.
Figure 2-9
2-20 Connecting the FR538G
v1.0, November 2007
Page 49
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
3. Edit the default information you want to change.
• MTU Size – The normal MTU (Maximum Transmit Unit) value for most Ethernet
networks is 1500 Bytes, or 1492 Bytes for PPPoE connections. For some ISPs you may
have to reduce the MTU. But this is rarely required, and should not be done unless you are
sure it is necessary for your ISP connection.
• Port Speed – In most cases, your router can automatically determine the connection speed
of the Internet (WAN) port. Most new devices with Ethernet ports run at full-duplex,
100Mbps modes. The router can automatically negotiate the speed with the other end of
the Ethernet connection. AutoSense is the default. However, if the Internet LED blinks
continuously, you may need to set the port speed manually. This could occur with some
older broadband modems.
If you know that the Ethernet port on your broadband modem supports 100BaseT, select
100M; otherwise, select 10M. Use the half-duplex settings unless you are sure you need
full duplex.
• Router's MAC Address – Each computer or router on your network has a unique 48-bit
local Ethernet address. This is also referred to as the computer's MAC (Media Access
Control) address. The default is Use default address. However, if your ISP requires MAC
authentication, then select either
– Use this Computer's MAC address to have the router use the MAC address of the
computer you are now using, or
– Use This MAC Address to manually type in the MAC address that your ISP expects.
The format for the MAC address is XX:XX:XX:XX:XX:XX (numbers 0-9 and either
uppercase or lowercase letters A-F). If you select Use This MAC Address and then type
in a MAC address, your entry will be overwritten.
Connecting the FR538G 2-21
v1.0, November 2007
Page 50
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
2-22 Connecting the FR538G
v1.0, November 2007
Page 51
Chapter 3
LAN Configuration
This chapter describes how to configure the advanced LAN features of your ProSafe Quad WAN
Gigabit Firewall. These features can be found by selecting Network Configuration from the
primary menu and LAN Setup from the submenu of the browser interface.
Using the Firewall as a DHCP server
By default, the firewall will function as a DHCP (Dynamic Host Configuration Protocol) server,
allowing it to assign IP, DNS server, WINS Server, and default gateway addresses to all computers
connected to the firewall LAN. The assigned default gateway address is the LAN address of the
firewall. IP addresses will be assigned to the attached PCs from a pool of addresses specified in
this menu. Each pool address is tested before it is assigned to avoid duplicate addresses on the
LAN.
For most applications, the default DHCP and TCP/IP settings of the firewall are satisfactory. See
the link to “Preparing a Computer for Network Access” in Appendix C, “Related Documents” for
an explanation of DHCP and information about how to assign IP addresses for your network.
If another device on your network will be the DHCP server, or if you will manually configure the
network settings of all of your computers, clear the Enable DHCP server radio box by selecting
the Disable DHCP Server radio box. Otherwise, leave it checked.
Specify the pool of IP addresses to be assigned by setting the Starting IP Address and Ending IP
Address. These addresses should be part of the same IP address subnet as the firewall’s LAN IP
address. Using the default addressing scheme, you should define a range between 192.168.1.2 and
192.168.1.100, although you may wish to save part of the range for device s with fixed addresses.
The firewall will deliver the following parameters to any LAN device that requests DHCP:
• An IP Address from the range you have defined.
• Subnet Mask.
• Gateway IP Address (the firewall’s LAN IP address).
• Primary DNS Server (the firewall’s LAN IP address).
• WINS Server (if you entered a WINS server address in the DHCP Setup menu).
• L ease Time (date obtained and duration of lease).
LAN Configuration 3-1
v1.0, November 2007
Page 52
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Configuring the LAN Setup Options
The LAN IP Setup menu allows configuration of LAN IP services such as DHCP and allows you
to configure a secondary or “multi-home” LAN IP setup in the LAN. The default values are
suitable for most users and situations. These are advanced settings most usually configured by a
network administrator.
To modify your LAN setup:
1. Select Network Configuration from the primary menu and LAN Setup from the submenu.
The LAN Setup screen will display.
Figure 3-1
2. Enter the IP Address of your router (factory default: 192.168.1.1). (Always make sure that the
LAN Port IP address and DMZ port IP address are in different subnets.)
3. Enter the IP Subnet Mask. The subnet mask specifies the network number portion of an IP
address. Your router will automatically calculate the subnet mask based on the IP address that
you assign. Unless you are implementing subnetting, use 255.255.255.0 as the subnet mask
(computed by the router).
3-2 LAN Configuration
v1.0, November 2007
Page 53
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
4. Check the Enable DHCP Server radio button. By default, the router will function as a DHCP
(Dynamic Host Configuration Protocol) server, providing TCP/IP configuration for all
computers connected to the router's LAN. If another device on your network will be the DHCP
server, or if you will manually configure all devices, check the Disable DHCP Server radio
button. Enable DHCP Server is the default. If Enabled is selected, enter the following
parameters:
a. Enter the Domain Name of the router (this is optional).
b. Enter the Starting IP Addr ess. This address specifies the first of the contiguous addresses
in the IP address pool. Any new DHCP client joining the LAN will be assigned an IP
address between this address and the Ending IP Address. The IP address 192.168.1.2 is the
default start address.
c. Enter the Ending IP Address. This address specifies the last of the contiguous addresses
in the IP address pool. Any new DHCP client joining the LAN will be assigned an IP
address between the Starting IP address and this IP address. The IP address 192.168.1.100
is the default ending address.
Note: The Starting and Ending DHCP addresses should be in the same “network”
as the LAN TCP/IP address of the router (the IP Address in LAN TCP/IP
Setup section).
d. Enter a WINS Server IP address. This box can specify the Windows NetBios Server IP if
one is present in your network. This field is optional.
e. Enter a Lease Time. This specifies the duration for which IP addresses will be leased to
clients.
f. Check the Enable DNS Proxy radio box. This is optional—the default is enabled. If
enabled, the quad WAN gigabit firewall will provide a LAN IP Address for DNS address
name resolution.
Note: If you change the LAN IP address of the firewall while connected through the
browser, you will be disconnected. You must then open a new connection to
the new IP address and log in again. For example, if you change the default IP
address 192.168.1.1 to 10.0.0.1, you must enter http://10.0.0.1 in your browser
to reconnect to the web management interface.
5. Click Apply to save your settings.
LAN Configuration 3-3
v1.0, November 2007
Page 54
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
6. Click Reset to discard any changes and revert to the previous configuration.
Note: Once you have completed the LAN IP setup, all outbound traffic is allowed
and all inbound traffic is discarded. To change these traffic rules, refer to
Chapter 4, “Firewall Protection and Content Filtering.
Configuring Multi Home LAN IPs
If you have computers on your LAN using different IP address ranges (for example, 172.16.2.0 or
10.0.0.0), then you can add “aliases” to the LAN port thereby giving computers on those networks
access to the Internet. This allows the firewall to act as a gateway to additional logical subnets on
your LAN. You can assign the firewall an IP address on each additional logical subnet
•The Av ailable Secondary LAN IPs table lists the secondary LAN IP addresses added to the
router.
•The IP Address is the “alias” added to the LAN port of the router . This will be the gateway for
computers that need to access the Internet.
•The Subnet Mask is the IPv4 Subnet Mask.
To add a secondary LAN IP address:
1. Enter the IP Address and the Subnet Mask in the respective fields of the Add Secondary LAN
IP Address section.
2. Click Add. The new Secondary LAN IP address will appear in the Availa ble Secondary LAN
IPs table.
3. Click Select all to select all the entries in the Available Secondary LAN IPs table. All the
radio buttons are selected.
4. Click Delete to delete only those entries with checked radio buttons from the Available
Secondary LAN IPs table.
3-4 LAN Configuration
v1.0, November 2007
Page 55
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
.
Figure 3-2
Note: Additional IP addresses cannot be configured in the DHCP server. The hosts on
the secondary subnets must be manually configured with IP addresses,
gateway IP and DNS server IPs.
To make changes to the selected entry:
1. Click Edit in the Action column adjacent to the selected entry. The Edit Secondary LAN IP
Setup screen will display.
2. Modify the IP Address and Subnet Mask fields and click Apply.
LAN Configuration 3-5
v1.0, November 2007
Page 56
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
3. Click Reset to discard any changes and revert to the previous settings.
Tip: The Secondary LAN IP address will be assigned to the LAN interface of the
router and can be used as a gateway by the secondary subnet.
Configuring Port Mirror
Port Mirror is a mechanism for enhancing the security on local area networks by configuring one
port to monitor the other ports. Any network activities on the LAN are then tracked and recorded
when the Port Mirror feature is enabled. The default setting for this option is disabled.
To enable Port Mirroring:
1. Select Network Configuration > LAN Setup from the main menu, and then click the Port
Mirror tab. The Port Mirror screen will display.
2. Select the Yes radio box to enable Port Mirror.
3. Select the LAN radio box for the port you want to enable as the mirror port.
4. Check Egress, Ingress or both checkboxes to specify incoming and outgoing mo nitoring of
the ports to be monitored. Check the desired Ingress (traffic coming in) and/or Egress (traffic
going out) checkboxes of the ports for which traffic is to be monitored.
Note: The corresponding Egress port must be selected to the Ingress port is selected;
for example, if Ingress port 2 is selected, then Egress port 2 must be selected as
well.
5. Click Apply to save your settings.
3-6 LAN Configuration
v1.0, November 2007
Page 57
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 3-3
Port Management
Port Management allows you to manage specific features for each LAN port:
• The QoS priority for each port (either high or normal).
• Set the Mbps speed for each LAN port and whether it is to operate at full-duplex or halfduplex. If the LAN port speed is disabled (the default), then auto-negotiation is selected by
default.
• Select one of four VLAN groups for each LAN port. Stations on the same VLAN group can
communicate with each other. Broadcast and multicast frames are constrained by VLAN
boundaries, so only stations whose ports are members of the same VLAN can see those
frames.
To enable Port Management:
1. Select Network Configuration > LAN Setup from the main menu, and then click the Port
Management tab. The Port Management screen will display.
2. Select the checkbox for each port to be enabled. It is s per-port setting.
3. Check the Normal or High radio box for each port to specify port-based QoS.
4. Check the Enable radio box and select the speed and duplex from the pull-down menus for
each port (the per-port speed is 10Mbps, 100Mbps or 1000 Mbps; and the per-port duplex is
half-duplex or full-duplex).
5. Select the VLAN ID from each LAN pull-down menu. (Four VLANs are supported; only
stations on the same VLAN group can communicate with each other.)
6. Click Apply to save your settings.
LAN Configuration 3-7
v1.0, November 2007
Page 58
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 3-4
Managing Groups and Hosts (LAN Groups)
The Known PCs and Devices table on the Groups and Hosts screen contains a list of all known
PCs and network devices, as well as hosts, that are assigned dynamic IP addresses by this router.
Collectively, these entries make up the Network Database. The Network Database is created in two
ways:
• DHCP Client Requests. By default, the DHCP server in this Router is enabled, and will
accept and respond to DHCP client requests from PCs and other network devices. These
requests also generate an entry in the Network Database. Because of this, leaving the DHCP
Server feature (on the LAN screen) enabled is strongly recommended.
3-8 LAN Configuration
v1.0, November 2007
Page 59
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• Scanning the Network. The local network is scanned using standard methods such as ARP.
This will detect active devices which are not DHCP clients. However, sometimes the name of
the PC or device cannot be accurately determined, and will be shown as Unknown.
Creating the Network Database
Some advantages of the Network Database are:
• Generally, you do not need to enter either IP address or MAC addresses. Instead, you can just
select the desired PC or device.
• No need to reserve an IP address for a PC in the DHCP Server. All IP address assignments
made by the DHCP Server will be maintained until the PC or device is removed from the
database, either by expiry (inactive for a long time) or by you.
• No need to use a Fixed IP on PCs. Because the address allocated by the DHCP Server will
never change, you don't need to assign a fixed IP to a PC to ensure it always has the same IP
address.
• MAC level control over PCs. The Network Database uses the MAC address to identify each
PC or device. So changing a PC’s IP address does not affect any restrictions on that PC.
• Group and individual control over PCs.
– You can assign PCs to Groups and apply restrictions to each Group using the Firewall
Rules screen (see “Using Rules to Block or Allow Specific Kinds of Traffic” on page 4-1).
– You can also select the Groups to be covered by the Block Sites feature (see “Setting
Block Sites (Content Filtering)” on page 4-27).
– If necessary, you can also create Firewall Rules to apply to a single PC (see “Enabling IP/
MAC Binding” on page 4-29). Because the MAC address is used to identify each PC,
users cannot avoid these restrictions by changing their IP address.
• A computer is identified by its MAC address—not its IP address. Hence, changing a
computer’s IP address does not affect any restrictions applied to that PC.
This Known PCs and Devices table lists entries in the Network Database. For each computer or
device, the following fields are displayed:
• Name: The name of the PC or device. For computers that do not support the NetBIOS
protocol, this will be listed as “Unknown” (you can edit the entry manually to add a
meaningful name). If the computer was assigned an IP address by the DHCP server, then the
Name will be appended by an asterisk.
LAN Configuration 3-9
v1.0, November 2007
Page 60
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• IP Address: The current IP address of the computer. For DHCP clients of the router, this IP
address will not change. If a computer is assigned a static IP addresses, you will need to update
this entry manually if the IP address on the computer has been changed.
• MAC Address: The MAC address of the PC’s network interface.
• Group: Each PC or device can be assigned to a single group. By default, a computer is
assigned to Group 1, unless a different group is selected from the Group pull-down menu .
• Action: Allows modification of the selected entry by clicking Edit.
To add computers to the network database manually:
1. Select Network Configuration from the main menu and LAN Groups from the submenu.
The Groups and Hosts screen will display.
2. In the Add Known PCs and Devices table, enter the name of the PC or device.
3. From the IP Address Type pull-down menu, select Reserve d (DHCP Client) to direct the
router to reserve the IP address for allocation by the DHCP server, or select Fixed (Set on PC)
if the IP address is statically assigned on the computer.
Note: When assigning a Reserved IP address to a client, the IP address selected must
be outside the range of addresses allocated to the DHCP Server pool.
4. Enter the IP Address that this computer or device is assigned in the IP Address field. If the IP
Address Type is Reserved (DHCP Client), the router will reserve the IP address for the
associated MAC address.
5. Enter the MAC Address of the computer’s network interface in the MAC Address field. The
MAC address should be in the form: xx:xx:xx:xx:xx:xx (for example: 00:80:48:2a:8b:c0 that
contain numbers 0-9 and letters a-f).
6. From the Group pull-down menu, enter the Group to which the computer will be assigned.
(Group 1 is the default group.)
3-10 LAN Configuration
v1.0, November 2007
Page 61
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
7. Click Add. The device will be added to the Known PCs and Devices table.
Figure 3-5
To edit the information of any of the Known PCs or Devices:
1. Click Edit in the Action column opposite the name of the device. The Edit Groups and Hosts
screen will display.
2. Modify any of the fields on this screen.
3. Click Reset to cancel your settings and return to the previous settings.
4. Click Apply to save your new settings. The modified record will appear in the Know PCs and
Devices table.
To edit the name s of any of the eight available groups:
1. Click Edit Group Names at the upper right of the Groups and Hosts screen. The Network
Database Group Names screen will display.
2. Check the radio button opposite the Group Name you want to change and type a suitable name
in the field.
3. Click Reset to discard any changes and revert to the previous settings.
LAN Configuration 3-11
v1.0, November 2007
Page 62
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
4. Click Apply to save the settings.
Figure 3-6
Setting Up Address Reservation
When you specify a reserved IP address for a device on the LAN (based on the MAC address of
the device), that computer or device will always receive the same IP address each time it accesses
the firewall’s DHCP server. Reserved IP addresses should be assigned to servers or access points
that require permanent IP settings. The Reserved IP address that you select must be outside of the
DHCP Server pool.
To res erve an IP address, use the Groups and Hosts screen under the Network Configuration
menu, LAN Groups submenu (see “Creating the Network Database” on page 3-9).
Note: The reserved address will not be assigned until the next time the PC contacts the
firewall's DHCP server. Reboot the PC or access its IP configuration and force a
DHCP release and renew.
Configuring and Enabling the DMZ Port
The De-Militarized Zone (DMZ) is a network which, when compared to the LAN, has fewer
firewall restrictions, by default. This zone can be used to host servers (such as a web server, ftp
3-12 LAN Configuration
v1.0, November 2007
Page 63
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
server, or email server, for example) and give public access to them. The fourth LAN port on the
router can be dedicated as a hardware DMZ port for safely providing services to the Internet,
without compromising security on your LAN.
The DMZ port feature is also helpful when using some online games and videoconferencing
applications that are incompatible with NAT. The firewall is programmed to recognize some of
these applications and to work properly with them, but there are other applications that may not
function well. In some cases, local PCs can run the application properly if those PCs are used on
the DMZ port.
Note: A separate firewall security profile is provided for the DMZ port that is
independent of the standard firewall security used for the LAN.
The DMZ Setup screen allows you to set up the DMZ port. It permits you to enable or disable the
hardware DMZ port (LAN port 4, see “Router Front Panel” on page 1-5) and configure an IP
address and Mask for the DMZ port.
To enable and configure the DMZ port:
1. From the main menu, select Network Configuration > DMZ Setup from the main menu. The
DMZ Setup screen will display.
2. Check the Do you want to enable DMA Port? radio box.
3. Enter an IP Address and the Subnet mask for the DMZ port. Make sure that the DMZ port IP
address and LAN Port IP address are in different subnets (for example, an address outside the
LAN Address pool, such as 192.168.1.101).
LAN Configuration 3-13
v1.0, November 2007
Page 64
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 3-7
4. If desired, Enable the DHCP Server (Dynamic Host Configuration Protocol), which will
provide TCP/IP configuration for all computers connected to the router’s DMZ network. Then
configure the following items:
a. Starting IP Address – This box specifies the first of the contiguous addresses in the IP
address pool.
b. Ending IP Address – This box specifies the last of the contiguous addresses in the IP
address pool.
c. WINS Server – This box specifies the Windows Internet Naming Service Server IP.
d. Lease Time – This box specifies the Lease time to be given to the DHCP Clients.
e. Enable DNS Proxy – If enabled, the quad W AN gigabit firewall will as a DNS for address
resolution.
5. Click Reset to cancel changes made on this screen and revert to the previous settings.
6. Click Apply to save your settings. The DMZ LED next to LAN port 4 (see “Router Front
Panel” on page 1-5) will light up indicating that the DMZ port has been enabled.
If another device on your DMZ network will be the DHCP server, or if you will manually
configure all devices, leave the Disable option (default) checked.
3-14 LAN Configuration
v1.0, November 2007
Page 65
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
To define the DMZ WAN Rules and LAN DMZ Rules, see “Setting DMZ WAN Rules” on
page 4-10 and “Setting LAN DMZ Rules” on page 4-12, respectively.
Static Routes
Static Routes provide additional routing information to your firewall. Under normal
circumstances, the firewall has adequate routing information after it has been configured for
Internet access, and you do not need to configure additional static routes. You should configure
static routes only for unusual cases such as multiple firewalls or multiple IP subnets located on
your network.
Configuring Static Routes
To add or edit a static route:
1. Select Network Configuration > Routing from the main menu. The Routing screen will
display.
2. Click Add. The Add Static Route menu, shown below, will display.
3. Enter a route name for this static route in the Route Name field (for identification and
management).
LAN Configuration 3-15
v1.0, November 2007
Page 66
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 3-8
4. Select Active to make this route effective.
5. Select Private if you want to limit access to the LAN only. The static route will not be
advertised in RIP.
6. Enter the Destination IP Address to the host or network to which the route leads.
7. Enter the IP Subnet Mask for this destination. If the destination is a single host, enter
255.255.255.255.
8. Enter the Interface which is the physical network interface (WAN1, WAN2, WAN3, WAN4 or
LAN) through which this route is accessible.
9. Enter the Gateway IP Address through which the destination host or network can be reached
(must be a firewall on the same LAN segment as the firewall).
10. Enter the Metric priority for this route. If multiple routes to the same destination exit, the route
with the lowest metric is chosen. (value must be between 1 and 15),
11. Click Reset to discard any changes and revert to the previous settings.
12. Click Apply to save your settings. The new static route will be added to Route table.
You can edit the route’s settings by clicking Edit in the Action column adjacent to the route.
3-16 LAN Configuration
v1.0, November 2007
Page 67
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Routing Information Protocol (RIP)
RIP (Routing Information Protocol, RFC 2453) is an Interior Gateway Protocol (IGP) that is
commonly used in internal networks (LANs). It allows a router to exchange its routing information
automatically with other routers, and allows it to dynamically adjust its routing tables and adapt to
changes in the network. RIP is disabled by default.
To configure RIP parameters:
1. Select Network Configuration > Routing from the main menu. When the Routing screen
displays, click the RIP Configuration link. The RIP Configuration screen will display.
2. From the RIP Direction pull-down menu, select the direction in which the router will send
and receives RIP packets. The choices are:
• None – The router neither broadcasts its route table nor does it accept any RIP packets
from other routers. This effectively disables RIP.
• Both – The router broadcasts its routing table and also processes RIP information received
from other routers.
• Out Only – The router broadcasts its routing table periodically but does not accept RIP
information from other routers.
• In Only – The router accepts RIP information from other routers, but does not broadcast
its routing table.
LAN Configuration 3-17
v1.0, November 2007
Page 68
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 3-9
3. From the RIP Version pull-down menu, select the version:
• RIP-1 – A classful routing that does not include subnet information. This is the most
commonly supported version.
• RIP-2 – Supports subnet information. Both RIP-2B and RIP-2M send the routing data in
RIP-2 format:
• RIP-2B Se nds the routing data in RIP-2 format and uses subnet broadcasting.
• RIP-2M Sends the routing data in RIP-2 format and uses multicasting.
4. Authentication for RIP2B/2M required? If you selected RIP-2B or RIP-2M, check the YES
radio box to enable the feature, and input the First Key Parameters and Second Key
Parameters MD-5 keys to authenticate between routers.
5. Click Reset to discard any changes and revert to the previous settings.
6. Click Save to save your settings.
3-18 LAN Configuration
v1.0, November 2007
Page 69
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Static Route Example
For example, you may require a static route if:
• Your primary Internet access is through a cable modem to an ISP.
• You have an ISDN firewall on your home network for connecting to the company where you
are employed. This firewall’s address on your LAN is 192.168.1.100.
• Your company’s network is 134.177.0.0.
When you first configured your firewall, two implicit static routes were created. A default route
was created with your ISP as the gateway, and a second static route was created to your local
network for all 192.168.1.x addresses. With this configuration, if you attempt to access a device on
the 134.177.0.0 network, your firewall will forward your request to the ISP. The ISP forwards your
request to the company where you are employed, and the request will likely be denied by the
company’s firewall.
In this case you must define a static route, telling your firewall that 134.177.0.0 should be accessed
through the ISDN firewall at 192.168.1.100.
In this example:
• The Destination IP Address and IP Subnet Mask fields specify that this static route applies to
all 134.177.x.x addresses.
• The Gateway IP Address fields specifies that all traffic for these addresses should be
forwarded to the ISDN firewall at 192.168.1.100.
• A Metric value of 1 will work since the ISDN firewall is on the LAN.
• P rivate is selected only as a precautionary security measure in case RIP is activated.
Network Binding
Network Binding is a bulk provisioning tool that allows you to implement strategic routing for
LAN to WAN traffic. It allows a user to associate a large number of routing entries with a specific
WAN interface. While functionally similar to static routing, it has a higher priority than other
routing functions. Network Binding is disabled by default.
To enable Network Binding:
1. Select the Enable radio button for a WAN port (WAN1, WAN1, WAN3 and/or WAN4)
2. Click Apply to save your settings.
LAN Configuration 3-19
v1.0, November 2007
Page 70
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 3-10
As an option, you may also import a file by using the following symtax rules:
1. The file content must be a text file.
2. You must use the following syntax rules to compose your file:
network xxx.xxx.xxx.xxx mask yyy.yyy.yyy.yyy or
host zzz.zzz.zzz.zzz
where:
xxx.xxx.xxx.xxx is the IP address for a network subnet
yyy.yyy.yyy.yyy is the net mask
zzz.zzz.zzz.zzz is an IP address
3-20 LAN Configuration
v1.0, November 2007
Page 71
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
For example:
network 60.12.32.0 mask 255.255.240.0
network 60.12.48.0 mask 255.255.248.0
host 60.12.56.0
host 60.12.56.1
network 60.12.56.2 mask 255.255.255.254
network 60.12.56.4 mask 255.255.255.252
LAN Configuration 3-21
v1.0, November 2007
Page 72
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
3-22 LAN Configuration
v1.0, November 2007
Page 73
Chapter 4
Firewall Protection and Content Filtering
This chapter describes how to use the content filtering features of the ProSafe Quad WAN Gigabit
Firewall to protect your network. These features can be found by selecting Security from the main
menu and selecting Block Sites from the submenu of the browser interface.
About Firewall Protection and Content Filtering
The ProSafe Quad WAN Gigabit Firewall provides you with Web content filtering options, plus
browsing activity reporting and instant alerts via e-mail. Parents and network administrators can
establish restricted access policies based on time-of-day, Web addresses and Web address
keywords. You can also block Internet access by applications and services, such as chat or games.
A firewall is a special category of router that protects one network (the “trusted” network, such as
your LAN) from another (the untrusted network, such as the Internet), while allowing
communication between the two. You can further segment keyword blocking to certain known
groups (see “Configuring Port Mirror” on page 3-6 to set up LAN Groups).
A firewall incorporates the functions of a NAT (Network Address Translation) router, while
adding features for dealing with a hacker intrusion or attack, and for controlling the types of traffic
that can flow between the two networks. Unlike simple Internet sharing NAT routers, a firewall
uses a process called stateful packet inspection to protect your network from attacks and
intrusions. NAT performs a very limited stateful inspection in that it considers whether the
incoming packet is in response to an outgoing request, but true Stateful Packet Inspection goes far
beyond NAT.
Using Rules to Block or Allow Specific Kinds of Traffic
Firewall rules are used to block or allow specific traffic passing through from one side to the other.
Inbound rules (WAN to LAN) restrict access by outsiders to private resources, selectively allowing
only specific outside users to access specific resources. Outbound rules (LAN to WAN) determine
what outside resources local users can have access to.
Firewall Protection and Content Filtering 4-1
v1.0, November 2007
Page 74
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
A firewall has two default rules, one for inbound traffic and one for outbound. The default rules of
the FR538G are:
• Inbound: Block all access from outside except responses to requests from the LAN side.
• Outbound: Allow all access from the LAN side to the outside.
The firewall rules for blocking/allowing traffic on the quad WAN gigabit firewall can be applied to
LAN/WAN traffic, DMZ/WAN traffic and LAN/DMZ traffic.
Services-Based Rules
The rules to block traffic are based on the traffic’s c ategory of service.
• Outbound Rules (service blocking) – Outbound traffic is normally allowed unless the
firewall is configured to disallow it.
• Inbound Rules (port forwarding) – Inbound traffic is normally blocked by the firewall
unless the traffic is in response to a request from the LAN side. The firewall can be configured
to allow this otherwise blocked traffic.
• Customized Services – Additional services can be added to the list of services in the factory
default list. These added services can then have rules defined for them to either allow or block
that traffic (see “Adding Customized Services” on page 4-24.
• Quality of Service (QoS) priorities – Each service at its own native priority that impacts its
quality of performance and tolerance for jitter or delays. You can change this QoS priority if
desired to change the traffic mix through the system (see “Configuring QoS (Quality of
Service)” on page 5-26).
Outbound Rules (Service Blocking)
The FR538G allows you to block the use of certain Internet services by PCs on yo ur network. This
is called service blocking or port filtering.
Note: See “Enabling IP/MAC Binding” on page 4-29 for yet another way to block
outbound traffic from selected PCs that would otherwise be allowed by the
firewall.
4-2 Firewall Protection and Content Filtering
v1.0, November 2007
Page 75
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Ta ble 4-1. Outbound Rules
Item Description
Service Name Select the desired Service or application to be covered by this rule. If the desired
service or application does not appear in the list, you must define it using the
Services menu (see “Adding Customized Services” on page 4-24).
Action (Filter) Select the desired action for outgoing connections covered by this rule:
• BLOCK always
• BLOCK by schedule, otherwise Allow
• ALLOW always
• ALLOW by schedule, otherwise Block
Note: Any outbound traffic which is not blocked by rules you create will be allowed by
the Default rule.
ALLOW rules are only useful if the traffic is already covered by a BLOCK rule. That
is, you wish to allow a subset of traffic that is currently blocked by another rule.
Action (Select
Schedule)
LAN users These settings determine which computers on your network are affected by this rule.
WAN Users These settings determine which Internet locations are covered by the rule, based on
Select the desired time schedule (i.e., Schedule1, Schedule2, or Schedule3) that will
be used by this rule.
• This drop down menu gets activated only when “BLOCK by schedule, otherwise
Allow” or “ALLOW by schedule, otherwise Block” is selected as Action.
• Use schedule page to configure the time schedules (see “Setting a Schedule to
Block or Allow Specific Traffic” on page 4-26).
Select the desired options:
• Any – All PCs and devices on your LAN.
• Single address – Enter the required address and the rule will be applied to that
particular PC.
• Address range – If this option is selected, you must enter the start and finish fields.
• Groups – Select the Group to which this rule will apply. Use the LAN Groups screen
(under Network Configuration) to assign PCs to Groups. See “Configuring Port
Mirror” on page 3-6.
their IP address. Select the desired option:
• Any – All Internet IP address are covered by this rule.
• Single address – Enter the required address in the start field.
• Address range – If this option is selected, you must enter the start and end fields.
Firewall Protection and Content Filtering 4-3
v1.0, November 2007
Page 76
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Table 4-1. Outbound Rules (continued)
Item Description
DMZ Users These settings determine which DMZ computers on DMZ network are affected by
this rule. Select the desired options.
• Any – All PCs and devices on your DMZ network.
• Single address – Enter the required address and the rule will be applied to that
particular PC on the DMZ network.
• Address range – If this option is selected, you must enter the start and finish fields
of the DMZ computers.
Log This determines whether packets covered by this rule are logged. Select the desired
action:
• Always – always log traffic considered by this rule, whether it matches or not. This
is useful when debugging your rules.
• Never – never log traffic considered by this rule, whether it matches or not.
Inbound Rules (Port Forwarding)
Because the FR538G uses Network Address Translation (NAT), your network presents only one IP
address to the Internet and outside users cannot directly address any of your local computers.
However, by defining an inbound rule you can make a local server (for example, a Web server or
game server) visible and available to the Internet. The rule tells the firewall to direct inbound
traffic for a particular service to one local server based on the destination port number. This is al so
known as port forwarding.
Whether or not DHCP is enabled, how the PCs will access the server’s LAN address impacts the
Inbound Rules. For example:
• If your external IP address is assigned dynamically by your ISP (DHCP enabled), the IP
address may change periodically as the DHCP lease expires. Consider using Dyamic DNS
(under Network Configuration) so that external users can always find your network (see
“Configuring Dynamic DNS (If Needed)” on page 2-17.
• If the IP address of the local server PC is assigned by DHCP, it may change when the PC is
rebooted. To avoid this, you can implement one of the following methods:
– Use the Reserved IP address feature in the LAN Groups menu (under Network
Configuration) to keep the PC’s IP address constant (see “Setting Up Address
Reservation” on page 3-12.
– Click Refresh on the Security > IP/MAC Binding screen to obtain the current IP Address
from the Binding List table. You can then keep the PCs IP address constant and avoid
unauthorized PC Internet access through the firewall (see “Enabling IP/MAC Binding” on
page 4-29).
4-4 Firewall Protection and Content Filtering
v1.0, November 2007
Page 77
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• L ocal PCs must access the local server using the PCs’ local LAN address. Attempts by local
PCs to access the server using the external WAN IP address will fail.
Note: See “Setting Up Port Triggering (in NAT mode)” on page 4-31 for yet another
way to allow certain types of inbound traffic that would otherwise be blocked
by the firewall.
Ta ble 4-2. Inbound Rules
Item Description
Services Select the desired Service or application to be covered by this rule. If the desired
service or application does not appear in the list, you must define it using the
Services menu (see “Adding Customized Services” on page 4-24).
Action (Filter) Select the desired action for packets covered by this rule:
• BLOCK always
• BLOCK by schedule, otherwise Allow
• ALLOW always
• ALLOW by schedule, otherwise Block
Note: Any inbound traffic which is not allowed by rules you create will be blocked by
the Default rule.
Action (Select
Schedule)
LAN Server or DMZ
Server
Translate to Port
Number
DMZ Users Specifies whether one or more IP address on the DMZ network will be affected by the
Select the desired time schedule (i.e., Schedule1, Schedule2, or Schedule3) that will
be used by this rule (see “Setting a Schedule to Block or Allow Specific Traffic” on
page 4-26).
• This drop down menu gets activated only when “BLOCK by schedule, otherwise
Allow” or “ALLOW by schedule, otherwise Block” is selected as Action.
• Use schedule page to configure the time schedules.
This LAN address or DMZ Server address determines which computer on your
network is hosting this service rule. (You can also translate this address to a port
number.)
Check the “Translate to Port Number” and enter a port number if you want to assign
the LAN Server to a specific port.
rule. This field is only populated in routing mode since the DMZ network is accessible
only in this mode.
• Any – All computers on the DMZ network will be affected by the rule.
• Single address – A single IP address on the DMZ network will be affected by this
rule.
• Address range – If this option is selected, a range of IP addresses on the DMZ
network will be affected by this rule.
Firewall Protection and Content Filtering 4-5
v1.0, November 2007
Page 78
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Table 4-2. Inbound Rules (continued)
Item Description
WAN Users These settings determine which Internet locations are covered by the rule, based on
their IP addresses. Select the desired option:
• Any – All Internet IP address are covered by this rule.
• Single address – Enter the required address in the start field.
• Address range – If this option is selected, you must enter the start and end fields.
WAN Destination IP
Address
Log This determines whether packets covered by this rule are logged. Select the desired
This setting determines the destination IP address applicable to incoming traffic.
This is the public IP address that will map to the internal LAN server; it can either be
the address of the WAN1, WAN2, WAN 3 or WAN4 ports or another public IP
address
map traffic coming from a particular WAN port to a DMZ machine
action:
• Always – Always log traffic considered by this rule, whether it matches or not. This
• Never – Never log traffic considered by this rule, whether it matches or not.
. This field is only populated under NAT mode because the router needs to
is useful when debugging your rules.
Note: Some residential broadband ISP accounts do not allow you to run any server
processes (such as a Web or FTP server) from your location. Your ISP may
periodically check for servers and may suspend your account if it discovers any
active services at your location. If you are unsure, refer to the Acceptable Use
Policy of your ISP.
Remember that allowing inbound services opens holes in your quad WAN gigabit firewall. Only
enable those ports that are necessary for your network. It is also advisable to turn on the server
application security and invoke the user password or privilege levels, if provided.
4-6 Firewall Protection and Content Filtering
v1.0, November 2007
Page 79
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Order of Precedence for Rules
As you define new rules, they are added to the tables in the Rules menu as the last item in the list,
as shown in Figure 4-1:
Figure 4-1
For any traffic attempting to pass through the firewall, the packet information is subjected to the
rules in the order shown in the Rules Table, be ginning at the top and proceeding to the bottom. In
some cases, the order of precedence of two or more rules may be important in determining the
disposition of a packet. For example, you should place the most strict rules at the top (those with
the most specific services or addresses). The Up and Down button allows you to relocate a defined
rule to a new position in the table.
Setting LAN WAN Rules
The Default Outbound Policy is to allow all traffic to the Internet to pass through. Firewall rules
can then be applied to block specific types of traffic from going out from the LAN to the Internet
(Outbound). The default policy of Allow Always can be changed to block all outbound traffic
which then allows you to enable only specific services to pass through the router.
To change the Default Outbound Policy:
Firewall Protection and Content Filtering 4-7
v1.0, November 2007
Page 80
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
1. Select Security from the main menu and Firewall Rules from the submenu. The LAN WAN
Rules screen will display.
2. Change the Default Outbound Policy by selecting Block Always from the drop-down menu
and click Apply..
Figure 4-2
To make changes to an existing outbound or inbound service rule:
1. In the Action column adjacent to the rule click:
• Edit – to make any changes to the rule definition of an existing rule. The Outbound
Service screen will display containing the data for the selected rule (see Figure 4-3 on
page 4-9).
• Up – to move the rule up one position in the table rank.
• Down – to move the rule down one position in the table rank.
2. Check the radio box adjacent to the rule and click:
• Click Disable to disable the rule. The “!” Status icon will change from green to grey,
indicating that the rule is disabled. (By default, when a rule is added to the table it is
automatically enabled.)
• Click Delete to delete the rule.
3. Click Select All to select all rules. A check will appear in the radio box for each rule.
4-8 Firewall Protection and Content Filtering
v1.0, November 2007
Page 81
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
LAN WAN Outbound Services Rules
You may define rules that will specify exceptions to the default rules. By adding custom rules, you
can block or allow access based on the service or application, source or destination IP addresses,
and time of day. The outbound rule will block the selected application from any internal IP LAN
address to any external WAN IP address according to the schedule created in the Schedule menu.
You can also tailor these rules to your specific needs (see “Administrator Tips” on page 4-38).
Note: This feature is for Advanced Administrators only! Incorrect configuration will
cause serious problems.
To cre ate a new outbound service rule:
1. Click Add under the Outbound Services Table. The Add LAN WAN Outbound Service
screen will display.
..
Figure 4-3
2. Complete the Outbound Service screen, and save the data (see Tab l e 4-1 on pa ge 4-3).
3. Click Reset to cancel your settings and return to the previous settings.
4. Click Apply to save your changes and reset the fields on this screen. The new rule will be
listed on the Outbound Services table.
LAN WAN Inbound Services Rules
This Inbound Services Rules table lists all existing rules for inbound traffic. If you have not
defined any rules, no rules will be listed. By default, all inbound traffic is blocked. Remember that
Firewall Protection and Content Filtering 4-9
v1.0, November 2007
Page 82
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
allowing inbound services opens holes in your firewall. Only enable those ports that are necessary
for your network.
To cre ate a new inbound service rule:
1. Click Add under the Inbound Services Table. The Add LAN WAN Inbound Service screen
will display.
Figure 4-4
2. Complete the Add WAN LAN Inbound Services screen (see Table 4-2 on page 4-5).
3. Click Reset to cancel your settings and return to the previous settings.
4. Click Apply to save your changes and reset the fields on this screen. The new rule will be
listed on the Inbound Services table.
Setting DMZ WAN Rules
The firewall rules for traffic between the DMZ and the WAN/Internet are configured on the DMZ
WAN Rules screen. The Default Outbound Policy is to allow all traffic from and to the Internet to
pass through. Firewall rules can then be applied to block specific types of traffic from either going
out from the DMZ to the Internet (Outbound) or coming in from the Internet to the DMZ
4-10 Firewall Protection and Content Filtering
v1.0, November 2007
Page 83
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
(Inbound). The default outbound policy can be changed to block all outbound traffic and enable
only specific services to pass through the router by adding an Outbound services Rule.
Figure 4-5
To change the Default Outbound Policy:
1. Select Security from the main menu, Firewall Rules from the submenu and then select the
DMZ WAN Rules tab. The DMZ WAN Rules screen will display.
2. Click Add under the Outbound Services table. The Add DMZ WAN Outbound Services
screen will display.
3. Accept the default settings to block all services or select a specific service to block from the
Services pull-down menu.
4. Click Apply. The Block Always rule will appear in the Outbound Services table. The rule is
automatically enabled.
Firewall Protection and Content Filtering 4-11
v1.0, November 2007
Page 84
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
The procedures described in “Setting LAN WAN Rules” on page 4-7 for setting inbound and
outbound rules on the standard LAN firewall are the same as the procedures used for setting
inbound and outbound rules on the DMZ port firewall.
Setting LAN DMZ Rules
The LAN DMZ Rules screen allows you to create rules that define the movement of traffic
between the LAN and the DMZ. The Default Outbound and Inbound Policies is to allow all traffic
between the local LAN and DMZ network. Firewall rules can then be applied to block specific
types of traffic from either going out from the L AN to the DMZ (Outbound) or coming in from the
DMZ to the LAN (Inbound).
To access the LAN DMZ Rules screen:
1. Select Security on the main menu, then select Fir ewall Rules and click the LAN DMZ Rules
tab. The LAN DMZ Rules screen will display showing the both the Outbound Services and
Inbound Services tables.
Figure 4-6
To make changes to an existing outbound or inbound LAN DMZ service rule:
1. In the Action column adjacent to the rule click:
• Edit – to make any changes to the rule definition. The Outbound Service screen will
display containing the data for the selected rule “Outbound Rules (Service Blocking)” on
page 4-2).
• Up – to move the rule up one position in the table rank.
• Down – to move the rule down one position in the table rank.
2. Check the radio box adjacent to the rule and:
4-12 Firewall Protection and Content Filtering
v1.0, November 2007
Page 85
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
• Click Disable to disable the rule. The “!” Status icon will change from green to grey,
indicating that the rule is disabled. (By default, when a rule is added to the table it is
automatically enabled.)
• Click Delete to delete the rule.
3. Click Select All to select all rules. A check will appear in the radio box for each rule.
LAN DMZ Outbound Services Rules
To create a new outbound LAN DMZ service rule:
1. Click Add under the Outbound Services Table. The Add LAN DMZ Outbound Service
screen will display.
Figure 4-7
2. Complete the Outbound Service screen, and save the data (see “Outbound Rules (Service
Blocking)” on page 4-2).
3. Click Reset to cancel your settings and return to the previous settings.
4. Click Apply to save your changes and reset the fields on this screen. The new rule will be
listed on the Outbound Services table.
LAN DMZ Inbound Services Rules
To d efine an Inbound LAN DMZ Rule:
1. Click Add under the Inbound Services table. The Add LAN DMZ Inboun d Service screen
will display.
Firewall Protection and Content Filtering 4-13
v1.0, November 2007
Page 86
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
2. Complete the Inbound Service screen and save the data (see “Inbound Rules (Port
Forwarding)” on page 4-4).
3. Click Reset to cancel your settings and return to the previous settings.
4. Click Apply to save your settings. The new rule will be added to the Inboun d Services table.
Inbound Rules Examples
LAN WAN Inbound Rule: Hosting A Local Public Web Server
If you host a public W eb ser ver on your local network, you can define a rule to allow inbound Web
(HTTP) requests from any outside IP address to the IP address of your Web server at any time of
day. This rule is shown in Figure 4-8.
Figure 4-8
LAN WAN Inbound Rule: Allowing Videoconference from Restricted Addresses
If you want to allow incoming videoconferencing to be initiated from a restricted range of outside
IP addresses, such as from a branch office, you can create an inbound rule. In the example, CUSeeMe connections are allowed only from a specified range of external IP addresses.
4-14 Firewall Protection and Content Filtering
v1.0, November 2007
Page 87
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 4-9
LAN WAN or DMZ WAN Inbound Rule: Setting Up One-to-One NAT Mapping
In this example, we will configure multi-NAT to support multiple public IP addresses on one W AN
interface. By creating an inbound rule, we will configure the firewall to host an additional public
IP address and associate this address with a Web server on the LAN.
If you arrange with your ISP to have more than one public IP address for your use, you can use the
additional public IP addresses to map to servers on your LAN or DMZ. One of these public IP
addresses will be used as the primary IP address of the router. This address will be used to provide
Internet access to your LAN PCs through NAT. The other addresses are available to map to your
servers.
The following addressing scheme is used to illustrate this procedure:
• NETGEAR FR538G ProSafe Quad WAN Gigabit Firewall
– WAN1 IP address: 10.1.0.118
– LAN IP address subnet: 192.168.1.1; subnet 255.255.255.0
– DMZ IP address subnet: 192.168.10.1; subnet 255.255.255.0
• Web server PC on the firewall’s LAN
– LAN IP address: 192.168.1.2
– DMZ IP Address: 192.168.10.2
Firewall Protection and Content Filtering 4-15
v1.0, November 2007
Page 88
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
– Access to Web server is (simulated) public IP address: 10.1.0.52
Tip: If you arrange with your ISP to have more than one public IP address for your use,
you can use the additional public IP addresses to map to servers on your LAN or
DMZ. One of these public IP addresses will be used as the primary IP address of the
router which will be used to provide Internet access to your LAN PCs through NAT.
The other addresses are available to map to your servers.
To configure the FR538G for additional IP addresses:
1. Select Security from the main menu and Firewall Ru les from the submenu.
2. If your server is to be on your LAN, select LAN WAN Rules.
If your server is to be on your DMZ, select DMZ WAN Rules.
3. Click Add under the Inbound Services table. The Add LAN WAN Inbound Service screen
will display.
4. From the Service pull-down menu, select the HTTP service for a Web server.
Figure 4-10
5. From the Action pull-down menu, select Allow Always.
6. In the Send to LAN Server field, enter the local IP address of your Web server PC.
7. From the Public Destination IP Address pull down menu, choose Other Public IP Address.
4-16 Firewall Protection and Content Filtering
v1.0, November 2007
Page 89
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
8. Enter one of your public Internet addresses that will be used by clients on the Internet to reach
your Web server.
9. Click Apply.
Your rule will now appear in the Inbound Services table of the Rules menu (see Figure 4-11). This
rule is different from a normal inbound port forwarding rule in that the Des tination box contains an
IP Address other than your normal WAN IP Address.
Figure 4-11
To test the connection from a PC on the Internet, type http://<IP_address>, where <IP_address>
is the public IP address you have mapped to your Web server. You should see the home page of
your Web server.
LAN WAN or DMZ WAN Inbound Rule: Specifying an Exposed Host
Specifying an exposed host allows you to set up a computer or server that is available to anyone on
the Internet for services that you have not yet defined.
To expose one of the PCs on your LAN or DMZ as this host:
1. Create an inbound rule that allows all protocols.
2. Place the rule below all other inbound rules.
Note: For security, NETGEAR strongly recommends that you avoid creating an exposed
host. When a computer is designated as the exposed host, it loses much of the
protection of the firewall and is exposed to many exploits from the Internet. If
compromised, the computer can be used to attack your network.
Firewall Protection and Content Filtering 4-17
v1.0, November 2007
Page 90
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
1. Select Any and Allow Always (or Allow by Schedule)
2. Place rule below all other inbound rules
Figure 4-12
Outbound Rules Example
Outbound rules let you prevent users from using applications such as Instant Messenger, Real
Audio or other non-essential sites.
LAN WAN Outbound Rule: Blocking Instant Messenger
If you want to block Instant Messenger usage by employees during working hours, you can create
an outbound rule to block that application from any internal IP address to any external address
according to the schedule that you have created in the Schedule menu. You can also have the
firewall log any attempt to use Instant Messenger during that blocked period.
4-18 Firewall Protection and Content Filtering
v1.0, November 2007
Page 91
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 4-13
Implementing DoS and DDoS
This screen allows you to specify whether or not the router should be protected against DoS
(denial of service) and (distributed denial of service) attacks in the DMZ, LAN and WAN
networks. The various types of attack checks are listed on the DoS & DDoS screen and defined
below:
• DoS Protection
– Disable SPI Firewall. The router by default is protected by SPI (stateful packet
inspection) firewall. You may disable protection by SPI firewall by checking Di sable SPI
Firewall.
– Ping Response. If enabled, the firewall will reject all ping packets to avoid an ICMP
Sweep or Ping Sweep attack.
• DDoS Protection
– Block Fragmenting Attacks. Fragmentation attack is a form of attack that is initiated
when one machine sends out fragmented packets with incorrect offset values to a target
system to gain illegal access or to cause to cause the target system to crash.
– Block TCP Flood. A SYN flood is a form of denial of service attack in which an attacker
sends a succession of SYN requests to a target system. When the system responds, the
attacker doesn’t complete the connections, thus leaving the connection half-open and
flooding the server with SYN messages. No legitimate connections can then be made.
When enabled, the router will drop all invalid TCP packets and will be protected from a
SYN flood attack. Usually, this setting should be enabled.
Firewall Protection and Content Filtering 4-19
v1.0, November 2007
Page 92
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
– Block UDP Flood. A UDP flood is a form of denial of service attack that can be initiated
when one machine sends a large number of UDP packets to random ports on a remote
host. As a result, the distant host will (1) check for the application listening at that port, (2)
see that no application is listening at that port and (3) reply with an ICMP Destination
Unreachable packet.
When the victimized system is flooded, it is forced to send many ICMP packets,
eventually making it unreachable by other clients. The attacker may also spoof the IP
address of the UDP packets, ensuring that the excessive ICMP return packets do not reach
him, thus making the attacker’s network location anonymous.
– Block Non-standard Packets. Abnormal packets are often used by hackers, especially for
DoS attacks, but may also be generated by other network devices. This setting should
normally be enabled.
To enable the appropriate DoS and DDoS Checks for your environmen t:
1. Select Security > Firewall from the main menu and then the select the DoS & DDoS tab. The
DoS & DDoS screen will display.
2. Select the desired checkboxes in the DoS Protection and Defense Agent DDoS Attack you
wish to initiate.
3. Click Apply to save your settings; otherwise, click Reset to return to the previous settings.
Figure 4-14
Imposing Session Limits
This screen allows you to specify whether or not to impose a session limit for a network client.
Setting session limits can be useful for managing P2P software, such as BT (bit torrent), emule,
4-20 Firewall Protection and Content Filtering
v1.0, November 2007
Page 93
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
etc., from using up all the sessions. The various options for session limit configuration are listed
below:
•Disable
– No session limit is imposed on any network client. Any client can use as many sessions as
allowed by the router.
• Single IP Cannot Exceed Preset Session Limit
– When this limit is reached, no new session is allowed from this particular client. New
sessions are allowed only when existing sessions are terminated or timed out.
• When Single IP Exceeds Preset Session Limit
– When this limit is reached, the router either restricts the particular client from adding any
new session or terminates all sessions from this particular client for a preset period of
time.
To configure session limit for your environment:
1. Select Security > Firewall Rules from the main menu, and then the Session Limit tab. The
Session Limit screen will display.
2. Select one of the session limit options by clicking the corresponding radio button.
a. If no session limit is desired for any client, click the Disable radio button
b. If no new session is allowed when the session limit is reached for a particular client, click
Single IP cannot exceed ... Session radio button and enter the value for the desired
session limit.
c. If no new session is allowed for a preset period of time when the se ssion limit is reached
for a particular client, click both the When single IP exceed ... session and block this IP
to add new session for ... minutes radio buttons. Please make sure the desired value for
the time period is entered.
d. If all sessions are terminated for a preset period of time when the session limit is reached
for a particular client, click both the When single IP exceed ... session and Block all
connections from this IP for ... minutes radio buttons. Please make sure the desired
value for the time period is entered.
3. Click Apply to save your settings; otherwise, click Reset to return to the previous settings.
Firewall Protection and Content Filtering 4-21
v1.0, November 2007
Page 94
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 4-15
Setting Up P2P Software Prevention
P2P Software Prevention is used to enable or disable the specific P2P applications to protect your
computer. You can also add custom P2P applications. P2P software prevention is disabled by
default.
To enable P2P Software Prevention:
1. Select Security > Firewall from the main menu, and then select the P2P Software Prevention
tab. The P2P Software Prevention screen will display
2. Click the Yes radio box to enable P2P Software Prevention, and then click Apply.
4-22 Firewall Protection and Content Filtering
v1.0, November 2007
Page 95
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 4-16
To enable services in the P2P Application Services Table:
1. Select the checkbox adjacent to the service you want to enable.
2. Click enable. The Status ! icon will turn from gray to green to indicate that the service has
been enabled.
To add a new custom service:
1. Add the following information in the Add Custom P2P Application Service table:
a. In the Name column, enter the name of the service.
b. From the Type pull-down menu, select either TCP or UDP.
c. Enter the Start Port and Finish Port in their respective fields
d. Click add. The custom service will be enabled and added to the P2P Services T able. (You
can temporarily disable the service by selecting its checkbox and clicking disable.)
Firewall Protection and Content Filtering 4-23
v1.0, November 2007
Page 96
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Adding Customized Services
Services are functions performed by server computers at the request of client computers.
For example, Web servers serve Web pages, time servers serve time and date information, and
game hosts serve data about other players’ moves. When a computer on the Internet sends a
request for service to a server computer, the requested service is identified by a service or port
number. This number appears as the destination port number in the transmitted IP packets. For
example, a packet that is sent with destination port number 80 is an HTTP (Web server) request.
The service numbers for many common protocols are defined by the Internet Engineering Task
Force (IETF) and published in RFC1700, “Assigned Numbers.” Service numbers for other
applications are typically chosen from the range 1024 to 65535 by the authors of the application.
Although the FR538G already holds a list of many service port numbers, you are not limited to
these choices. Use the Services screen to add additional services and applications to the list for use
in defining firewall rules. The Services menu shows a list of services that you have defined, as
shown in Figure 4-17.
To define a new service, first you must determine which port number or range of n umbers is used
by the application. This information can usually be determined by contacting the publisher of the
application or from user groups of newsgroups. When you have the port number information, you
can enter it on the Services screen.
4-24 Firewall Protection and Content Filtering
v1.0, November 2007
Page 97
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 4-17
To add a customized service:
1. Select Security from the main menu and Services from the submenu. The Services screen will
display.
2. In the Add Custom Service table, enter a descriptive name for the service (this is for your
convenience).
3. Select the Layer 4 Protocol that the service uses as its transport protocol. It can be TCP, UDP,
TCP/UDP or ICMP.
4. Enter the first TCP or UDP port of the range that the service uses. If the service uses only one
port, then the Start Port and the Finish Port will be the same.
5. Enter the last port of the range that the service uses. If the service only uses a single port
number, enter the same number in both fields.
6. Click Add. The new custom service will be added to the Custom Services Table.
To edit the parameters of a service:
Firewall Protection and Content Filtering 4-25
v1.0, November 2007
Page 98
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
1. In the Custom Services T able, click the Edit icon adjacent to the service you want to edit. The
Edit Service screen will display.
2. Modify the parameters you wish to change.
3. Click Reset to cancel the changes and restore the previous settings.
4. Click Apply to confirm your changes. The modified service will display in the Custom
Services Table.
Setting a Schedule to Block or Allow Specific Traffic
If you enabled Content Filtering in the Block Sites menu, or if you defined an outbound or inbound
rule to use a schedule, you can set up a schedule for when blocking occurs or when access is
restricted. The firewall allows you to specify when blocking will be enforced by configuring one
of the Schedules—Schedule 1, Schedule 2 or Schedule 3.
To invoke rules and block keywords or Internet domains bas ed on a schedule:
1. Select Security > Schedule from the main menu, and then select the Schedule 1 tab. The
Schedule 1 screen will display.
2. Check the radio button for All Days or Specific Days. If you chose Specific Days, check the
radio button for each day you want the schedule to be in effect.
3. Check the radio button to schedule the time of day: All Day, or Specific Times. If you chose
Specific Times, enter the Start Time and End Time fields (Hour, Minute, AM/P M), which will
limit access during certain times for the selected days.
4. Click Reset to cancel your settings and revert to the previous settings.
5. Click Apply to save your settings to Schedule 1.
Repeat these 5 steps to set to a schedule for Schedule 2 and Schedule 3.
4-26 Firewall Protection and Content Filtering
v1.0, November 2007
Page 99
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
Figure 4-18
Setting Block Sites (Content Filtering)
If you want to restrict internal LAN users from access to certain sites on the Internet, you can use
the firewall’s Content Filtering and Web Components filtering. By default, these features are
disabled; all requested traffic from any Web site is allowed. If you enable one or more of these
features and users try to access a blocked site, they will see a “Blocked by NETGEAR” message.
Several types of blocking are available:
• Web Components blocking. Y ou can block the following Web component types: Proxy, Java,
ActiveX, and Cookies. Even sites on the Trusted Domains list will be subject to Web
Components blocking when the blocking of a particular Web component is enabled.
Note: Many websites require that cookies be accepted in order for the site to be
accessed properly. Blocking cookies may make these sites in accessible.
• Keyword Blocking (Domain Name Blocking). You can specify up to 64 words that, should
they appear in the Web site name (URL) or in a newsgroup name, will cause that site or
newsgroup to be blocked by the quad WAN gigabit firewall.
Firewall Protection and Content Filtering 4-27
v1.0, November 2007
Page 100
ProSafe Quad WAN Gigabit Firewall FR538G Reference Manual
You can bypass Keyword blocking for Trusted IPs by adding the Trusted IP Address in the
Trusted IP fields and selecting the Allow T rusted IP address to Visit Block sites. Access to the
domains or keywords from this IP address still be allowed without any blocking.
Keyword application examples:
• If the keyword “XXX” is specified, the URL <http://www.badstuff.com/xxx.html> is blocked,
as is the newsgroup alt.pictures.XXX.
• If the keyword “.com” is specified, only Web sites with other domain suffixes (such as .edu or
.gov) can be viewed.
• If you wish to block all Internet browsing access, enter the keyword “.”.
To enable Content Filtering:
1. Select Security > Block Sites from the sub-menu. The Block Sites screen will display.
2. Check the Yes radio button to enable Content Filtering, or select a Schedule radio button.
3. Check the radio boxes of any Web Components you wish to block.
4. Check the Allow T rusted IP address To Visit BLocked Sites radio box to allow trusted IPs to
access blocked sites, and enter the Trusted IP Address, and click Apply.
5. Build your list of blocked Keywords or Domain Names in the Add Blocked Keyword fields.
After each entry, click Add. The Keyword or Domain name will be added to the Blocked
Keywords table. (You can also edit an entry by clicking Edit in the Action column adjacent to
the entry.)
6. Click Reset to cancel your changes and revert to the previous settings.
7. Click Apply to save your settings.
4-28 Firewall Protection and Content Filtering
v1.0, November 2007
Loading...