User manual NETGEAR DG834

Reference Manual for the ADSL Firewall Router DG834 NETGEAR, Inc. 4500 Great America Parkway Santa Clara, CA 95054 USA Phone 1-888-NETGEAR 202-10005-05 June 2005 202-10005-05, June 2005 © 2005 by NETGEAR, Inc. All rights reserved. Trademarks NETGEAR is a trademark of Netgear, Inc. Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation. Other brand and product names are registered trademarks or trademarks of their respective holders. Statement of Conditions In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to make changes to the products described in this document without notice. NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit layout(s) described herein. Federal Communications Commission (FCC) Compliance Notice: Radio Frequency Notice This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: · · · · Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help. Federal Communications Commission (FCC) Radiation Exposure Statement This equipment complies with FCC radiation exposure limits set forth for an uncontrolled environment. In order to avoid the possibility of exceeding the FCC radio frequency exposure limits, human proximity to the antenna shall not be less than 20 cm (8 inches) during normal operation. EN 55 022 Declaration of Conformance This is to certify that the DG834 ADSL Firewall Router is shielded against the generation of radio interference in accordance with the application of Council Directive 89/336/EEC, Article 4a. Conformity is declared by the application of EN 55 022 Class B (CISPR 22). Bestätigung des Herstellers/Importeurs ii 202-10005-05, June 2005 Es wird hiermit bestätigt, daß das DG834 ADSL Firewall Router gemäß der im BMPT-AmtsblVfg 243/1991 und Vfg 46/1992 aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte (z.B. Testsender) kann jedoch gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung. Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen. Certificate of the Manufacturer/Importer It is hereby certified that the DG834 ADSL Firewall Router has been suppressed in accordance with the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please refer to the notes in the operating instructions. Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market and has been granted the right to test the series for compliance with the regulations. Voluntary Control Council for Interference (VCCI) Statement This equipment is in the second category (information equipment to be used in a residential area or an adjacent area thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas. When used near a radio or TV receiver, it may become the cause of radio interference. Read instructions for correct handling. Customer Support Refer to the Support Information Card that shipped with your DG834 ADSL Firewall Router. World Wide Web NETGEAR maintains a World Wide Web home page that you can access at the universal resource locator (URL) http://www.netgear.com. A direct connection to the Internet and a Web browser such as Internet Explorer or Netscape are required. Product and Publication Details Model Number: Publication Date: Product Family: Product Name: Home or Business Product: Language: Publication Part Number: DG834 June 2005 router DG834 ADSL Firewall Router Business English 202-10005-05 iii 202-10005-05, June 2005 iv 202-10005-05, June 2005 Contents Chapter 1 About This Manual Audience, Scope, Conventions, and Formats ................................................................1-1 How to Use This Manual ................................................................................................1-2 How to Print this Manual .................................................................................................1-3 Chapter 2 Introduction About the Router ............................................................................................................2-1 Key Features ..................................................................................................................2-1 A Powerful, True Firewall .........................................................................................2-2 Easy Installation and Management ..........................................................................2-2 Protocol Support ......................................................................................................2-3 Virtual Private Networking (VPN) .............................................................................2-4 Content Filtering .......................................................................................................2-4 Auto Sensing and Auto UplinkTM LAN Ethernet Connections ..................................2-5 What's in the Box? ..........................................................................................................2-5 The Router's Front Panel .........................................................................................2-5 The Router's Rear Panel .........................................................................................2-6 Chapter 3 Connecting the Router to the Internet What You Need Before You Begin ..................................................................................3-1 ADSL Microfilter Requirements ................................................................................3-1 ADSL Microfilter .................................................................................................3-1 ADSL Microfilter with Built-In Splitter .................................................................3-2 Ethernet Cabling Requirements ...............................................................................3-2 Computer Hardware Requirements .........................................................................3-2 LAN Configuration Requirements ............................................................................3-2 Internet Configuration Requirements .......................................................................3-3 Where Do I Get the Internet Configuration Parameters? .........................................3-3 Contents 202-10005-05, June 2005 v Record Your Internet Connection Information ..........................................................3-3 Connecting the DG834 to Your LAN ...............................................................................3-4 How to Connect the Router ......................................................................................3-5 Auto-Detecting Your Internet Connection Type ..............................................................3-9 Wizard-Detected PPPoE Login Account Setup ......................................................3-10 Wizard-Detected PPPoA Login Account Setup ...................................................... 3-11 Wizard-Detected Dynamic IP Account Setup ......................................................... 3-11 Wizard-Detected IP Over ATM Account Setup ......................................................3-12 Wizard-Detected Fixed IP (Static) Account Setup ..................................................3-13 Testing Your Internet Connection ..................................................................................3-14 Manually Configuring Your Internet Connection ...........................................................3-14 How to Perform Manual Configuration ...................................................................3-15 Internet Connection Requires Login and Uses PPPoE ...................................3-16 Internet Connection Requires Login and Uses PPPoA ...................................3-17 Internet Connection Does Note Require A Login ............................................3-18 ADSL Settings ........................................................................................................3-19 Chapter 4 Protecting Your Network Protecting Access to Your DG834 ADSL Firewall Router ...............................................4-1 How to Change the Built-In Password .....................................................................4-1 Changing the Administrator Login Timeout ..............................................................4-2 Configuring Basic Firewall Services ...............................................................................4-2 Blocking Keywords, Sites, and Services ..................................................................4-3 How to Block Keywords and Sites ...........................................................................4-3 Firewall Rules .................................................................................................................4-5 Inbound Rules (Port Forwarding) .............................................................................4-6 Inbound Rule Example: A Local Public Web Server ..........................................4-6 Inbound Rule Example: Allowing Videoconferencing ........................................4-8 Considerations for Inbound Rules .....................................................................4-8 Outbound Rules (Service Blocking) .........................................................................4-9 Outbound Rule Example: Blocking Instant Messenger .....................................4-9 Order of Precedence for Rules .............................................................................. 4-11 Services ........................................................................................................................4-12 How to Define Services ..........................................................................................4-12 Setting Times and Scheduling Firewall Services ..........................................................4-13 vi 202-10005-05, June 2005 Contents How to Set Your Time Zone ...................................................................................4-13 How to Schedule Firewall Services ........................................................................4-14 Chapter 5 Managing Your Network Backing Up, Restoring, or Erasing Your Settings ...........................................................5-1 How to Back Up the Configuration to a File .............................................................5-1 How to Restore the Configuration from a File ..........................................................5-2 How to Erase the Configuration ...............................................................................5-2 Upgrading the Router's Firmware ...................................................................................5-2 How to Upgrade the Router Firmware .....................................................................5-3 Network Management Information .................................................................................5-4 Viewing Router Status and Usage Statistics ............................................................5-4 Viewing Attached Devices ........................................................................................5-9 Viewing, Selecting, and Saving Logged Information ................................................5-9 Selecting What Information to Log .................................................................. 5-11 Saving Log Files on a Server ..........................................................................5-12 Examples of Log Messages ...................................................................................5-12 Activation and Administration ..........................................................................5-12 Dropped Packets .............................................................................................5-12 Enabling Security Event E-mail Notification .................................................................5-13 Running Diagnostic Utilities and Rebooting the Router ................................................5-14 Enabling Remote Management ....................................................................................5-15 Configuring Remote Management .........................................................................5-15 Chapter 6 Advanced Configuration Configuring Advanced Security ......................................................................................6-1 Setting Up A Default DMZ Server ............................................................................6-1 How to Configure a Default DMZ Server ...........................................................6-2 Connect Automatically, as Required ........................................................................6-3 Disable Port Scan and DOS Protection ...................................................................6-3 Respond to Ping on Internet WAN Port ...................................................................6-3 MTU Size .................................................................................................................6-3 Configuring LAN IP Settings ...........................................................................................6-3 DHCP .......................................................................................................................6-5 Use Router as DHCP server .............................................................................6-5 Contents 202-10005-05, June 2005 vii Reserved IP addresses .....................................................................................6-6 How to Configure LAN TCP/IP Settings ...................................................................6-7 Configuring Dynamic DNS .......................................................................................6-7 How to Configure Dynamic DNS ..............................................................................6-8 Using Static Routes ........................................................................................................6-9 Static Route Example ...............................................................................................6-9 How to Configure Static Routes .............................................................................6-10 Universal Plug and Play (UPnP) ...................................................................................6-12 Chapter 7 Virtual Private Networking (Advanced Feature) Overview of VPN Configuration ......................................................................................7-2 Client-to-Gateway VPN Tunnels ..............................................................................7-2 Gateway-to-Gateway VPN Tunnels .........................................................................7-2 Planning a VPN ..............................................................................................................7-3 VPN Tunnel Configuration ..............................................................................................7-6 How to Set Up a Client-to-Gateway VPN Configuration .................................................7-6 Step 1: Configuring the Client-to-Gateway VPN Tunnel on the DG834 ...................7-7 Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC .........7-12 How to Set Up a Gateway-to-Gateway VPN Configuration ..........................................7-20 VPN Tunnel Control ......................................................................................................7-27 Activating a VPN Tunnel ........................................................................................7-27 Using the VPN Status Page to Activate a VPN Tunnel ....................................7-27 Activate the VPN Tunnel by Pinging the Remote Endpoint .............................7-28 Start Using a VPN Tunnel to Active It ..............................................................7-30 Verifying the Status of a VPN Tunnel .....................................................................7-30 Deactivating a VPN Tunnel ....................................................................................7-32 Using the Policy Table on the VPN Policies Page to Deactivate a VPN Tunnel 7-32 Using the VPN Status Page to Deactivate a VPN Tunnel ...............................7-33 Deleting a VPN Tunnel ...........................................................................................7-35 How to Set Up VPN Tunnels in Special Circumstances ...............................................7-35 Using Auto Policy to Configure VPN Tunnels ........................................................7-36 Configuring VPN Network Connection Parameters .........................................7-36 Example of Using Auto Policy .........................................................................7-41 Using Manual Policy to Configure VPN Tunnels ....................................................7-48 viii 202-10005-05, June 2005 Contents Chapter 8 Troubleshooting Basic Functioning ...........................................................................................................8-1 Power LED Not On ...................................................................................................8-2 Test LED Never Turns On or Test LED Stays On .....................................................8-2 LAN or WAN Port LEDs Not On ...............................................................................8-2 Troubleshooting the Web Configuration Interface ..........................................................8-3 Troubleshooting the ISP Connection ..............................................................................8-4 ADSL link .................................................................................................................8-4 WAN LED Blinking Yellow ..................................................................................8-4 WAN LED Off .....................................................................................................8-4 Obtaining a WAN IP Address ...................................................................................8-5 Troubleshooting PPPoE or PPPoA ..........................................................................8-6 Troubleshooting Internet Browsing ..........................................................................8-6 Troubleshooting a TCP/IP Network Using the Ping Utility ..............................................8-7 Testing the LAN Path to Your Router .......................................................................8-7 Testing the Path from Your Computer to a Remote Device .....................................8-8 Restoring the Default Configuration and Password ........................................................8-9 Using the Reset button .............................................................................................8-9 Problems with Date and Time .........................................................................................8-9 Appendix A Technical Specifications Appendix B Network and Routing Basics Related Publications ...................................................................................................... B-1 Basic Router Concepts .................................................................................................. B-1 What is a Router? ................................................................................................... B-1 Routing Information Protocol ................................................................................... B-2 IP Addresses and the Internet ................................................................................. B-2 Netmask .................................................................................................................. B-4 Subnet Addressing .................................................................................................. B-4 Private IP Addresses ............................................................................................... B-7 Single IP Address Operation Using NAT ................................................................. B-7 MAC Addresses and Address Resolution Protocol ................................................. B-8 Related Documents ................................................................................................. B-9 Contents 202-10005-05, June 2005 ix Domain Name Server .............................................................................................. B-9 IP Configuration by DHCP ...................................................................................... B-9 Internet Security and Firewalls .................................................................................... B-10 What is a Firewall? ................................................................................................ B-10 Stateful Packet Inspection ..................................................................................... B-10 Denial of Service Attack .........................................................................................B-11 Ethernet Cabling ...........................................................................................................B-11 Category 5 Cable Quality .......................................................................................B-11 Inside Twisted Pair Cables .................................................................................... B-12 Uplink Switches, Crossover Cables, and MDI/MDIX Switching ............................ B-13 Appendix C Preparing Your Network Preparing Your Computers for TCP/IP Networking ....................................................... C-1 Configuring Windows 95, 98, and Me for TCP/IP Networking ....................................... C-2 Installing or Verifying Windows Networking Components ....................................... C-2 Enabling DHCP to Automatically Configure TCP/IP Settings in Windows 95B, 98, and Me C-4 Selecting the Windows' Internet Access Method .................................................... C-6 Verifying TCP/IP Properties .................................................................................... C-6 Configuring Windows NT4, 2000 or XP for IP Networking ............................................ C-7 Installing or Verifying Windows Networking Components ....................................... C-7 DHCP Configuration of TCP/IP in Windows XP, 2000, or NT4 ...................................... C-8 DHCP Configuration of TCP/IP in Windows XP ..................................................... C-8 DHCP Configuration of TCP/IP in Windows 2000 ................................................ C-10 DHCP Configuration of TCP/IP in Windows NT4 .................................................. C-13 Verifying TCP/IP Properties for Windows XP, 2000, and NT4 .............................. C-15 Configuring the Macintosh for TCP/IP Networking ...................................................... C-16 MacOS 8.6 or 9.x .................................................................................................. C-16 MacOS X ............................................................................................................... C-16 Verifying TCP/IP Properties for Macintosh Computers ......................................... C-17 Verifying the Readiness of Your Internet Account ....................................................... C-18 Are Login Protocols Used? ................................................................................... C-18 What Is Your Configuration Information? .............................................................. C-18 Obtaining ISP Configuration Information for Windows Computers ....................... C-19 Obtaining ISP Configuration Information for Macintosh Computers ..................... C-20 Restarting the Network ................................................................................................ C-21 x 202-10005-05, June 2005 Contents Appendix D Virtual Private Networking What is a VPN? ............................................................................................................. D-1 What Is IPSec and How Does It Work? ......................................................................... D-2 IPSec Security Features ......................................................................................... D-2 IPSec Components ................................................................................................. D-2 Encapsulating Security Payload (ESP) ................................................................... D-3 Authentication Header (AH) .................................................................................... D-4 IKE Security Association ......................................................................................... D-4 Mode ................................................................................................................. D-5 Key Management .................................................................................................... D-6 Understand the Process Before You Begin ................................................................... D-6 VPN Process Overview ................................................................................................. D-7 Network Interfaces and Addresses ......................................................................... D-7 Interface Addressing ......................................................................................... D-7 Firewalls ........................................................................................................... D-8 Setting Up a VPN Tunnel Between Gateways ........................................................ D-8 VPNC IKE Security Parameters .................................................................................. D-10 VPNC IKE Phase I Parameters ............................................................................. D-10 VPNC IKE Phase II Parameters ............................................................................ D-11 Testing and Troubleshooting ........................................................................................ D-11 Additional Reading ...................................................................................................... D-11 Appendix E NETGEAR VPN Configuration DG834 to FVL328 .......................................................................................................... E-1 Configuration Profile ................................................................................................ E-1 Step-By-Step Configuration ..................................................................................... E-2 DG834 with FQDN to FVL328 ....................................................................................... E-6 Configuration Profile ................................................................................................ E-6 The Use of a Fully Qualified Domain Name (FQDN) ........................................ E-7 Step-By-Step Configuration ..................................................................................... E-8 Configuration Summary (Telecommuter Example) ...................................................... E-13 Setting Up the Client-to-Gateway VPN Configuration (Telecommuter Example) ........ E-14 Step 1: Configuring the Client-to-Gateway VPN Tunnel on the VPN Router at the Employer's Main Office ......................................................................................... E-15 Contents 202-10005-05, June 2005 xi Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC at the Telecommuter's Home Office ................................................................................ E-17 Monitoring the VPN Tunnel (Telecommuter Example) ................................................. E-26 Viewing the PC Client's Connection Monitor and Log Viewer ............................... E-26 Viewing the VPN Router's VPN Status and Log Information ................................ E-28 Glossary xii 202-10005-05, June 2005 Contents Chapter 1 About This Manual This chapter describes the intended audience, scope, conventions, and formats of this manual. Audience, Scope, Conventions, and Formats This reference manual assumes that the reader has basic to intermediate computer and Internet skills. However, basic computer network, Internet, firewall, and VPN technologies tutorial information is provided in the Appendices and on the Netgear website. This guide uses the following typographical conventions: Table 1-1. italics bold fixed Typographical Conventions Emphasis, books, CDs, URL names User input Screen text, file and server names, extensions, commands, IP addresses This guide uses the following formats to highlight special messages: Note: This format is used to highlight information of importance or special interest. This manual is written for the DG834 ADSL router according to these specifications: Table 1-2. Product Version Manual Publication Date Manual Scope DG834 ADSL Firewall Router June 2005 Note: Product updates are available on the NETGEAR, Inc. Web site at http://kbserver.netgear.com/products/DG834.asp. About This Manual 202-10005-05, June 2005 1-1 Reference Manual for the ADSL Firewall Router DG834 How to Use This Manual The HTML version of this manual includes the following: · · Buttons, at a time and , for browsing forwards or backwards through the manual one page A button that displays the table of contents and an button. Double-click on a link in the table of contents or index to navigate directly to where the topic is described in the manual. A product model. button to access the full NETGEAR, Inc. online knowledge base for the · · Links to PDF versions of the full manual and individual chapters. 1-2 202-10005-05, June 2005 About This Manual Reference Manual for the ADSL Firewall Router DG834 How to Print this Manual To print this manual you can choose one of the following several options, according to your needs. · Printing a Page in the HTML View. Each page in the HTML version of the manual is dedicated to a major topic. Use the Print button on the browser toolbar to print the page contents. · Printing a Chapter. Use the PDF of This Chapter link at the top left of any page. ­ Click the PDF of This Chapter link at the top right of any page in the chapter you want to print. The PDF version of the chapter you were viewing opens in a browser window. Note: Your computer must have the free Adobe Acrobat reader installed in order to view and print PDF files. The Acrobat reader is available on the Adobe Web site at http://www.adobe.com. ­ Click the print icon in the upper left of the window. Tip: If your printer supports printing two pages on a single sheet of paper, you can save paper and printer ink by selecting this feature. · Printing the Full Manual. Use the Complete PDF Manual link at the top left of any page. ­ ­ Click the Complete PDF Manual link at the top left of any page in the manual. The PDF version of the complete manual opens in a browser window. Click the print icon in the upper left of the window. Tip: If your printer supports printing two pages on a single sheet of paper, you can save paper and printer ink by selecting this feature. About This Manual 202-10005-05, June 2005 1-3 Reference Manual for the ADSL Firewall Router DG834 1-4 202-10005-05, June 2005 About This Manual Chapter 2 Introduction This chapter describes the features of the NETGEAR DG834 ADSL Firewall Router. The DG834 ADSL router is a combination of a built-in ADSL modem, router, 4-port switch, and firewall which enables your entire network to safely share an Internet connection that otherwise is used by a single computer. Note: If you are unfamiliar with networking and routing, refer to Appendix B, "Network and Routing Basics" to become more familiar with the terms and procedures used in this manual. About the Router The DG834 ADSL Firewall Router provides continuous, high-speed 10/100 Ethernet access between your Ethernet devices. The DG834 ADSL router enables your entire network to share an Internet connection through the built-in ADSL modem that otherwise is used by a single computer. With minimum setup, you can install and use the router within minutes. The DG834 ADSL router provides multiple Web content filtering options, plus e-mail browsing activity, reporting, and instant alerts. Parents and network administrators can establish restricted access policies based on time of day, Web site addresses, and address keywords. They can also share high-speed ADSL Internet access for up to 253 personal computers. The included firewall and Network Address Translation (NAT) features protect you from hackers. Key Features The DG834 ADSL router provides the following features: · · · A built-in ADSL modem A powerful, true firewall Easy, Web-based setup for installation and management Introduction 202-10005-05, June 2005 2-1 Reference Manual for the ADSL Firewall Router DG834 · · · · · Extensive Internet protocol support Trustworthy VPN Communications over the Internet VPN Wizard for easy VPN configuration Content filtering Auto Sensing and Auto UplinkTM LAN Ethernet connections These features are discussed below. A Powerful, True Firewall Unlike simple Internet sharing NAT routers, the DG834 is a true firewall, using stateful packet inspection to defend against hacker attacks. Its firewall features include: · Denial of Service (DoS) protection Automatically detects and thwarts Denial of Service (DoS) attacks such as Ping of Death, SYN Flood, LAND Attack and IP Spoofing. Blocks unwanted traffic from the Internet to your LAN. Blocks access from your LAN to Internet locations or services that you specify as off-limits. Logs security incidents The DG834 will log security events such as blocked incoming traffic, port scans, attacks, and administrator logins. You can configure the router to email the log to you at specified intervals. You can also configure the router to send immediate alert messages to your email address or email pager whenever a significant event occurs. · · · Easy Installation and Management You can install, configure, and operate the DG834 within minutes after connecting it to the network. The following features simplify installation and management tasks: · Browser-based management Browser-based configuration allows you to easily configure your router from almost any type of personal computer, such as Windows, Macintosh, or Linux. A user-friendly Setup Wizard is provided and online help documentation is built into the browser-based Web Management Interface. Smart Wizard The router automatically senses the type of Internet connection, asking you only for the information required for your type of ISP account. Introduction 202-10005-05, June 2005 · 2-2 Reference Manual for the ADSL Firewall Router DG834 · Remote management The router allows you to log in to the Web management interface from a remote location via the Internet. For security, you can limit remote management access to a specified remote IP address or range of addresses, and you can choose a nonstandard port number. Diagnostic functions The router incorporates built-in diagnostic functions such as Ping, DNS lookup, and remote reboot. These functions allow you to test Internet connectivity and reboot the router. You can use these diagnostic functions directly from the DG834 when you are connected on the LAN or when you are connected over the Internet via the remote management function. Visual monitoring The router's front panel LEDs provide an easy way to monitor its status and activity. Flash erasable programmable read-only memory (EPROM) for firmware upgrades. · · · Protocol Support The DG834 supports Transmission Control Protocol/Internet Protocol (TCP/IP) and Routing Information Protocol (RIP). Appendix B, "Network and Routing Basics" provides further information on TCP/IP. · The Ability to Enable or Disable IP Address Sharing by NAT The DG834 allows several networked PCs to share an Internet account using only a single IP address, which may be statically or dynamically assigned by your Internet service provider (ISP). This technique, known as Network Address Translation (NAT), allows the use of an inexpensive single-user ISP account. This feature can also be turned off completely while using the DG834 if you want to manage the IP address scheme yourself. Automatic Configuration of Attached PCs by DHCP The DG834 dynamically assigns network configuration information, including IP, router, and domain name server (DNS) addresses, to attached PCs on the LAN using the Dynamic Host Configuration Protocol (DHCP). This feature greatly simplifies configuration of PCs on your local network. DNS Proxy When DHCP is enabled and no DNS addresses are specified, the router provides its own address as a DNS server to the attached PCs. The router obtains actual DNS addresses from the ISP during connection setup and forwards DNS requests from the LAN. Classical IP (RFC 1577) Some Internet service providers, in Europe for example, use Classical IP in their ADSL services. In such cases, the router is able to use the Classical IP address from the ISP. 2-3 202-10005-05, June 2005 · · · Introduction Reference Manual for the ADSL Firewall Router DG834 · PPP over Ethernet (PPPoE) PPP over Ethernet is a protocol for connecting remote hosts to the Internet over an ADSL connection by simulating a dial-up connection. This feature eliminates the need to run a login program such as EnterNet or WinPOET on your computer. PPP over ATM (PPPoA) PPP over ATM is a protocol for connecting remote hosts to the Internet over an ADSL connection by simulating an ATM connection. Dynamic DNS Dynamic DNS services allow remote users to find your network using a domain name when your IP address is not permanently assigned. The router contains a client that can connect to many popular Dynamic DNS services to register your dynamic IP address. Universal Plug and Play (UPnP) UPnP is a networking architecture that provides compatibility between networking technologies. UPnP compliant routers provide broadband users at home and small businesses with a seamless way to participate in online games, videoconferencing and other peer-to-peer services. · · · Virtual Private Networking (VPN) The DG834 ADSL router provides a secure encrypted connection between your local area network (LAN) and remote networks or clients. It includes the following VPN features: · · Supports 8 VPN connections. Supports industry standard VPN protocols The DG834 ADSL router supports standard Manual or IKE keying methods, standard MD5 and SHA-1 authentication methods, and standard DES and 3DES encryption methods. It is compatible with many other VPN products. Supports 3DES encryption for maximum security. VPN Wizard based on VPNC recommended settings. · · Content Filtering With its content filtering feature, the DG834 prevents objectionable content from reaching your PCs. The router allows you to control access to Internet content by screening for keywords within Web addresses. You can configure the router to log and report attempts to access objectionable Internet sites. 2-4 202-10005-05, June 2005 Introduction Reference Manual for the ADSL Firewall Router DG834 Auto Sensing and Auto UplinkTM LAN Ethernet Connections With its internal 4-port 10/100 switch, the DG834 can connect to either a 10 Mbps standard Ethernet network or a 100 Mbps Fast Ethernet network. The local LAN ports are autosensing and capable of full-duplex or half-duplex operation. The router incorporates Auto UplinkTM technology. Each local Ethernet port will automatically sense whether the Ethernet cable plugged into the port should have a `normal' connection such as to a computer or an `uplink' connection such as to a switch or hub. That port will then configure itself to the correct configuration. This feature also eliminates the need to worry about crossover cables, as Auto Uplink will accommodate either type of cable to make the right connection. What's in the Box? The product package should contain the following items: · · · · · · DG834 ADSL Firewall Router AC power adapter (varies by region) Category 5 (Cat 5) Ethernet cable Telephone cable Microfilters (quantity and type vary by region) ADSL Firewall Router Resource CD, including: -- This guide -- Application Notes A Printed Quick Installation Guide Warranty and Support Information Cards · · If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep the carton, including the original packing materials, in case you need to return the product for repair. The Router's Front Panel The DG834 ADSL Firewall Router front panel shown below contains status LEDs. Introduction 202-10005-05, June 2005 2-5 Reference Manual for the ADSL Firewall Router DG834 Power Test Internet LAN Figure 2-1: DG834 Front Panel You can use the LEDs to verify various conditions. Table 2-1 lists and describes each LED on the front panel of the router. These LEDs are green when lit. Table 2-1. Label Power Test Internet LED Descriptions Activity On Off On Off Blink -- Amber On -- Green Blink -- Green On (Green) Blink (Green) On (Amber) Blink (Amber) Off Description Power is supplied to the router. Power is not supplied to the router. The system is initializing. The system is ready and running. Indicates ADSL training. The Internet port has detected a link with an attached device. Data is being transmitted or received by the Internet port. The Local port has detected a link with a 100 Mbps device. Data is being transmitted or received at 100 Mbps. The Local port has detected a link with a 10 Mbps device. Data is being transmitted or received at 10 Mbps. No link is detected on this port. LAN The Router's Rear Panel The rear panel of the DG834 ADSL Firewall Router (Figure 2-2) contains port connections. 2-6 202-10005-05, June 2005 Introduction Reference Manual for the ADSL Firewall Router DG834 LAN ADSL Internet Power Reset Figure 2-2: DG834 Rear Panel Viewed from left to right, the rear panel contains the following elements: · · · · AC power adapter outlet Four Local Ethernet RJ-45 ports for connecting the router to the local computers Factory Default Reset push button ADSL port for connecting the router to an ADSL line Introduction 202-10005-05, June 2005 2-7 Reference Manual for the ADSL Firewall Router DG834 2-8 202-10005-05, June 2005 Introduction Chapter 3 Connecting the Router to the Internet This chapter describes how to set up the router on your Local Area Network (LAN) and connect to the Internet. It describes how to configure your DG834 ADSL Firewall Router for Internet access using the Setup Wizard, or how to manually configure your Internet connection. What You Need Before You Begin You need to prepare the following before you can establish an Internet connection through your router: 1. 2. 3. The router connected to an ADSL line and a computer properly connected to the router as explained below. Active Internet service such as that provided by an ADSL account. The Internet Service Provider (ISP) configuration information for your DSL account. Note: If you purchased the DG834 in a country where a microfilter is not included, you must acquire one. ADSL Microfilter Requirements ADSL technology uses the same wires as your telephone service. However, ADSL adds signals to the telephone lines which create noise in the telephone service. You must use ADSL microfilters to filter out these signals before they reach your telephone. ADSL Microfilter Phone Figure 3-1: ADSL microfilter Connecting the Router to the Internet 202-10005-05, June 2005 3-1 Reference Manual for the ADSL Firewall Router DG834 Each device such as a telephone, fax machine, answering machine, or caller ID display will require an ADSL microfilter. Note: Do not connect the DG834 to the ADSL line through a microfilter unless the microfilter is a combination microfilter/splitter specifically designed for this purpose. Doing so will prevent the built-in ADSL modem in the DG834 from establishing a connection to the Internet. If you have any doubts about this, connect the DG834 directly to the ADSL line. ADSL Microfilter with Built-In Splitter DSL Phone Line Figure 3-2: ADSL microfilter with built-in splitter Use an ADSL microfilter with built-in splitter when there is a single wall outlet which must provide connectivity for both the DG834 and telephone equipment. Ethernet Cabling Requirements The DG834 ADSL router connects to your Ethernet LAN via twisted-pair cables. If the computer will connect to your network at 100 Mbps, you must use a Category 5 (CAT5) cable such as the one provided with your router. Computer Hardware Requirements To use the DG834 ADSL router on your network, each computer must have an installed Ethernet adapter and an Ethernet cable, or a 802.11g wireless adapter. LAN Configuration Requirements For the initial connection to the Internet and configuration of your router, you need to connect a computer to the router which is set to automatically get its TCP/IP configuration from the router via DHCP. Note: Please refer to Appendix C, "Preparing Your Network" for assistance with DHCP configuration. 3-2 202-10005-05, June 2005 Connecting the Router to the Internet Reference Manual for the ADSL Firewall Router DG834 Internet Configuration Requirements Depending on how your ISP set up your Internet account, you need one or more of these configuration parameters to connect your router to the Internet: · · · · · · Virtual Path Identifier (VPI)/Virtual Channel Indentifier (VCI) parameters Multiplexing Method Host and Domain Names ISP Login Name and Password ISP Domain Name Server (DNS) Addresses Fixed or Static IP Address Where Do I Get the Internet Configuration Parameters? There are several ways you can gather the required Internet connection information. · Your ISP should have provided you with all the information needed to connect to the Internet. If you cannot locate this information, you can ask your ISP to provide it or you can try one of the options below. If you have a computer already connected using the active Internet access account, you can gather the configuration information from that computer. · · · · For Windows 95/98/ME, open the Network control panel, select the TCP/IP entry for the Ethernet adapter, and click Properties. For Windows 2000/XP, open the Local Area Network Connection, select the TCP/IP entry for the Ethernet adapter, and click Properties. For Macintosh computers, open the TCP/IP or Network control panel. · You can also refer to the DG834 Resource CD for the NETGEAR Router ISP Guide which provides Internet connection information for many ISPs. Once you locate your Internet configuration parameters, you may want to record them on the next page. Record Your Internet Connection Information Print the following page. Fill in the configuration parameters from your Internet Service Provider (ISP). Connecting the Router to the Internet 202-10005-05, June 2005 3-3 Reference Manual for the ADSL Firewall Router DG834 ISP Multiplexing Method and Virtual Circuit Number: The default settings of your DG834 ADSL Firewall Router will work fine for most ISPs. However, some ISPs use a specific Multiplexing Method or a Virtual Circuit Number for either the Virtual Path Identifier (VPI) or Virtual Channel Identifier (VCI). If your ISP provided you with a specific Multiplexing Method or VPI/VCI number, then fill in the following: Multiplexing Method, circle one: LLC-based or VC-based VPI: ________ A number between 0 and 255. VCI: ___________ A number between 1 and 65535. ISP Login Name: The login name and password are case sensitive and must be entered exactly as given by your ISP. Some ISPs use your full e-mail address as the login name. The Service Name is not required by all ISPs. If you use a login name and password, then fill in the following: Login Name: ______________________________ Password: ____________________________ Service Name: _____________________________ Fixed or Static IP Address: If you have a static IP address, record the following information. For example, 169.254.141.148 could be a valid IP address. Fixed or Static Internet IP Address: ______.______.______.______ Router IP Address: ______.______.______.______ Subnet Mask: ______.______.______.______ ISP DNS Server Addresses: If you were given DNS server addresses, fill in the following: Primary DNS Server IP Address: ______.______.______.______ Secondary DNS Server IP Address: ______.______.______.______ Host and Domain Names: Some ISPs use a specific host or domain name like CCA7324-A or home. If you did not get host or domain names, use the following examples as a guide: · · If your main e-mail account with your ISP is aaa@yyy.com, then use aaa as your host name. Your ISP might call this your account, user, host, computer, or system name. If your ISP's mail server is mail.xxx.yyy.com, then use xxx.yyy.com as the domain name. ISP Host Name: _________________________ ISP Domain Name: _______________________ Connecting the DG834 to Your LAN This section provides instructions for connecting the DG834 ADSL router. 3-4 202-10005-05, June 2005 Connecting the Router to the Internet Reference Manual for the ADSL Firewall Router DG834 Note: The Resource CD included with your router contains an animated Installation Assistant to help you through this procedure. How to Connect the Router There are four steps to connecting your firewall: 1. 2. 3. 4. Install ADSL filters on the phone lines. Connect the router to the ADSL filter. Log in to the router. Connect to the Internet. Follow the steps below to connect your router to your network. Before you begin, locate the ADSL configuration information from your Internet Service Provider (ISP). 1. INSTALL ADSL FILTERS ON THE PHONE LINES. a. You need to install a filter on every telephone or device that shares the same phone number as your ADSL router. Select the filter that came with your router. One-Line Filter Phone Splitter Two-Line Filter With Splitter DSL Phone Figure 3-3: ADSL microfilters Note: If you purchased the DG834 in a country where the filter is not included, you must acquire one. b. Two-Line Filter Example. Insert the two-line filter into the phone outlet and connect the phone to the phone line connector (A): Connecting the Router to the Internet 202-10005-05, June 2005 Line 3-5 Reference Manual for the ADSL Firewall Router DG834 . Line Phone A Figure 3-4: Connecting an ADSL microfilter and phone Note: To use a one-line filter with a separate splitter, insert the splitter into the phone outlet, connect the one-line filter to the splitter, and connect the phone to the filter. 2. CONNECT THE DG834 TO THE ADSL FILTERS. Note: Improperly connecting a filter to your DG834 ADSL router will block your ADSL connection. a. Turn off your computer. b. Connect the ADSL port of the DG834 to the ADSL port (B) of the two-line filter: DSL Lin e DS L Phone B ADSL Firewall Router DG834 Figure 3-5: Connecting the DG834 ADSL router to an ADSL microfilter and phone 3-6 202-10005-05, June 2005 Connecting the Router to the Internet Reference Manual for the ADSL Firewall Router DG834 c. Connect the Ethernet cable (C) from your DG834's LAN port to the Ethernet adapter in your computer. Lin e DS L Phone C ADSL Firewall Router DG834 Figure 3-6: Connecting a computer to the DG834 ADSL router Note: The DG834 ADSL router incorporates Auto UplinkTM technology. Each Ethernet LAN port will automatically sense whether the cable plugged into the port should have a 'normal' connection (for example, connecting to a computer) or an 'uplink' connection (for example, connecting to a switch or hub). That port will then configure itself to the correct configuration. This feature also eliminates the need to worry about crossover cables, as Auto Uplink will accommodate either type of cable to make the right connection. d. Connect the power adapter to the router and plug it in to a power outlet. Verify the following: The power light is lit after turning on the router. The ADSL link light is solid green, indicating a link has been established to the ADSL network. e. Now, turn on your computer. If software usually logs you in to your Internet connection, do not run that software. Cancel it if it starts automatically. Verify the following: The local lights are lit for any connected computers. Connecting the Router to the Internet 202-10005-05, June 2005 3-7 Reference Manual for the ADSL Firewall Router DG834 3. LOG IN TO THE DG834. Note: Your computer needs to be configured for DHCP. For instructions on configuring for DHCP, please see Appendix C, "Preparing Your Network". a. Connect to the router by typing http://192.168.0.1 in the address field of Internet Explorer or Netscape® Navigator. Figure 3-7: Connect to the router A login window opens as shown below: Figure 3-8: Login window b. When prompted, enter admin for the user name and password for the password, both in lower case letters. After logging in, you will see the menu below. 3-8 202-10005-05, June 2005 Connecting the Router to the Internet Reference Manual for the ADSL Firewall Router DG834 Figure 3-9: Setup Wizard 4. CONNECT TO THE INTERNET The router is now properly attached to your network. You are now ready to configure your router to connect to the Internet. There are two ways you can configure your router to connect to the Internet: a. b. Let the DG834 auto-detect the type of Internet connection you have and configure it. See "Auto-Detecting Your Internet Connection Type" on page 3-9 for instructions. Manually choose which type of Internet connection you have and configure it. See "Manually Configuring Your Internet Connection" on page 3-14 for instructions. These options are described below. In either case, unless your ISP automatically assigns your configuration automatically via DHCP, you need the configuration parameters from your ISP you recorded in "Record Your Internet Connection Information" on page 3-3. Auto-Detecting Your Internet Connection Type The Web Configuration Manager built in to the router contains a Setup Wizard that can automatically determine your network connection type. 1. If your router has not yet been configured, the Setup Wizard shown in Figure 3-9 should launch automatically. Connecting the Router to the Internet 202-10005-05, June 2005 3-9 Reference Manual for the ADSL Firewall Router DG834 Note: If instead of the Setup Wizard menu, the main menu of the router's Configuration Manager as shown in Figure 3-15 appears, click the Setup Wizard link in the upper left to bring up this menu. 2. You must select a country and language. Language choices are English, French, German, and Italian. After you change the language, the remaining setup screens change to the language of your choice. Select Yes to allow the router to automatically determine your connection. Click Next. The Setup Wizard will now check for the following connection types: · · · · Dynamic IP assignment A login protocol such as PPPoE or PPPoA Classical IP over ATM (RFC1577) Fixed IP address assignment 3. 4. Next, the Setup Wizard will report which connection type it has discovered, and then display the appropriate configuration page. If the Setup Wizard finds no connection, you will be prompted to check the physical connection between your router and the ADSL line. When the connection is properly made, the router's Internet LED should be on. 5. The ADSL settings for the multiplexing method and VPI/VCI will update with the preset defaults. The multiplexing method preset default settings will usually work. Only change the multiplexing method if you are sure your ISP requires Virtual Path Identifier (VPI) or Virtual Channel Identifier (VCI) settings that are different from the default values. Incorrect VPI or VCI settings will prevent you from connecting to the Internet. To change these settings, click the ADSL Settings link on the main menu. See "ADSL Settings" on page 3-19 for more details. The procedures for filling in the configuration page for each type of connection follow below. Wizard-Detected PPPoE Login Account Setup If the Setup Wizard determines that your Internet service account uses a login protocol such as PPP over Ethernet (PPPoE), you will be directed to the PPPoE page shown in Figure 3-10: 3-10 202-10005-05, June 2005 Connecting the Router to the Internet Reference Manual for the ADSL Firewall Router DG834 Figure 3-10: Setup Wizard menu for PPPoE login accounts Enter the PPPoE login user name and password. Wizard-Detected PPPoA Login Account Setup If the Setup Wizard determines that your Internet service account uses a login protocol such as PPP over ATM (PPPoA), you will be directed to the PPPoA page shown in Figure 3-11 below: Figure 3-11: Setup Wizard menu for PPPoA login accounts Enter your login user name and password. These fields are case sensitive. Wizard-Detected Dynamic IP Account Setup If the Setup Wizard determines that your Internet service account uses Dynamic IP assignment, you will be directed to the page shown in Figure 3-12 below: Connecting the Router to the Internet 202-10005-05, June 2005 3-11 Reference Manual for the ADSL Firewall Router DG834 Figure 3-12: Setup Wizard menu for Dynamic IP address Click Apply to set Dynamic IP as the connection method. Wizard-Detected IP Over ATM Account Setup If the Setup Wizard determines that your Internet service account uses IP over ATM Classical IP assignment (RFC1577), you will be directed to the page shown in Figure 3-13 below: Figure 3-13: Setup Wizard menu for IP over ATM (Classical IP) address 1. Enter your assigned IP Address and Subnet Mask. This information should have been provided to you by your ISP. You need the configuration parameters from your ISP you recorded in "Record Your Internet Connection Information" on page 3-3. Enter the IP address of your ISP's Primary DNS Server. If a Secondary DNS Server address is available, enter it also. DNS servers are required to perform the function of translating an Internet name such as www.netgear.com to a numeric IP address. For a fixed IP address configuration, you must obtain DNS server addresses from your ISP and enter them manually here. 2. 3. Click Apply to save the settings. Connecting the Router to the Internet 202-10005-05, June 2005 3-12 Reference Manual for the ADSL Firewall Router DG834 4. Click the Test button to test your Internet connection. If the NETGEAR Web site does not appear within one minute, refer to Chapter 8, "Troubleshooting". Wizard-Detected Fixed IP (Static) Account Setup If the router determines that your Internet service account uses Fixed IP assignment, you will be directed to the page shown in Figure 3-14 below: Figure 3-14: Setup Wizard menu for Fixed IP address 1. 2. If required, enter the Account Name and Domain Name from your ISP. Choose "Use Static IP Address" or "Use IP Over ATM" (IPoA -- RFC1483 Routed) according to the information from your ISP. If you choose IPoA, the router will be able to detect the gateway IP address but you still need to provide the router IP address. Enter your assigned IP Address, Subnet Mask, and the IP Address of your ISP's gateway router. This information should have been provided to you by your ISP. You need the configuration parameters from your ISP you recorded in "Record Your Internet Connection Information" on page 3-3. Enter the IP address of your ISP's Primary DNS Server. If a Secondary DNS Server address is available, enter it also. 3. 4. Connecting the Router to the Internet 202-10005-05, June 2005 3-13 Reference Manual for the ADSL Firewall Router DG834 DNS servers are required to perform the function of translating an Internet name such as www.netgear.com to a numeric IP address. For a fixed IP address configuration, you must obtain DNS server addresses from your ISP and enter them manually here. 5. 6. Click Apply to save the settings. Click the Test button to test your Internet connection. If the NETGEAR Web site does not appear within one minute, refer to Chapter 8, "Troubleshooting". Testing Your Internet Connection After completing the Internet connection configuration, your can test your Internet connection. Log in to the router, then, from the Basic Settings link in the Setup menu, click the Test button. If the NETGEAR Web site does not appear within one minute, refer to Chapter 8, "Troubleshooting". Your router is now configured to provide Internet access for your network. Your router automatically connects to the Internet when one of your computers requires access. It is not necessary to run a dialer or login application such as Dial-Up Networking or Enternet to connect, log in, or disconnect. These functions are performed by the router as needed. To access the Internet from any computer connected to your router, launch a browser such as Microsoft Internet Explorer or Netscape Navigator. You should see the router's Internet LED blink, indicating communication to the ISP. The browser should begin to display a Web page. The following chapters describe how to configure the Advanced features of your router, and how to troubleshoot problems that may occur. Manually Configuring Your Internet Connection You can manually configure your router using the menu below, or you can allow the Setup Wizard to determine your configuration as described in the previous section. 3-14 202-10005-05, June 2005 Connecting the Router to the Internet Reference Manual for the ADSL Firewall Router DG834 ISP Does Not Require Login ISP Does Require Login Figure 3-15: Basic Settings menu How to Perform Manual Configuration We recommend that you start the manual configuration from the Setup Wizard: 1. Select your country and language. Language choices are English, French, German, and Italian. After you change the language, the remaining setup screens change to the language of your choice. Select No to manually configure your router connection. Click Next. Manually configure the router in the Basic Settings menu shown in Figure 3-15. Follow the instructions below according to the encapsulation method and whether your Internet connection requires a login. The following methods are available: · · Internet Connection Requires Login and Uses PPPoE Internet Connection Requires Login and Uses PPPoA 3-15 202-10005-05, June 2005 2. 3. 4. 5. Connecting the Router to the Internet Reference Manual for the ADSL Firewall Router DG834 · 6. Internet Connection Does Not Require a Login Usually the default ADSL Settings work fine for most ISPs and you can skip this step. If you have any problems with your connection, check the ADSL Settings. See "ADSL Settings" on page 3-19 for more details. Internet Connection Requires Login and Uses PPPoE 1. If your Internet connection does require login, select Yes and fill in the settings according to the instructions below. Note: You will no longer need to launch the ISP's login program on your computer in order to access the Internet. When you start an Internet application, your router automatically logs you in. 2. 3. 4. Choose PPPoE for the encapsulation method. Enter the login name (frequently the email address your ISP provided), password, and service name (if required). If you want to change the login timeout, enter a new value in minutes. This determines how long the router keeps the Internet connection active after there is no Internet activity from the LAN. Entering an Idle Timeout value of zero means never log out. When a connection uses PPPoE, the IP address is normally assigned automatically. However, the DG834 allows this address to be set manually. · · Select "Get Automatically from ISP" if your ISP assigns your IP address. Select "Use Static IP Address" if your ISP gives you a statically assigned address. 5. 6. The DNS server is used to look up site addresses based on their names. · · Select "Get Automatically from ISP" if your ISP uses DHCP to assign your DNS servers. Your ISP will automatically assign this address. Select "Use These DNS Servers" if your ISP gave you one or two DNS addresses. Type the primary and secondary addresses. 7. You should only disable NAT if you are sure you do not require it. NAT automatically assigns private IP addresses (192.168.0.x) to LAN connected devices. When NAT is disabled, only standard routing is performed by this router. Classical routing lets you directly manage the IP addresses the DG834 uses. Classical routing should be selected only by experienced users. 3-16 202-10005-05, June 2005 Connecting the Router to the Internet Reference Manual for the ADSL Firewall Router DG834 Note: Disabling NAT will reboot the router and reset all the DG834 configuration settings to the factory default. Disable NAT only if you plan to install the DG834 in a setting where you will be manually administering the IP address space on the LAN side of the router. Internet Connection Requires Login and Uses PPPoA 1. If your Internet connection does require login, select Yes and fill in the settings according to the instructions below. Note: You will no longer need to launch the ISP's login program on your computer in order to access the Internet. When you start an Internet application, your router automatically logs you in. 2. 3. 4. Choose PPPoA for the encapsulation method. Enter the login name (frequently the email address your ISP provided), and password. If you want to change the login timeout, enter a new value in minutes. This determines how long the router keeps the Internet connection active after there is no Internet activity from the LAN. Entering an Idle Timeout value of zero means never log out. When a connection uses PPPoA, the IP address is normally assigned automatically. However, the DG834 allows this address to be set manually. · · Select "Get Automatically from ISP" if your ISP assigns your IP address. Select "Use Static IP Address" if your ISP gives you a statically assigned address. 5. 6. The DNS server is used to look up site addresses based on their names. · Select "Get Automatically from ISP" if your ISP uses DHCP to assign your DNS servers. Your ISP will automatically assign this address. 7. Select "Use These DNS Servers" if your ISP gave you one or two DNS addresses. Type the primary and secondary addresses.You should only disable NAT if you are sure you do not require it. NAT automatically assigns private IP addresses (192.168.0.x) to LAN connected devices. When NAT is disabled, only standard routing is performed by this router. Classical routing lets you directly manage the IP addresses the DG834 uses. Classical routing should be selected only by experienced users. Note: Disabling NAT will reboot the router and reset all the DG834 configuration settings to the factory default. Disable NAT only if you plan to install the DG834 in a setting where you will be manually administering the IP address space on the LAN side of the router. Connecting the Router to the Internet 202-10005-05, June 2005 3-17 Reference Manual for the ADSL Firewall Router DG834 Internet Connection Does Note Require A Login 1. 2. 3. If your Internet connection does not require a login, select No and fill in the settings according to the instructions below. Enter your Account Name (may also be called Host Name) and Domain Name. These parameters may be necessary to access your ISP's mail or news servers. Internet IP Address: · · Select "Get Dynamically from ISP" if your ISP uses DHCP to assign your IP address. Your ISP will automatically assign these addresses. Select "Use Static IP Address" if your ISP has assigned you a permanent, fixed (static) IP address. Enter the IP address that your ISP assigned. Also enter the IP Subnet Mask and the Gateway IP Address. The gateway is the ISP's router to which your router will connect. Select "IP Over ATM (IPoA)" if your ISP uses Classical IP Addresses (RFC1577). Enter the IP address, IP Subnet Mask, and Gateway IP Addresses that your ISP assigned. · 4. Domain Name Server (DNS) Address: · · Select "Get Dynamically from ISP" if your ISP uses DHCP to assign your IP address. Your ISP will automatically assign this address. If you know that your ISP does not automatically transmit DNS addresses to the router during login, select "Use these DNS servers" and enter the IP address of your ISP's Primary DNS Server. If a Secondary DNS Server address is available, enter it also. A DNS server is a host on the Internet that translates Internet names (such as www.netgear.com) to numeric IP addresses. Typically your ISP transfers the IP address of one or two DNS servers to your router during login. If the ISP does not transfer an address, you must obtain it from the ISP and enter it manually here. 5. You should only disable NAT if you are sure you do not require it. NAT automatically assigns private IP addresses (192.168.0.x) to LAN connected devices. When NAT is disabled, only standard routing is performed by this router. Classical routing lets you directly manage the IP addresses the DG834 uses. Classical routing should be selected only by experienced users. Note: Disabling NAT will reboot the router and reset all the DG834 configuration settings to the factory default. Disable NAT only if you plan to install the DG834 in a setting where you will be manually administering the IP address space on the LAN side of the router 3-18 202-10005-05, June 2005 Connecting the Router to the Internet Reference Manual for the ADSL Firewall Router DG834 6. Router MAC Address: This section determines the Ethernet MAC address that will be used by the router on the Internet port. Some ISPs will register the Ethernet MAC address of the network interface card in your computer when your account is first opened. They will then only accept traffic from the MAC address of that computer. This feature allows your router to masquerade as that computer by "cloning" its MAC address. To change the MAC address, select "Use this Computer's MAC address". The router will then capture and use the MAC address of the computer that you are now using. You must be using the one computer that is allowed by the ISP. Alternatively, select "Use this MAC address" and enter it. 7. 8. Click Apply to save your settings. Click the Test button to test your Internet connection. If the NETGEAR Web site does not appear within one minute, refer to Chapter 8, "Troubleshooting". ADSL Settings The default settings of your DG834 ADSL Firewall Router will work fine for most ISPs. However, some ISPs use a specific Multiplexing Method and Virtual Circuit Number for the Virtual Path Identifier (VPI) and Virtual Channel Identifier (VCI). Note: The correct country must be selected from the Setup Wizard's first page for the default ADSL Settings to work. If your ISP provided you with a specific Multiplexing Method or VPI/VCI number, then fill in the following: 1. 2. 3. 4. 5. Select the ADSL Settings link from the main menu. For the Multiplexing Method, select LLC-based or VC-based. Type a number between 0 and 255 for the VPI. The default is 8. Type a number between 1 and 65535 for the VCI. The default is 35. Click Apply. Connecting the Router to the Internet 202-10005-05, June 2005 3-19 Reference Manual for the ADSL Firewall Router DG834 3-20 202-10005-05, June 2005 Connecting the Router to the Internet Chapter 4 Protecting Your Network This chapter describes how to use the basic firewall features of the DG834 ADSL Firewall Router to protect your network. Protecting Access to Your DG834 ADSL Firewall Router For security reasons, the router has its own user name and password. Also, after a period of inactivity for a set length of time, the administrator login will automatically disconnect. When prompted, enter admin for the router User Name and password for the router Password. You can use procedures below to change the router's password and the amount of time for the administrator's login timeout. Note: The user name and password are not the same as any user name or password your may use to log in to your Internet connection. NETGEAR recommends that you change this password to a more secure password. The ideal password should contain no dictionary words from any language, and should be a mixture of both upper and lower case letters, numbers, and symbols. Your password can be up to 30 characters. How to Change the Built-In Password 1. Log in to the router at its default LAN address of http://192.168.0.1 with its default User Name of admin, default password of password, or using whatever Password and LAN address you have chosen for the router. Figure 4-1: Log in to the router 2. From the Main Menu of the browser interface, under the Maintenance heading, select Set Password to bring up the menu shown in Figure 4-2. Protecting Your Network 202-10005-05, June 2005 4-1 Reference Manual for the ADSL Firewall Router DG834 Figure 4-2: Set Password menu 3. 4. To change the password, first enter the old password, and then enter the new password twice. Click Apply to save your changes. Note: After changing the password, you will be required to log in again to continue the configuration. If you have backed up the router settings previously, you should do a new backup so that the saved settings file includes the new password. Changing the Administrator Login Timeout For security, the administrator's login to the router configuration will timeout after a period of inactivity. To change the login timeout period: 1. 2. In the Set Password menu, type a number in `Administrator login times out' field. The suggested default value is 5 minutes. Click Apply to save your changes or click Cancel to keep the current period. Configuring Basic Firewall Services Basic firewall services you can configure include access blocking and scheduling of firewall security. These topics are presented below. 4-2 202-10005-05, June 2005 Protecting Your Network Reference Manual for the ADSL Firewall Router DG834 Blocking Keywords, Sites, and Services The router provides a variety of options for blocking Internet based content and communications services. With its content filtering feature, the DG834 ADSL router prevents objectionable content from reaching your PCs. The router allows you to control access to Internet content by screening for keywords within Web addresses. Key content filtering options include: · · · · Keyword blocking of HTTP traffic. Outbound Service Blocking limits access from your LAN to Internet locations or services that you specify as off-limits. Denial of Service (DoS) protection. Automatically detects and thwarts Denial of Service (DoS) attacks such as Ping of Death, SYN Flood, LAND Attack and IP Spoofing. Blocking unwanted traffic from the Internet to your LAN. The section below explains how to configure your router to perform these functions. How to Block Keywords and Sites The DG834 ADSL router allows you to restrict access to Internet content based on functions such as Web addresses and Web address keywords. 1. Log in to the router at its default LAN address of http://192.168.0.1 with its default User Name of admin, default password of password, or using whatever Password and LAN address you have chosen for the router. Select the Block Sites link of the Security menu. 2. Protecting Your Network 202-10005-05, June 2005 4-3 Reference Manual for the ADSL Firewall Router DG834 Figure 4-3: Block Sites menu 3. To enable keyword blocking, select one of the following: · · Per Schedule--to turn on keyword blocking according to the settings on the Schedule page. Always--to turn on keyword blocking all of the time, independent of the Schedule page. Enter a keyword or domain in the Keyword box, click Add Keyword, then click Apply. Some examples of Keyword application follow: · If the keyword "XXX" is specified, the URL is blocked. · If the keyword ".com" is specified, only Web sites with other domain suffixes (such as .edu or .gov) can be viewed. · Enter the keyword "." to block all Internet browsing access. Up to 32 entries are supported in the Keyword list. 5. To delete a keyword or domain, select it from the list, click Delete Keyword, then click Apply. 6. To specify a trusted user, enter that computer's IP address in the Trusted IP Address box and click Apply. You can specify one trusted user, which is a computer that will be exempt from blocking and logging. Since the trusted user will be identified by an IP address, you should configure that computer with a fixed IP address. 4. 4-4 202-10005-05, June 2005 Protecting Your Network Reference Manual for the ADSL Firewall Router DG834 7. Click Apply to save your settings. Firewall Rules Firewall rules are used to block or allow specific traffic passing through from one side of the router to the other. Inbound rules (WAN to LAN) restrict access by outsiders to private resources, selectively allowing only specific outside users to access specific resources. Outbound rules (LAN to WAN) determine what outside resources local users can have access to. A firewall has two default rules, one for inbound traffic and one for outbound. The default rules of the DG834 are: · Inbound: Block all access from outside except responses to requests from the LAN side. · Outbound: Allow all access from the LAN side to the outside. You can define additional rules that will specify exceptions to the default rules. By adding custom rules, you can block or allow access based on the service or application, source or destination IP addresses, and time of day. You can also choose to log traffic that matches or does not match the rule you have defined. You can change the order of precedence of rules so that the rule that applies most often will take effect first. See "Order of Precedence for Rules" on page 4-11 for more details. To access the rules configuration of the DG834, click the Firewall Rules link on the main menu, then click Add for either an Outbound or Inbound Service. Figure 4-4: Rules menu Protecting Your Network 202-10005-05, June 2005 4-5 Reference Manual for the ADSL Firewall Router DG834