D-Link DFL-80 User manual

Manual
Building Networks for People
D-Link DFL-80
Ethernet VPN Firewall

2
Contents
PackageContents ................................................................................3
Introduction............................................................................................4
SoftwareManagement ..........................................................................6
Troubleshooting.................................................................................134
TechnicalSpecifications ....................................................................142
ContactingTechnicalSupport ............................................................144
WarrantyandRegistration .................................................................145

3
Contents of Package:
D-Link DFL-80 Firewall
Manual and Warranty on CD
QuickInstallationGuide
Package Contents
If any of the above items are missing, please contact your reseller.
System Requirements:
Internet Explorer or Netscape Navigator version 6.0 or above,
with JavaScript enabled
A computer with Windows, Macintosh, or Linux-based
operating system with an installed Ethernet adapter
AC power adapter (5V, 3A)
Note: Usingapowersupplywithadifferentvoltageratingthantheoneincludedwith
theDFL-80willcausedamageandvoidthewarrantyfor this product.

4
Introduction
The DFL-80 provides six 10/100Mbit Ethernet network interface ports which
are (4) Internal/LAN, (1) External/WAN, and (1) DMZ port. It also provides an
easilyoperatedsoftware WebUI whichallowsusers to set systemparameters
or monitor network activities using a web browser.
DFL-80 security feature
Somefunctionsthat areavailablein thefirewallare:PacketFilter,ProxyServer,
IntruderAlarm, Packet Monitor Log, Inbound/Outbound Policy, etc.
DFL-80 installation
This product is a hardware firewall. Therefore the installation is much easier
than a software firewall. First the user has to prepare four network cables,
and connect them to the internal, external and DMZ connectors respectively.
TheLANinterfaceshastoconnecttotheinternalnetwork.Theexternalinterface
has to connect with an external router, DSL modem, or Cable modem. The
DMZ interface connects to an independent HUB/Switch for the DMZ network.
DFL-80 function setting
The DFL-80 Firewall has a built-in WEBUI (Web User Interface). All
configurationsandmanagementare donethroughtheWEBUIusinganInternet
web browser.
DFL-80 monitoring function
The firewall provides monitoring functions which contains traffic log, event
log, traffic alarm, event alarm, and traffic statistics. Traffic alarm records the
packets of intruder invasions. Not only does the firewall log these attacks, it
can be set up to send E-mail alerts to the Administrator automatically for
immediate intruder’s invasion crisis management.
DFL-80 supporting protocols
The DFL-80 supports all the TCP, UDP and ICMP protocols, such as HTTP,
TELNET, SMTP, POP3, FTP, DNS, PING, etc. System Administrators can
set up proprietary protocols according to operating requirements.

5
DMZ Port: Use this port to connect to the company’s server(s), which
needs direct connection to the Internet (FTP, SNMP, HTTP, DNS).
External Port (WAN): Use this port to connect to the external router, DSL
modem, or Cable modem.
Internal Ports (LAN): Use this port to connect to the internal network of
the office.
Reset: Reset the DFL-80 to the original default settings.
DC Power: connect one end of the power supply to this port, the other end
to the electrical wall outlet.
Hardware Description

6
Software Management
DFL-80 management tool: Web User Interface
The main menu functions are located on the left-hand side of the screen, and
the display window will be on the right-hand side. The main functions include
12items, which are: Administrator,Configuration,Address,Service, Schedule,
Policy, VPN, Virtual Server, Log, Alarm, Statistics, and Status.

7
LoggingIn
Connect theAdministrator’sPCtothe Internal(LAN)port oftheDFL-80 Firewall.
Makesure there isa linklight for theconnection. TheDFL-80has anembedded
web server used for management and configuration. Use a web browser to
display the configurations of the firewall (such as Internet Explorer 6(or above)
or Netscape 6(or above) with full java script support). The default IP address of
the firewall is 192.168.1.1 witha subnet mask of255.255.255.0. Therefore, the
IP address of theAdministrator PC must be in the range between 192.168.1.2
/24–192.168.1.254/24.
If the company’s internal IP Address is not in the subnet of 192.168.1.0, (i.e.
Internal IPAddress is 172.16.0.1) theAdministrator must change his/her PC IP
address to be within the same range of the internal subnet (i.e. 192.168.1.2).
Reboot the PC if necessary.
By default, the DFL-80 Firewall is shipped with its DHCP Server function
enabled.Thismeanstheclientcomputerson theinternal (LAN)networkincluding
theAdministrator PC cansettheirTCP/IPsettings to automaticallyobtain anIP
address from the DFL-80.
The following table is a list of private IP addresses. These addresses may
not be used as an External IP address.
Once the Administrator PC has an IP address on the same network as the
DFL-80, open up an Internet web browser and type in http://192.168.1.1 in the
address bar.
A pop-up screen will appear and prompt for a username and password. A
username and password are required in order to connect to the Firewall. Enter
the default login username and password of the Administrator (see below).
10.0.0.0~ 10.255.255.255
172.16.0.0~ 172.31.255.255
192.168.0.0~ 192.168.255.255
Username: admin
Password:
admin

8
Administration
TheDFL-80 FirewallAdministrationandmonitoringcontrol is setby the System
Administrator. The System Administrator can add or modify System settings
and monitoring mode. The sub Administrators can only read System settings
but not modify them. In Administration, the SystemAdministrator can:
(1) Add and change the sub Administrator’s names and passwords;
(2) Back up all Firewall settings into local files.
(3) Set up alerts for intruder invasions.
What isAdministration?
“Administration” is the managing of settings such as the privileges of packets
that pass through the firewall and monitoring controls. Administrators may
manage, monitor, and configure firewall settings. All configurations are “read-
only” for all users other than the Administrator; those users are not able to
change any settings for the firewall.
The three sub functions under Administrator are Wizard, Admin, Setting,
Date/Time, and Software Update.
Wizard: Includes a setup wizard to configure the Firewall quickly for Internet
access. Refer to the Quick Installion Guide to use the wizard.
Admin: has control of user access to the firewall. He/she can add/remove
users and change passwords.
Setting: The Administrator may use this function to backup firewall
configurations and export (save) them to an “Administrator” computer or
anywhereon thenetwork;or restorea configurationfile totheDFL-80;orrestore
the firewall back to default factory settings. Under Setting, the Administrator
mayenable e-mailalert notification.This willalertAdministrator(s)automatically
whenever the firewall has experienced unauthorized access or a network hit
(intrusion or flooding). Once enabled, an IP address of a SMTP(Simple Mail
Transfer Protocol)serverisrequired. Uptotwoe-mail addressescanbe entered
for the alert notifications.
Date/Time: This function enables the Firewall to be synchronized either with
an Internet Time Server or with the client computer’s clock.
Software Update: Administratorsmayvisit http://support.dlink.comtodownload
the latest firmware. Administrators may update the DFL-80 firmware to
maximize its performance and stay current with the latest fixes for intruding
attacks.

9
Administration (continued)
FirewallAdministration setup
On the left hand menu, click on Administration, and then select Admin below
it. The current list of Administrator(s) shows up.
Settings of theAdministration table:
Administrator Name: The username of Administrators for the firewall. The
user admin cannot be removed.
Privilege: The privileges of Administrators (Admin or Sub Admin)
The username of the mainAdministrator is Admin with read/write privilege.
SubAdmins may be created by the Admin by clicking New Sub Admin. Sub
Admins have read only privilege.
Configure: ClickModify tochange theSubAdministrator’spasswordand click
Remove to delete a SubAdministrator.

10
Adding a new Sub Administrator:
Step 1. In the Administration window, click the New Sub Admin button
to create a new Sub Administrator.
Step 2. In the Add New SubAdministrator window:
!Sub Admin Name: Enter the username of new Sub Admin.
!Password: Enter a password for the new Sub Admin.
!Confirm Password: Enter the password again.
Step 3. Click OK to add the user or click Cancel to cancel the addition.
Administration (continued)

11
Administration (continued)
Changing the Sub-Administrator’s Password:
Step 1. In the Administration window, locate the Administrator name you
want to edit, and click on Modify in the Configure field.
Step 2. The Modify Administrator Password window will appear. Enter in
the required information:
Password: enter original password.
New Password: enter new password
Confirm Password: enter the new password again.
Step 3. Click OK to confirm password change or click Cancel to cancel it.
Removing a Sub Administrator:
Step 1. In theAdministration table, locate the Administrator name you want
to edit, and click on the Remove option in the Configure field.
Step 2. The Remove confirmation pop-up box will appear.
Step 3. Click OK to remove that Sub Admin or click Cancel to cancel.
!
!
!

12
Settings
The Administrator may use this function to backup firewall configurations and
export (save) them to an “Administrator” computer or anywhere on the
network; or restore a configuration file to the device; or restore the firewall
back to default factory settings.
Entering the Settings window:
Click Setting in the Administrator menu to enter the Settings window. The
Firewall Configuration settings will be shown on the screen.

13
Exporting DFL-80 Firewall settings:
Step 1. Under Firewall Configuration, click on the Download button next
to Export System Settings to Client.
Step 2. When the File Download pop-up window appears, choose the
destinationplaceinwhichtosavetheexportedfile. The Administrator
may choose to rename the file if preferred.
Importing Firewall settings:
Step 1. Under Firewall Configuration, click on the Browse button next to
Import System Settings. When the Choose File pop-up window
appears, select the file to which contains the saved firewall settings,
then click OK.
Step 2. Click OK to import the file into the Firewall or click Cancel to cancel
importing.

14
Restoring Factory Default Settings:
Step 1. Select Reset Factory Settings under Firewall Configuration.
Step 2. Click OK at the bottom-right of the screen to restore the factory
settings.
Enabling E-mailAlert Notification:
Step 1. Select Enable E-mail Alert Notification under E-Mail Settings.
This function will enable the Firewall to send e-mail alerts to the
System Administrator when the network is being attacked by
intruders or when emergency conditions occur.
Step 2. SMTP Server IP: Enter SMTP server’s IP address.
Step 3. E-Mail Address 1: Enter the first e-mail address to receive the
alarm notification.
Step 4. E-Mail Address 2: Enter the second e-mail address to receive the
alarm notification. (Optional)
Step 5. Click OK on the bottom-right of the screen to enable E-mail alert
notification.

15
To-Firewall Packets Log
Once this function is enabled, every packet passing through the Firewall will
be recorded for the administrator to trace.
Firewall Reboot
Once this function is enabled, the firewall will be reboot.
Step 1. Click Setting in the Administration menu to enter the settings
window.
Step 2. To reboot the Firewall, Click Reboot.
Step 3. Aconfirmation pop-up box will appear.
Step 4. Follow the confirmation pop-up box, click OK to restart firewall or
click Cancel to discard.

16
Date/Time
Admins can configure the Firewall’s date and time by either syncing to an
Internet Network Time Server (NTP) or by syncing to your computer’s clock.
Follow these steps to sync to an Internet Time Server.
Step 1. Enable synchronization by checking the box.
Step 2. Click the down arrow to select the offset time from GMT.
Step 3. Enter the Server IPAddress or Server name with which you want to
synchronize.
Step 4. Update system clock every 5 minutes You can set the interval
time to synchronize with outside servers. If you set it to 0, it means
the device will not synchronize automatically.
Follow this step to sync to your computer’s clock.
Step 1. Click on the Sync button.
Click the OK button below to apply the setting or click Cancel to discard
changes.

17
Software Update
Under Software Update, the admin may update the DFL-80’s software with
a newer software. The admin can visit http://support.dlink.com to get an
availableupdatedsoftware.
Configuration
System Configuration
In this section, the Administrator can:
(1) Set up the internal, external and DMZ IP addresses
(2) Set up the Multiple NAT
(3) Set up the Firewall detecting functions
(4) Set up a static route
(5) Set up the DHCP Server
(6) Set up DNS Proxy
(7) Set up Dynamic DNS
Note: After all the settings of the Firewall configuration have been set, the
Administrator can backup the System configuration into the local hard drive
as shown in the Administrator section of this manual.

18
Interface
In this section, the Administrator can set up the IP addresses for home or
office network. The Administrator may configure the IP addresses of the
Internal (LAN) network, the External (WAN) network, and the DMZ network.
The netmask and gateway IP addresses are also configured in this section.
Entering the Interface menu:
Click on Configuration in the left menu bar. Then click on Interface below
it. The current settings of the interface addresses will appear on the screen.
Configuring the Interface Settings:
Internal Interface
Using the Internal Interface, the Administrator sets up the Internal (LAN)
network. The Internal network will use a private IP scheme. The private IP
network will not be routable on the Internet.
IP Address: The private IP address of the Firewall’s internal network is the IP
address of the Internal (LAN) ports of the DFL-80. The default IP address is
192.168.1.1.

19
If the new Internal IPAddress is not 192.168.1.1, the Administrator needs to
set the IP Address on the computer to be on the same subnet as the Firewall
and restart the System to make the new IP address effective. For example, if
theFirewall’s newInternal IPAddress is172.16.0.1, then enterthe new Internal
IPAddress 172.16.0.1 in the URL field of browser to connect to Firewall.
NetMask: This is the netmask of the internal network. The default netmask of
the DFL-80 is 255.255.255.0.
Ping: Select this to allow the internal network to ping the IP Address of the
Firewall. If set to enable, the DFL-80 will respond to ping packets from the
internalnetwork.
For PPPoE (ADSL User): This option is for PPPoE users who are required to
enter a username and password in order to connect, such as ADSL users.
Current Status: Displays the current line status of the PPPoE connection.
IP Address: Displays the IPAddress of the PPPoE connection
Username: Enter the PPPoE username provided by the ISP.
Password: Enter the PPPoE password provided by the ISP.
IP Address provided by ISP:
Dynamic: Select this if the IP address is automatically assigned by the
ISP.
Fixed: Select this if you were given a static IP address. Enter the IP
address that is given to you by your ISP.
Service-On-Demand:
Auto Disconnect:ThePPPoEconnection willautomatically disconnect
after a length of idle time (no activities). Enter in the amount of idle
minutes before disconnection. Enter ‘0’ if you do not want the PPPoE
connection to disconnect at all.
The IP Address of the Internal Interface and the
DMZ Interface are private IP addresses only.

20
Ping: Select this to allow the external network to ping the IPAddress of
the Firewall. This will allow people from the Internet to be able to ping
the Firewall. If set to enable, the DFL-80 will respond to echo request
packets from the external network.
WebUI: Select this to allow the DFL-80 WEBUI to be accessed from
the WAN network. This will allow the WebUI to be configured from a
user on the Internet. Keep in mind that the DFL-80 always requires a
username and password to enter the WebUI.
For Dynamic IP Address (Cable Modem User): This option is for users who
are automatically assigned an IP address by their ISP, such as cable modem
users. The following fields apply:
IPAddress: The dynamic IP address obtained by the Firewall from the
ISPwill be displayedhere. Thisis the IPaddress ofthe WAN port ofthe
DFL-80.
MAC Address: This is the MAC Address of the DFL-80.
Hostname: This will be the name assign to the DFL-80. Some cable
modem ISP assign a specific hostname in order to connect to their
network. Please enter the hostname here. If not required by your ISP,
you do not have to enter a hostname.
Ping: Select this to allow the external network to ping the IPAddress of
the Firewall. This will allow people from the Internet to be able to ping
the Firewall. If set to enable, the DFL-80 will respond to echo request
packets from the external network.
WebUI: Select this to allow the DFL-80 WEBUI to be accessed from
the WAN network. This will allow the WebUI to be configured from a
user on the Internet. Keep in mind that the DFL-80 always requires a
username and password to enter the WebUI.
For Static IP Address: This option is for users who are assigned a static IP
Address from their ISP. Your ISP will provide all the information needed for this
section such as IP Address, Netmask, Gateway, and DNS. Use this option
also if you have more than one public IPAddress assigned to you.
IP Address: Enter the static IP address assigned to you by your ISP.
This will be the public IP address of the WAN port of the DFL-80.
Netmask: This will be the Netmask of the WAN network. (i.e.
255.255.255.0)
Default Gateway: This will be the Gateway IP address.
Domain Name Server (DNS): Thisis theIPAddressofthe DNSserver.