Sitecom WLR-6001manual

WLR-6001 Wireless Gigabit VPN Router N750 X6 (802.11a/b/g/n)

User Manual TABLE OF CONTENTS 1 KEY FEATURES....................................................................................................... 5 2 PACKAGE CONTENTS ............................................................................................ 6 3 CAUTIONS................................................................................................................ 7 4 PRODUCT LAYOUT ................................................................................................ 8 5 NETWORK + SYSTEM REQUIREMENTS..........................................................11 6 WLR-6001 PLACEMENT.....................................................................................11 7 SETUP LAN, WAN .................................................................................................12 8 PC NETWORK ADAPTER SETUP.......................................................................13 9 BRING UP THE WLR-6001.................................................................................17 10 INITIAL SETUP WLR-6001............................................................................17 11 CONFIGURATION WIZARD............................................................................26 11.1 Connecting to an external VPN service ...........................................................................27 12 WIRELESS SETTINGS......................................................................................31 13 FIREWALL SETTINGS......................................................................................42 14 ADVANCED SETTINGS.....................................................................................48 15 VPN.....................................................................................................................58 16 TOOLBOX SETTINGS.......................................................................................... 107 17 ADDENDUM: USB PORT CONTROL CENTER................................................ 119

Revision 1.1 © Sitecom Europe BV 2012 Note: All the information contained in this manual was correct at the time of publication. However, as our engineers are always updating and improving the product, your device’s software may have a slightly different appearance or modified functionality than presented in this manual.

Introduction Congratulations on your purchase of the Wireless Gigabit VPN Router N750 X6. The WLR-6001 is compliant with 802.11a and 802.11n and up to 6 times faster than standard 802.11g based routers while still being compatible with 802.11g & 802.11b devices. The WLR-6001 is not only a Wireless Access Point, but also doubles as a 4-port full-duplex Gigabit switch that connects your wired-Ethernet devices together at 10/100/1000 Mbps speeds. At 300/450 Mbps wireless transmission rate, the Access Point built into the Router uses advanced MIMO (Multi-Input, Multi-Output) technology to transmit multiple streams of data in a single wireless channel, giving you seamless access to multimedia content. The robust RF signal travels farther, eliminates dead spots and extends the network range. For data protection and privacy, the WLR-6001 encodes all wireless transmissions with WEP, WPA, or WPA2 encryption. With the built-in DHCP Server & powerful SPI firewall, the WLR-6001 protects your computers against intruders and most known Internet attacks and also provides safe VPN pass-through. With the incredible speed and QoS function of 802.11n the WLR-6001 is ideal for media-centric applications like streaming video, gaming, and VoIP telephony to run multiple media-intense data streams through the network at the same time, with no degradation in performance. With Sitecom Cloud Security, Sitecom goes one step further and ensures that you can surf the Internet even more safely, not only on your PC, but on all the devices in your home which you use to access the Internet. All the Internet devices in your home are protected against the dangers of Internet criminality. You can use the WLR-6001 as a VPN client to access an external VPN server or you can configure the router as a VPN server to be able to access your home network from any location using the Internet. With VPN technology you always make use of a highly secured and encrypted VPN tunnel.

1 Key Features Features Advantages Incredible Data Rate up to 450Mbps* Heavy data payloads such as MPEG video streaming IEEE 802.11n Compliant and backwards compatible with 802.11b/g Fully Interoperable with IEEE 802.11b / IEEE802.11g compliant devices with legacy protection Four 10/100/1000 Mbps gigabit Switch Ports (Auto-Crossover) Scalability, extend your network. Firewall supports Virtual Server Mapping, DMZ, IP Filter, ICMP Blocking, SPI Avoids the attacks of Hackers or Viruses from Internet Support 802.1x authenticator, 802.11i (WPA/WPA2, AES), VPN pass-through Provide mutual authentication (Client and dynamic encryption keys to enhance security WDS (Wireless Distribution System) Make wireless AP and Bridge mode simultaneously as a wireless repeater Sitecom Cloud Security Protect your home against cybercrime while browsing. * Theoretical wireless signal rate based on IEEE standard of 802.11a, b, g, n chipset used. Actual throughput may vary. Network conditions and environmental factors lower actual throughput rate. All specifications are subject to change without notice.

2 Package Contents Open the package carefully, and make sure that none of the items listed below are missing. Do not discard the packing materials, in case of return; the unit must be shipped back in its original package. 1. The WLR-6001 Router 2. A 100V~240V to 12V 1.25A Switching Power Adapter 3. A Quick Install Guide 4. A CD (with User Manual) 5. A Warranty card 6. An UTP cable

3 Cautions This router’s design and manufacturer has your safety in mind. In order to safely and effectively use this router, please read the following before usage. 3.1 Usage Cautions The user should not modify this router. The environmental temperature should be within +5 ~ +35 degrees Celsius. 3.2 Power The router’s power voltage is DC 12V 1.25A. When using this router, please connect the supplied AC adapter or AC adapter cable to the router’s power jack. When placing the adapter cable, make sure it can not get damaged or be subject to pressure. To reduce the risk of electric shock, unplug the adapter first before cleaning it. Never connect the adapter to the router in a humid or dusty area. Do not replace the adapter or cable’s wire or connector. 3.3 Repair If the router has a problem, you should take it to an appointed repair centre and let the specialists do the repair. Never repair the router yourself, you might damage the router or endanger yourself. 3.4 Disposing of the Router When you dispose of the router, be sure to dispose it appropriately. Some countries may regulate disposal of an electrical device, please consult with your local authority. 3.5 Others When using this router, please do not let it come into contact with water or other liquids. If water is accidentally spilled on the router, please use a dry cloth to absorb the spillage. Electronic products are vulnerable, when using please avoid shaking or hitting the router, and do not press the buttons too hard. - Do not let the router come into contact with water or other liquid. - Do not disassemble the router, repair the router or change the design of the router, any damage done will not be included in the repair policy. - Avoid hitting the router with a hard object, avoid shaking the router and stay away from magnetic fields. - If during electrostatic discharge or a strong electromagnetic field the product will malfunction, unplug the power cable. The product will return to normal performance the next time it is powered on.

4 Product Layout Port Description Power connector Connect the 12V DC adapter to this port LAN (Yellow) Connect your PC’s or network devices to this port WAN (Blue) Connect your ADSL/Cable modem to this port USB Connect your Printer or Storage device to this port

Backlabel The backlabel describes the IP address, login details, SSID, security code and WPS button functionality. Button Description WPS BUTTON Press 0-5 seconds for 2.4 GHz WPS mode Press 5-10 seconds for 5 GHz WPS mode Press 10 seconds to reset the router Press 15 Seconds to reset the router to factory defaults.

LED Definition From left to right. Port Description LAN (Blue) Shows the cable is connected. LAN (Blue) Shows the cable is connected. LAN (Blue) Shows the cable is connected. LAN (Blue) Shows the cable is connected. WAN (Blue) Shows the cable is connected. WiFi (White) Shows 5GHz WiFi activity. WiFi (Blue) Shows 2.4GHz WiFi activity. Power (Red) Shows the device is turned on. OPS (White) Shows OPS activity.

5 Network + System Requirements To begin using the WLR-6001, make sure you meet the following as minimum requirements: • PC/Notebook. • Operating System – Microsoft Windows XP/2000/VISTA/7 • 1 Free Ethernet port. • WiFi card/USB dongle (802.11 b/g/n) – optional. • External xDSL (ADSL) or Cable modem with an Ethernet port (RJ-45). • PC with a Web-Browser (Internet Explorer, Safari, Firefox, Opera) • Ethernet compatible CAT5e cables. 6 WLR-6001 Placement You can place the WLR-6001 on a desk or other flat surface, or you can mount it on a wall. For optimal performance, place your Wireless Broadband Router in the center of your home (or your office) in a location that is away from any potential source of interference, such as a metal wall or microwave oven. This location must be close to a power connection and your ADSL/Cable modem.

8 PC Network Adapter setup Windows XP • Enter [Start Menu]
select [Control panel]
select [Network]. • Select [Local Area Connection]) icon=>select [properties]

• Select [Internet Protocol (TCP/IP)] =>Click [Properties]. • Select the [General] tab. The WLR-6001 supports a [DHCP] function, please select both [Obtain an IP address automatically] and [Obtain DNS server address automatically].

Windows Vista/Seven • Enter [Start Menu]
select [Control panel]
select [View network status and tasks] -> select [Manage network connections]. • Select [Local Area Connection]) icon=>select [properties]

• Select [Internet Protocol Version 4 (TCP/IPv4)] =>Click [Properties]. • Select the [General] tab. The WLR-6001 supports a [DHCP] function, please select both [Obtain an IP address automatically] and [Obtain DNS server address automatically].

9 Bring up the WLR-6001 Connect the supplied power-adapter to the power inlet port and connect it to a wall outlet. Switch the WLR-6001 on by flipping the switch on the back of the device. The WLR-6001 automatically enters the self-test phase. During self-test phase, the Power LED will be lit continuously to indicate that this product is in normal operation. 10 Initial Setup WLR-6001 LOGIN procedure 1. OPEN your browser (e.g. Internet Explorer). 2. Type http://192.168.0.1 in the address bar and press [Enter]

3. Type user name and password. The default username is admin, the password can be found on the back label on the bottom of your router. 4. Click OK. 5. You will see the home page of the WLR-6001. The System status section allows you to monitor the current status of your router, the UP time, hardware information, serial number as well as firmware version information is displayed here.

LAN settings The LAN tab gives you the opportunity to change the IP settings of the WLR- 6001. Click <Apply> at the bottom of this screen to save any changes. IP address 192.168.0.1. It is the router’s LAN IP address (Your LAN clients default gateway IP address). IP Subnet Mask 255.255.255.0 Specify a Subnet Mask for your LAN segment. 802.1d Spanning Tree is Disabled by default. If the 802.1d Spanning Tree function is enabled, this router will use the spanning tree protocol to prevent network loops. DHCP Server Enabled by default. You can enable or disable the DHCP server. When DHCP is disabled no ip-addresses are assigned to clients and you have to use static ip-addresses. When DHCP server is enabled your computers will be assigned an ip-address automatically until the lease time expires. Lease Time Forever. In the Lease Time setting you can specify the time period that the DHCP lends an IP address to your LAN clients. The DHCP will change your LAN client’s IP address when this time threshold period is reached.

IP Address Pool You can select a particular IP address range for your DHCP server to issue IP addresses to your LAN Clients. Note: default IP range is 192.168.0.100 ~ 192.168.0.200. If you want your PC(s) to have a static/fixed IP address, then you’ll have to choose an IP address outside this IP address Pool Domain Name You can specify a Domain Name for your LAN. Or just keep the default (sitecomwlr6001).

Device Status View the Broadband router’s current configuration settings. Device Status displays the configuration settings you’ve configured in the Wizard / Basic Settings / Wireless Settings section.

Internet Status This page displays whether the WAN port is connected to a Cable/DSL connection. It also displays the router’s WAN IP address, Subnet Mask, and ISP Gateway as well as MAC address, the Primary DNS. Press Renew button to renew your WAN IP address.

DHCP Client Status DHCP This page shows all DHCP clients (LAN PCs) currently connected to your network. The table shows the assigned IP address, MAC address and expiration time for each DHCP leased client. Use the Refresh button to update the available information. You can check Enable Static DHCP IP. It is possible to add more static DHCP IPs. They are listed in the table Current Static DHCP Table. IP can be deleted at will from the table. Click the Apply button to save the changed configuration.

WLR-6001 Log View the operation log of the WLR-6001. This page shows the current system log of the Broadband router. It displays any event occurred after system start up. At the bottom of the page, the system log can be saved <Save> to a local file for further processing or the system log can be cleared <Clear> or it can be refreshed <Refresh> to get the most updated information. When the system is powered down, the system log will disappear if not saved to a local file.

WLR-6001 Statistics Shows the counters of packets sent and received on WAN, LAN & WLAN.

11 Configuration Wizard Click Internet Settings to configure the router. Here you can choose your internet connection type. Depending on the chosen setting, you may need to enter your user name and password, MAC address or hostname in the following window. After you have entered the correct information, click Apply to save the settings.

11.1 Connecting to an external VPN service This section explains how to connect the WLR-6001 to an external VPN service by making use of the supported protocols PPTP, and L2TP+IPSec. If you want to set up the WLR-6001 as a VPN server, you should go to Section 15 “WLR-6001 as a VPN server”. In order to properly connect to an external VPN service you must first make sure that your WLR-6001 is connected to the Internet. The Internet connection can be configured as either “Dynamic IP Address” or “PPP over Ethernet”. Once you are successfully connected to the Internet with either of these two methods you may continue with the set-up of the VPN connection. Once you are sure the WLR-6001 has Internet connectivity, please follow the following steps: 1. First of all, make sure you are connected to the WLR-6001. It does not matter if you are connected either wirelessly or via a cable connected to one of the LAN ports (yellow ports) of the device. 2. Open your web browser and type in the address bar the LAN IP address of the device. Note: the default value for the LAN IP is “192.168.0.1” 3. Click on the Tab called “Internet Settings” where you can see your current Internet configuration. 4. Click on “Login Method”. This action will display a small menu containing the different connectivity options, as you can see in the following image:

This is a configuration example, where the default configuration for the Internet connection is Dynamic IP Address, but you may also have PPP over Ethernet established as default. 5. At this point you must choose the type of VPN connection you want to set-up. Depending on the VPN service you want to connect to, choose out of: 5a. Connect to a PPTP service. Click on the “PPTP” option in the menu. You should see the following page:

Although most of the VPN servers will give you an IP address dynamically, some VPN servers must be configured statically. If you want to configure your IP address dynamically, please skip this step. If you want to configure the VPN statically, click on “Use the following IP address”. Next, fill in the information provided from your VPN service regarding: 1. IP address. This is the IP address that the VPN service has assigned to you. 2. Subnet mask. If you are configuring your IP address statically, your VPN service should have provided you with a subnet mask value along with your IP address. 3. Default Gateway. If connected statically, this value is also provided from your VPN service to route packets properly to the VPN server. Fill in the Login information to connect to the VPN service. VPN servers use this information for user authentication. Please fill in the following information:

4. Username and Password. This information must have been provided from your VPN service provided. 5. PPTP Gateway. This value corresponds to either the domain name or public IP address of the VPN server you are trying to connect to. It must have been also provided from your VPN service provider. Click on “Apply”. Now your router will save the new configuration, and it will restart with the new configuration, trying to connect to the VPN server. 5b. Connect to a L2TP + IPSec service. Click on the “L2TP IPSec” option in the menu. You should see the following page: Although most of the VPN servers will give you an IP address dynamically, some VPN servers must be configured statically. If you want to configure your IP address dynamically, please skip this step. If you want to

configure the VPN statically, click on “Use the following IP address”. Next, fill in the information provided from your VPN service regarding: 1. IP address. This is the IP address that the VPN service has assigned to you. 2. Subnet mask. If you are configuring your IP address statically, your VPN service should have provided you with a subnet mask value along with your IP address. 3. Default Gateway. If connected statically, this value is also provided from your VPN service to route packets properly to the VPN server. Fill in the Login information to connect to the VPN service. VPN servers use this information for user authentication. Please fill in the following information: 4. Username, Password, and Shared Key. This information must have been provided from your VPN service provider. 5. PPTP Gateway. This value corresponds to either the domain name or public IP address of the VPN server you are trying to connect to. It must have been also provided from your VPN service provider. Click on “Apply”. Now your router will save the new configuration, and it will restart with the new configuration, trying to connect to the VPN server. 12 Wireless Settings You can set parameters that are used for the wireless stations to connect to this router for the 2.4Ghz radio or 5Ghz radio. The parameters include Mode, ESSID, Channel Number and Associated Client. Wireless Function

Enable or Disable Wireless function here. Click Apply and wait for module to be ready & loaded.

Basic Settings Mode Allows you to set the AP to AP, Station, Bridge or WDS mode. Band Allows you to set the AP fixed at 802.11b or 802.11g mode. You can also select B+G mode to allow 802.11b and 802.11g clients at the same time. For the 5GHz mode you can set 802.11a, 802.11n or 802.11a/n mode. ESSID This is the name of the wireless signal which is broadcasted. All the devices in the same wireless LAN should have the same ESSID. Channel The channel used by the wireless LAN. All devices in the same wireless LAN should use the same channel.

Advanced Settings This tab allows you to set the advanced wireless options. The options included are Authentication Type, Fragment Threshold, RTS Threshold, Beacon Interval, and Preamble Type. You should not change these parameters unless you know what effect the changes will have on the router. Authentication Type There are two authentication types: "Open System" and "Shared Key". When you select "Open System", wireless stations can associate with this wireless router without WEP encryption. When you select "Shared Key", you should also setup a WEP key in the "Encryption" page. After this has been done, make sure the wireless clients that you want to connect to the device are also setup with the same encryption key. Fragment Threshold "Fragment Threshold" specifies the maximum size of a packet during the fragmentation of data to be transmitted. If you set this value too low, it will result in bad performance. RTS Threshold When the packet size is smaller then the RTS threshold, the wireless router will not use the RTS/CTS mechanism to send this packet. Beacon Interval is the interval of time that this wireless router broadcasts a beacon. A Beacon is used to synchronize the wireless network.

Data Rate The “Data Rate” is the rate that this access point uses to transmit data packets. The access point will use the highest possible selected transmission rate to transmit the data packets. N Data Rate The “Data Rate” is the rate that this access point uses to transmit data packets for N compliant wireless nodes. Highest to lowest data rate can be fixed. Channel Bandwidth is the range of frequencies that will be used. Preamble Type The “Long Preamble” can provide better wireless LAN compatibility while the “Short Preamble” can provide better wireless LAN performance. Broadcast ESSID If you enabled “Broadcast ESSID”, every wireless station located within the coverage of this access point can discover this access point easily. If you are building a public wireless network, enabling this feature is recommended. Disabling “Broadcast ESSID” can provide better security. CTS Protection: It is recommended to enable the protection mechanism. This mechanism can decrease the rate of data collision between 802.11b and 802.11g wireless stations. When the protection mode is enabled, the throughput of the AP will be a little lower due to a lot of frame-network that is transmitted. TX Power can be set to a bare minimum or maximum power. WMM WiFi Multi Media if enabled supports QoS for experiencing better audio, video and voice in applications.

Security This Access Point provides complete wireless LAN security functions, included are WEP, IEEE 802.11x, IEEE 802.11x with WEP, WPA with pre-shared key and WPA with RADIUS. With these security functions, you can prevent your wireless LAN from illegal access. Please make sure your wireless stations use the same security function, and are setup with the same security key. Disable When you choose to disable encryption, it is very insecure to operate the WLR-6001. Enable 802.1x Auth IEEE 802.1x is an authentication protocol. Every user must use a valid account to login to this Access Point before accessing the wireless LAN. The authentication is processed by a RADIUS server. This mode only authenticates users by IEEE 802.1x, but it does not encrypt the data during communication

WEP When you select 64-bit or 128-bit WEP key, you have to enter WEP keys to encrypt data. You can generate the key by yourself and enter it. You can enter four WEP keys and select one of them as a default key. Then the router can receive any packets encrypted by one of the four keys. Key Length You can select the WEP key length for encryption, 64-bit or 128- bit. The larger the key will be the higher level of security is used, but the throughput will be lower. Key Format You may select ASCII Characters (alphanumeric format) or Hexadecimal Digits (in the "A-F", "a-f" and "0-9" range) to be the WEP Key. Key1 - Key4 The WEP keys are used to encrypt data transmitted in the wireless network. Use the following rules to setup a WEP key on the device. 64-bit WEP: input 10-digits Hex values (in the "A-F", "a-f" and "0-9" range) or 5-digit ASCII character as the encryption keys. 128-bit WEP: input 26-digit Hex values (in the "A-F", "a-f" and "0-9" range) or 13-digit ASCII characters as the encryption keys. Click <Apply> at the bottom of the screen to save the above configurations. You can now configure other sections by choosing Continue, or choose Apply to apply the settings and reboot the device.

WPA Pre-shared Key Wi-Fi Protected Access (WPA) is an advanced security standard. You can use a pre-shared key to authenticate wireless stations and encrypt data during communication. It uses TKIP or CCMP (AES) to change the encryption key frequently. So the encryption key is not easy to be cracked by hackers. This is the best security available. WPA-Radius Wi-Fi Protected Access (WPA) is an advanced security standard. You can use an external RADIUS server to authenticate wireless stations and provide the session key to encrypt data during communication. It uses TKIP or CCMP (AES) to change the encryption key frequently. Press Apply button when you are done.

ACL This wireless router supports MAC Address Control, which prevents unauthorized clients from accessing your wireless network. Enable wireless access control Enables the wireless access control function Adding an address into the list Enter the "MAC Address" and "Comment" of the wireless station to be added and then click "Add". The wireless station will now be added into the "Current Access Control List" below. If you are having any difficulties filling in the fields, just click "Clear" and both "MAC Address" and "Comment" fields will be cleared. Remove an address from the list If you want to remove a MAC address from the "Current Access Control List ", select the MAC address that you want to remove in the list and then click "Delete Selected". If you want to remove all the MAC addresses from the list, just click the "Delete All" button. Click "Reset" will clear your current selections. Click <Apply> at the bottom of the screen to save the above configurations. You can now configure other sections by choosing Continue, or choose Apply to apply the settings and reboot the device.

WPS Wi-Fi Protected Setup (WPS) is the simplest way to establish a connection between the wireless clients and the wireless router. You don’t have to select the encryption mode and fill in a long encryption passphrase every time when you try to setup a wireless connection. You only need to press a button on both wireless client and wireless router, and WPS will do the rest for you. The wireless router supports two types of WPS: WPS via Push Button and WPS via PIN code. If you want to use the Push Button, you have to push a specific button on the wireless client or in the utility of the wireless client to start the WPS mode, and switch the wireless router to WPS mode. You can simply push the WPS button of the wireless router, or click the ‘Start to Process’ button in the web configuration interface. If you want to use the PIN code, you have to know the PIN code of the wireless client and switch it to WPS mode, then fill-in the PIN code of the wireless client through the web configuration interface of the wireless router. WPS Check the box to enable WPS function and uncheck it to disable the WPS function. WPS Current Status If the wireless security (encryption) function of this wireless router is properly set, you’ll see a ‘Configured’ message here. Otherwise, you’ll see ‘UnConfigured’.

Self Pin Code This is the WPS PIN code of the wireless router. You may need this information when connecting to other WPS-enabled wireless devices. SSID This is the network broadcast name (SSID) of the router. Authentication Mode It shows the active authentication mode for the wireless connection. Passphrase Key It shows the passphrase key that is randomly generated by the wireless router during the WPS process. You may need this information when using a device which doesn’t support WPS. WPS via Push Button Press the button to start the WPS process. The router will wait for the WPS request from the wireless devices within 2 minutes. WPS via PIN You can fill-in the PIN code of the wireless device and press the button to start the WPS process. The router will wait for the WPS request from the wireless device within 2 minutes.

13 Firewall Settings The Broadband router provides extensive firewall protection by restricting connection parameters, thus limiting the risk of hacker attacks, and defending against a wide array of common Internet attacks. However, for applications that require unrestricted access to the Internet, you can configure a specific client/server as a Demilitarized Zone (DMZ). Note: To enable the Firewall settings select Enable and click Apply

DMZ If you have a client PC that cannot run an Internet application (e.g. Games) properly from behind the NAT firewall, then you can open up the firewall restrictions to unrestricted two-way Internet access by defining a DMZ Host. The DMZ function allows you to re-direct all packets going to your WAN port IP address to a particular IP address in your LAN. The difference between the virtual server and the DMZ function is that the virtual server re-directs a particular service/Internet application (e.g. FTP, websites) to a particular LAN client/server, whereas DMZ re-directs all packets (regardless of services) going to your WAN IP address to a particular LAN client/server. Enable DMZ Enable/disable DMZ Public IP Address The IP address of the WAN port or any other Public IP addresses given to you by your ISP Client PC IP Address Fill-in the IP address of a particular host in your LAN that will receive all the packets originally going to the WAN port/Public IP address above. Click <Apply> at the bottom of the screen to save the above configurations.

Denial of Service (DoS) The Broadband router's firewall can block common hacker attacks, including Denial of Service, Ping of Death, Port Scan and Sync Flood. If Internet attacks occur the router can log the events. Ping of Death Protections from Ping of Death attack Discard Ping From WAN The router’s WAN port will not respond to any Ping requests Port Scan Protects the router from Port Scans. Sync Flood Protects the router from Sync Flood attack.

Access You can restrict users from accessing certain Internet applications/services (e.g. Internet websites, email, FTP etc.), Access Control allows users to define the traffic type permitted in your LAN. You can control which PC client can have access to these services. Deny If you select “Deny” then all clients will be allowed to access Internet accept for the clients in the list below. Allow If you select “Allow” then all clients will be denied to access Internet accept for the PCs in the list below. Filter client PCs by IP Fill in “IP Filtering Table” to filter PC clients by IP. Add PC You can click Add PC to add an access control rule for users by IP addresses. Remove PC If you want to remove some PCs from the "IP Filtering Table", select the PC you want to remove in the table and then click “Delete Selected". If you want to remove all PCs from the table, just click the "Delete All" button. Filter client PC by MAC Check “Enable MAC Filtering” to enable MAC Filtering.

Add PC Fill in “Client PC MAC Address” and “Comment” of the PC that is allowed to access the Internet, and then click “Add”. If you find any typo before adding it and want to retype again, just click "Reset" and the fields will be cleared. Remove PC If you want to remove some PC from the "MAC Filtering Table", select the PC you want to remove in the table and then click "Delete Selected". If you want to remove all PCs from the table, just click the "Delete All" button. If you want to clear the selection and re-select again, just click “Reset”. Click <Apply> at the bottom of the screen to save the above configuration.

URL block You can block access to some Web sites from particular PCs by entering a full URL address or just keywords of the Web site. Enable URL Blocking Enable/disable URL Blocking Add URL Keyword Fill in “URL/Keyword” and then click “Add”. You can enter the full URL address or the keyword of the web site you want to block. Remove URL Keyword If you want to remove some URL keywords from the "Current URL Blocking Table", select the URL keyword you want to remove in the table and then click "Delete Selected". If you want remove all URL keywords from the table, just click "Delete All" button. If you want to clear the selection and re-select again, just click “Reset”. Click <Apply> at the bottom of the screen to save the above configurations

14 Advanced Settings Network Address Translation (NAT) allows multiple users at your local site to access the Internet through a single Public IP Address or multiple Public IP Addresses. NAT provides Firewall protection from hacker attacks and has the flexibility to allow you to map Private IP Addresses to Public IP Addresses for key services such as Websites and FTP. Select Disable to disable the NAT function. Port Forwarding Port Forwarding allows you to re-direct a particular range of service port numbers (from the Internet/WAN Port) to a particular LAN IP address. It helps you to host servers behind the router NAT firewall. Enable Port Forwarding Enable Port Forwarding Local IP This is the private IP of the server behind the NAT firewall.

Type This is the protocol type to be forwarded. You can choose to forward “TCP” or “UDP” packets only, or select “both” to forward both “TCP” and “UDP” packets. Port Range The range of ports to be forward to the private IP. Comment description of this setting. Add Fill in the "Private IP", “Type”, “Port Range” and "Comment" of the setting to be added and then click "Add". Then this Port Forwarding setting will be added into the "Current Port Forwarding Table" below. Remove If you want to remove a Port Forwarding setting from the "Current Port Forwarding Table", select the Port Forwarding setting that you want to remove in the table and then click "Delete Selected". If you want to remove all Port Forwarding settings from the table, just click "Delete All" button. Click "Reset" will clear your current selections.

Virtual Server Use the Virtual Server function when you want different servers/clients in your LAN to handle different service/Internet application type (e.g. Email, FTP, Web server etc.) from the Internet. Computers use numbers called port numbers to recognize a particular service/Internet application type. The Virtual Server allows you to re-direct a particular service port number (from the Internet/WAN Port) to a particular LAN private IP address and its service port number. Enable Virtual Server Enable Virtual Server. Local IP This is the LAN client/host IP address that the Public Port number packet will be sent to. Local Port This is the port number (of the above Private IP host) that the below Public Port number will be changed to when the packet enters your LAN (to the LAN Server/Client IP). Type Select the port number protocol type (TCP, UDP or both). If you are unsure, then leave it to the default “both” setting. Public Port Enter the service (service/Internet application) port number from the Internet that will be re-directed to the above Private IP address host in your LAN Comment The description of this setting.

Add Fill in the "Private IP", "Private Port", "Type", “Public Port” and "Comment" of the setting to be added and then click "Add". Then this Virtual Server setting will be added into the "Current Virtual Server Table" below. Reset If you want to remove Virtual Server settings from the "Current Virtual Server Table", select the Virtual Server settings you want to remove in the table and then click "Delete Selected". If you want to remove all Virtual Server settings from the table, just click the "Delete All" button. Click "Reset" will clear your current selections. Click <Apply> at the bottom of the screen to save the above configurations.