D-Link DFL-600 User manual

D-Link DFL-600
Firewall/VPN
Manual
Rev. 4.0
Building Networks for People

Table of Contents
Introduction......................................................... 4
IP Address Settings and Computer Settings ...... 8
Introduction and Overview.................................. 9
Using the Configuration Utility ............................ 12
Setup Wizard ...................................................... 14
Home .................................................................. 20
WAN Settings ..................................................... 21
LAN Settings....................................................... 27
DHCP Settings ................................................... 29
NAT..................................................................... 33
DMZ.................................................................... 34
Advanced Settings.............................................. 49
Connecting PCs to the DFL-600 Router............. 111
Networking Basics .............................................. 114
Contacting Technical Support............................. 128
Limited Warranty and Registration ..................... 129

Package Contents
Contents of Package:
• D-Link DFL-600 Firewall/VPN Router
• Manual
• Quick Installation Guide
• Power Adapter, 5V DC, 2.5A*
• CAT-5 UTP Cable
If any of the above items are missing, please contact your reseller.
*Using a power supply with a different voltage rating will damage the
product and void the warranty.
System Requirements:
Internet Explorer 5.5 or higher or Netscape Navigator 7.1 or higher, with JavaScript
enabled.
One computer with an installed 10Mbps, 100Mbps or 10/100 Mbps Ethernet
adapter.
One RJ-45 DSL/Cable Modem for Internet connection.

Introduction
The D-Link DFL-600 VPN Router enables your network to connect to the
Internet via a secure, private connection using a Cable or DSL modem. The
Virtual Private Network (VPN) that is created on the Internet between your
home and a VPN server in your office is secure from interference when you
use the DFL-600.
It is an ideal way to connect your computer to a Local Area Network (LAN).
After completing the steps outlined in the Quick Install Guide (included in
your package) you will have the ability to share information and resources,
such as files and printers, and take full advantage of a secure “connected”
environment.
Connect the WAN port on the DFL-600 to the Ethernet port on your
Cable/DSL modem using an Ethernet cable. Your entire LAN can now
access the Internet using just one Internet account. The DFL-600 has 3 LAN
ports, one DMZ port, and one WAN port. That means that 3 computers can
share the benefits of the DFL-600-equipped network and 1 computer can be
configured as a server for Internet applications that may conflict with the
advanced protection from intrusion offered by your new DFL-600.
For the price of one Internet account, the DHCP-capable DFL-600 will
automatically provide unique IP Addresses for all the computers on the
network. (DHCP stands for Dynamic Host Configuration Protocol. It is a
protocol for assigning IP Addresses automatically. With a DHCP router like
the DFL-600, there is no need to assign static IP Addresses, or purchase
multiple addresses from your Internet Service Provider.)
Everyone in your home can access the Internet on his or her own computer, at
the same time, without any noticeable decrease in speed and with Firewall
Protection, Hacker-attack logging, and Virtual Private Networking, the DFL-
600 provides a level of security suitable for many businesses.
This manual provides a quick introduction to network technology. Please
take a moment to read through this manual and get acquainted with your
DFL-600.

Front View
LED Indicators
WAN
Link/Act.
(Green) Green LED will LIGHT when a good link is
established. Green LED will BLINK when packet is
transmitting or receiving (Act.).
WAN 10/100 (Green) Green LED will LIGHT when a 100 Mbps Link is
established. Green LED will NOT LIGHT when a
10 Mbps Link is established.
DMZ
Link/Act.
(Green) Green LED will LIGHT when a good link is
established. Green LED will BLINK when packet is
transmitting or receiving (Act.).
DMZ 10/100 (Green) Green LED will LIGHT when a 100 Mbps Link is
established. Green LED will NOT LIGHT when a
10 Mbps Link is established.
LAN (1-3)
Link/Act.
(Green) Green LED will LIGHT when link is established
(Link). Green LED will BLINK when packet is
transmitting or receiving (Act.).
LAN (1-3)
10/100
(Green) Green LED will LIGHT when a 100 Mbps Link is
established. Green LED will NOT LIGHT when a
10 Mbps Link is established.
Power (Green) Green LED will LIGHT when powered ON.

Rearview
Power (5V
2.5A DC)
Connects the DC power adapter to the Power port
WAN Connects DSL/Cable modem to the WAN Ethernet port
Ports 1-3 Connect networked devices such as computers and ftp
servers to the three LAN ports. All LAN ports support
auto crossover.
DMZ Connects a networked device to the DMZ zone of the
Firewall/VPN Router. The DMZ feature can be disabled.
Reset To reload the factory default settings, press the reset
button. Pressing the Reset button will clear the current
configuration as reset the DFL-600 to the factory default
settings.
Product Features
VPN
Provides Virtual Private Networking when communicating with a VPN server-
equipped office, or with another DFL-600-equipped network. Supports IPSEC,
PPTP, L2TP, and VPN pass through.
DSL/Cable Modem support
The DFL-600 can connect any Cable or DSL modem to the network.
DHCP
The DFL-600 is a DHCP-capable router. It automatically assigns unique IP
Addresses to each network users that is connected to the DFL-600, for the price of
one Internet account.

Firewall Protection
Supports general hacker attack pattern monitoring and logging.
PPPoE Client
Supports PPPoE client function to connect to a remote PPPoE server.
Virtual Server
Allows the internal server to be accessible from the Internet
Upgradeable New Features
Allows new features to be added in the future
High Performance 64 bit RISC CPU Engine
With the most advanced 64 bit RISC CPU Engine, DFL-600 guarantees full
compatibility with future DSL/Cable technologies.
IPSec Security
(DES, 3DES, MD5, SHA-1)
Idle Timer
Set a specified idle-time before automatically disconnecting
Dial-on Demand
Eliminates the need for Dial-up. Automatically logs in to your ISP.
Web-Based Configuration
No software installation required. Can be configured through a web browser making
it OS independent.

IP Address Settings and Computer Settings
In order to install the DFL-600 you will need to check your computer’s
settings and the values from your ISP.
The information offered by your ISP:
• Dynamic IP settings
• Your fixed IP address for the gateway
• Your subnet mask for the gateway
• Your default gateway IP address
• Your DNS IP address
If you would like to use PPPoE, you will need the following values from your
ISP in order to install your router:
• User Name
• Password
The static IP settings for the PC:
• Your PC’s fixed IP address
• Your PC’s subnet mask
• Your PC’s default gateway
• Your PC’s primary DNS IP address
Note: The router’s default IP address setting is 192.168.0.1, with a subnet
mask of 255.255.255.0.
Dynamic IP Settings:
It is recommended that you allow your PC’s IP settings be automatically assigned by
a DHCP server. By default, your new DFL-600 VPN Firewall functions as a DHCP
server, and it will give your PC the necessary IP settings, every time you boot your
PC.

Introduction and Overview
The DFL-600 Firewall/VPN Router creates two separate networks on the
LAN side of your network −by default, a 192.168.0.0 subnet and a
192.168.1.0 subnet (both with a subnet mask of 255.255.255.0). The DFL-
600 routes packets between these two subnets and the Internet (or the
network connected to the DFL-600’s WAN port). An Internet Service
Provider (ISP) or a network administrator provides the network address
information on the WAN network.
The 192.168.0.0 network
− LAN. The three Ethernet ports labeled −Local
Area Network on the front panel, and 1, 2, and 3 on the rear panel −are, by
default, assigned the IP address range between 192.168.0.2 to 192.168.0.254.
So computers and other devices connected to these three ports either allow
the DFL-600’s DHCP server to assign them IP addresses from this range, or
you can manually assign devices connected to these ports an IP address from
this range. Remember that the IP address, 192.168.0.0, is reserved. The
DFL-600 is assigned 192.168.0.1 −on the LAN side −and is configured
from a computer (again, on the LAN side of your network) using a web
browser. To connect to the DFL-600’s web-based management utility, type
the IP address https://192.168.0.1 into the Address field of your web browser.
The https specifies the secure version of http.
The 192.168.1.0 network
− DMZ. The port labeled −DMZ on both the front
and rear panel −is, by default, assigned the IP address range between
192.168.1.2 to 192.168.1.254 −with a subnet mask of 255.255.255.0. So
computers and other devices connected to this port must be assigned IP
addresses from this range. The DHCP server on the DFL-600 only services
the LAN ports, so you must manually assign a computer connected to the
DMZ port an IP address from this range.
You can use this default IP addressing scheme, or you can configure your
own. It is important to note that the three LAN ports and the DMZ port must
be on different subnets (different ranges of IP addresses) and that the
computers that are connected to these ports must have IP addresses in the
appropriate range.

The DMZ port is used to allow computers and devices connected to this port
to have more direct access to the Internet. This is useful for certain
applications that may conflict with the firewall and Network Address
Translation (NAT) features of the DFL-600. Computers and devices
connected to the DMZ port will not have the level of protection that the LAN
ports can provide, however. It is recommended that computers and devices
connected to the DFL-600’s DMZ port have some type of firewall software
installed and running to provide these devices with at least some level of
protection from unwanted intrusions from the Internet.
The Wide Area Network (WAN) side of the DFL-600 is anything connected
to the WAN port. This is normally an Ethernet connection to a Cable or DSL
modem that, in turn, provides a connection to the Internet. There are three
different methods for your ISP to provide the necessary network address
information to your DFL-600.
It can be useful when configuring your DFL-600 Firewall/VPN Router to
think of the LAN side (all computers or devices connected to the three LAN
ports or the DMZ port) and the WAN side (all computers or devices
connected to the WAN port – the Internet). The WAN side of the router is
connected to some device that ultimately allows a connection to the Internet,
while the LAN side is connected to your computers or other network devices
(such as a switch or hub) that ultimately allows users access to the both the
Internet and any other devices on your LAN (such as a printer or scanner).
The network information (including the IP address) required by the WAN
side of the DFL-600 is either obtained automatically from your ISP (or other
network device on the WAN side) or is entered manually. The DFL-600
allows three methods for this information to be obtained, as follows:
Dynamic −your ISP uses the Dynamic Host Configuration Protocol (DHCP)
to provide the network information. Some ISP’s may require you to enter an
assigned Host Name, as well.
Static IP Address −your ISP assigns you an IP address that never changes.
This is more common in businesses that lease dedicated connections. If your
ISP uses this type of connection, you must manually enter the assigned IP