D-Link NetDefend SOHO DFL-160 User manual

User Manual
DFL-160
Ver 2.27.00
Network Security Solution http://www.dlink.com.tw
Security
Security
SOHO UTM Firewall

User Manual
D-Link DFL-160 Firewall
NetDefendOS Version 2.27.00
D-Link Corporation
No. 289, Sinhu 3rd Rd, Neihu District, Taipei City 114, Taiwan R.O.C.
http://www.DLink.com
Published 2010-05-24
Copyright ©2009

User Manual
D-Link DFL-160 Firewall
NetDefendOS Version 2.27.00
Published 2010-05-24
Copyright © 2009
Copyright Notice
This publication, including all photographs, illustrations and software, is protected under
international copyright laws, with all rights reserved. Neither this manual, nor any of the material
contained herein, may be reproduced without written consent of the author.
Disclaimer
The information in this document is subject to change without notice. The manufacturer makes no
representations or warranties with respect to the contents hereof and specifically disclaim any
implied warranties of merchantability or fitness for any particular purpose. The manufacturer
reserves the right to revise this publication and to make changes from time to time in the content
hereof without obligation of the manufacturer to notify any person of such revision or changes.
Limitations of Liability
UNDER NO CIRCUMSTANCES SHALL D-LINK OR ITS SUPPLIERS BE LIABLE FOR
DAMAGES OF ANY CHARACTER (E.G. DAMAGES FOR LOSS OF PROFIT, SOFTWARE
RESTORATION, WORK STOPPAGE, LOSS OF SAVED DATA OR ANY OTHER
COMMERCIAL DAMAGES OR LOSSES) RESULTING FROM THE APPLICATION OR
IMPROPER USE OF THE D-LINK PRODUCT OR FAILURE OF THE PRODUCT, EVEN IF
D-LINK IS INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. FURTHERMORE,
D-LINK WILL NOT BE LIABLE FOR THIRD-PARTY CLAIMS AGAINST CUSTOMER FOR
LOSSES OR DAMAGES. D-LINK WILL IN NO EVENT BE LIABLE FOR ANY DAMAGES IN
EXCESS OF THE AMOUNT D-LINK RECEIVED FROM THE END-USER FOR THE
PRODUCT.

Table of Contents
1. Product Overview .............................................................................................. 6
1.1. The DFL-160 Solution ............................................................................. 6
1.2. Ethernet Interfaces ................................................................................... 8
1.3. The LED Indicators ................................................................................10
2. Initial Setup .....................................................................................................12
2.1. Unpacking ............................................................................................12
2.2. Web Browser Connection ........................................................................14
2.3. Browser Connection Troubleshooting ........................................................19
2.4. Console Port Connection .........................................................................20
3. The System Menu .............................................................................................23
3.1. Administration .......................................................................................23
3.2. Internet Connection ................................................................................26
3.3. LAN Settings ........................................................................................28
3.4. DMZ Settings ........................................................................................31
3.5. Logging ................................................................................................34
3.6. Date and Time .......................................................................................36
3.7. Dynamic DNS Settings ............................................................................38
4. The Firewall Menu ...........................................................................................40
4.1. Outbound LAN Traffic Options ................................................................41
4.2. Outbound DMZ Traffic Options ................................................................43
4.3. Inbound Traffic Options ..........................................................................45
4.4. VPN Options .........................................................................................47
4.4.1. IPsec .........................................................................................48
4.4.2. L2TP/PPTP Client .......................................................................52
4.4.3. L2TP/PPTP Server .......................................................................53
4.5. VPN Users ............................................................................................55
4.6. Web Content Filtering .............................................................................56
4.6.1. Options ......................................................................................56
4.6.2. The Content Categories .................................................................58
4.7. Anti-Virus ............................................................................................65
4.8. IDP Options ..........................................................................................68
4.9. Traffic Shaping ......................................................................................71
4.10. Schedules ............................................................................................74
5. The Tools Menu ...............................................................................................77
5.1. Ping .....................................................................................................77
6. The Status Menu ...............................................................................................79
6.1. System Status ........................................................................................80
6.2. Logging Status .......................................................................................82
6.3. Anti-Virus Status ...................................................................................83
6.4. Web Content Filtering Status ....................................................................84
6.5. IDP Status ............................................................................................85
6.6. Connections Status .................................................................................86
6.7. Interfaces Status .....................................................................................87
6.8. IPsec Status ...........................................................................................89
6.9. User Authentication Status .......................................................................90
6.10. Routes ................................................................................................91
6.11. DHCP Server Status ..............................................................................92
7. The Maintenance Menu .....................................................................................94
7.1. The Update Center .................................................................................94
7.2. Licenses ...............................................................................................96
7.3. Backups ...............................................................................................98
7.4. Reset to Factory Defaults .........................................................................99
7.5. Upgrades ............................................................................................100
7.6. Technical Support ................................................................................101
8. The Console Boot Menu ..................................................................................103
9. Troubleshooting .............................................................................................105
A. CLI Reference ...............................................................................................107
4

B. Windows XP IP Setup .....................................................................................121
C. Windows Vista IP Setup ..................................................................................123
D. Windows 7 IP Setup .......................................................................................125
E. Apple Mac IP Setup ........................................................................................127
Alphabetical Index .............................................................................................129
User Manual
5

Chapter 1. Product Overview
• The DFL-160 Solution, page 6
• Ethernet Interfaces, page 8
• The LED Indicators, page 10
1.1. The DFL-160 Solution
The NetDefend SOHO UTM product is a D-Link hardware/software solution designed for situations
where a conventional IP router connected to the public Internet in a small organization or home
environment does not have sufficient capabilities to provide the network security required to combat
today's universe of potential external threats.
The DFL-160 and the NetDefendOS Software
The term DFL-160 refers to the physical hardware that is provided with the NetDefend SOHO UTM
product. The operating system software that drives the hardware is a purpose built networking
operating system called D-Link NetDefendOS. This operating system is also found in D-Link DFL
firewall products designed for larger enterprises.
The NetDefendOS Management Interface
The principle management interface for the DFL-160 is through a web browser running on a
separate computer. This computer acts as a management workstation and the DFL-160 acts as a web
server, allowing the product to be managed through an intuitive set of web pages that are viewed
through the web browser.
The DFL-160 Interfaces
The DFL-160 provides 10/100/1000 Mbps capable LAN (Local Area Network) and DMZ
(Demilitarized Zone) Ethernet interfaces for the internal, protected networks plus a 10/100 Mbps
capable WAN (Wide Area Network) interface for connection to the public Internet. Further
information about all these can be found in Section 1.2, “Ethernet Interfaces”.
Additionally, a serial interface (the COM port) is provided for access to a Command Line Interface
(CLI).
Below is an image of the back of the DFL-160 unit showing all the connection ports.
6

"Inside" and "Outside" Networks
The NetDefendOS provides the administrator with the ability to control and manage the traffic that
flows between the trusted "inside" networks and the much more threatening public Internet that lies
"outside".
The "outside" Internet network is connected to the DFL-160's WAN interface and the trusted
"inside" network is connected to the LAN interface. As explained later, there are, in fact, four LAN
interfaces connected together through an internal switch.
The network connected to the DMZ interface can be considered to also be "inside" but it is designed
for a network where servers are situated which are accessed by external hosts and users on the
public Internet. The DMZ therefore represents a place where threats such as server viruses can be
isolated and kept separate from the more sensitive LAN network. For this reason, connections
initiated from hosts and users on the DMZ network to the LAN network are never allowed.
Firewalling and UTM
NetDefendOS provides the NetDefend SOHO UTM product with the following important features
to protect against external threats coming from the Internet:
•Extensive Firewalling Capabilities
NetDefendOS can block traffic which does not comply with security policies defined by the
user. These policies can target traffic according to which protocol (such as HTTP or FTP) is
arriving and leaving, and by which interface, as well as optionally determining when such traffic
is allowed according to a time schedule.
There are three sets of basic traffic flow policies that can be defined:
1. Traffic initiated by internal networks ("outbound traffic")
2. Traffic initiated by external networks to hosts and users on the LAN network ("inbound
LAN traffic").
3. Traffic initiated by external networks to hosts and users on the DMZ network ("inbound
DMZ traffic").
Note: No inbound traffic is initially allowed
When a DFL-160 is started for the first time, no inbound traffic is allowed so the
administrator should decide what inbound traffic will be allowed as one of the first
setup steps.
•Unified Threat Management (UTM)
UTM is performed by NetDefendOS through the following features:
1. An Anti-Virus option to scan file downloads for viruses.
2. Intrusion Detection and Prevention to scan all traffic connecting to internal servers.
3. Web Content Filtering to implement policies on the types of web sites that can be accessed.
1.1. The DFL-160 Solution Chapter 1. Product Overview
7

1.2. Ethernet Interfaces
Physical Interface Arrangement
The DFL-160 has a number of physical Ethernet interfaces which can be used to plug into other
Ethernet networks. The image below shows these interfaces at the back of the hardware unit.
Interface Network Connections
The illustration below shows the typical usage of network connections to the DFL-160 interfaces.
Intended Interface Usage
The interfaces are intended to be used in the following ways:
• The LAN interfaces.
There are four physical LAN interfaces which are labelled: LAN1,LAN2,LAN3 and LAN4.
1.2. Ethernet Interfaces Chapter 1. Product Overview
8

These are intended for connection to local, internal networks which will be protected from the
outside internet by the highest security available from the DFL-160.
Interfaces LAN1 to LAN4 are connected together via a switch fabric in the DFL-160 which
means that traffic travelling between them will not be subject to the control of NetDefendOS.
All four are considered to be part of the single logical LAN interface.
This manual will refer to the LAN interface and by this will mean a connection to any of these 4
physical interfaces.
The management options for the LAN interface are described in Section 3.3, “LAN Settings”.
• The DMZ interface.
This is for connection to a local network which will be the Demilitarized Zone (DMZ). A DMZ
is usually set aside to contain computers that regularly receive data from and send data to the
public internet. An example might be a mail server. The intent with the DMZ interface is to
provide a stage of security between the well protected, internal LAN networks and the public
Internet which is connected to the WAN interface.
If desired, the DMZ can be used like another LAN interface but does not share the common
LAN switch fabric mentioned above.
The management options for the DMZ interface are described in Section 3.4, “DMZ Settings”.
• The WAN interface.
This is intended for connection to an external network. In most cases this interface will be
connected to the public Internet via your Internet Service Provider (ISP).
The basic management options for the WAN interface are described in Section 3.2, “Internet
Connection”.
Interface Link Speed Capabilities
The physical speed capabilities are as follows:
Ethernet Interface Capability (Megabits/second)
LAN (1 to 4) 10/100/1000 Mbps
DMZ 10/100/1000 Mbps
WAN 10/100 Mbps
1.2. Ethernet Interfaces Chapter 1. Product Overview
9

1.3. The LED Indicators
On the front portion of the DFL-160 casing are a set of indicator lights which show system status
and Ethernet port activity.
Power and Status
The power light is illuminated when power is applied and the status light is illuminated after
NetDefendOS has completed start up or if the boot menu has been entered prior to complete startup
(the latter is described in Chapter 8, The Console Boot Menu).
Ethernet Ports
On the right hand side of the front of the DFL-160 there is a line of LED lights that show the status
of the different Ethernet interfaces by showing a flashing or solid light in orange or green. The
image below shows these LED status indicators.
The following table shows the meaning of the Ethernet port LED colors.
LED Status Indicated Link Status
Solid Amber 1000 Mbps link established
Blinking Amber Data transmission over 1000 Mbps link
Solid Green 10/100 Mbps link established
Blinking Green Data transmission over 10/100 Mbps link
Light off No data link exists
1.3. The LED Indicators Chapter 1. Product Overview
10

1.3. The LED Indicators Chapter 1. Product Overview
11

Chapter 2. Initial Setup
• Unpacking, page 12
• Web Browser Connection, page 14
• Browser Connection Troubleshooting, page 19
• Console Port Connection, page 20
2.1. Unpacking
Package Contents
Carefully open the product packaging and inside you will find the following:
• The DFL-160 hardware unit.
• The DFL-160 Quick Installation Guide.
• A plug-in 12 Volt/1.2 Amp power supply with connecting cable.
• One Category 5e Ethernet cable.
• One RS232 cable for connecting a console to the DFL-160 serial COM port.
• A CD ROM containing essential product documents and useful software utilities.
Location of the Hardware
The DFL-160 unit is designed for table mounting only. The product can be mounted on any
appropriate stable, flat, level surface that can safely support the weight of the unit and its attached
cables.
12

Environmental and Operating Parameters
The following table lists the key environmental and operating parameters for the DFL-160
hardware.
Parameter DFL-160 Value
AC Input 100-240 VAC, 50/60 Hz, External supply
Operating Temperature Range 0°C to +50°C
Storage Temperature Range -40°C to +70°C
Operational Humidity Range 10% to 90% RH
Storage Humidity Range 5% to 90% RH
Power Consumption Under 20 Watts
Heat Flow Considerations
The DFL-160 is a low power device that generates a modest amount of heat output during operation.
The following precautions should be taken to allow this heat to dissipate:
• Do not install the DFL-160 in an environment where the operating ambient temperature might
come close to or go beyond the recommended operating temperature range (as stated in the table
above, the operating range is from 0°C to +50°C).
• Make sure that airflow around the DFL-160 unit is not restricted.
• Do not place anything on top of the unit, including any other electronic devices.
Power Supply Precautions
The following is recommended in regard to the power supply:
• Make sure that any power source circuits are properly grounded, and use the power cord
supplied with the DFL-160 to connect it to the power source.
• Ensure that the DFL-160 does not overload the power circuits, wiring and over-current
protection. To determine the possibility of overloading the supply circuits, add together the
ampere ratings of all devices installed on the same circuit as the DFL-160 and compare the total
with the rating limit for the circuit. The maximum ampere ratings are usually printed on the
devices near AC power connectors.
• If your installation requires any power cords other than the one supplied with the product, be
sure to use a power cord displaying the logo of the safety agency that defines the regulations for
power cords in your country. The logo is your assurance that the power cord can be used safely
with the DFL-160.
• The purchase and use of a separate surge protection unit from a third party should be considered
to protect against damage by electrical power surges. This is particularly recommended in
geographic regions where lightning strikes might occur.
Software Installation
A copy of the NetDefendOS network operating system is already pre-installed on the DFL-160 unit.
When the unit is powered up, NetDefendOS will automatically start for the first time with the
factory default settings. Initial startup is described in Section 2.2, “Web Browser Connection”.
2.1. Unpacking Chapter 2. Initial Setup
13

2.2. Web Browser Connection
This section describes the steps for accessing a DFL-160 for the first time through a web browser.
The user interface accessed in this way is known as the NetDefendOS Web Interface (or WebUI).
1. Connect the Cables
The DFL-160 and a management workstation (typically a Windows PC) running a web browser
should be physically connected together so they are on the same Ethernet network. A connection can
be made directly using a crossover Ethernet cable, or by connecting the management workstation
and the firewall to the same switch.
One of the four LAN interfaces should be attached to the same Ethernet network as the management
workstation (or a network accessible from the workstation via one or more routers). Typically the
connection is made via a switch or hub in the network but can, instead, be done directly using a
regular straight-through Ethernet cable.
For Internet connection, the WAN interface should be connected to your ISP.
2. Setting the Workstation Interface IP Address
Traffic will be able to flow between the designated workstation interface and the DFL-160 LAN
interface because they are on the same IP network. If DHCP is enabled on the workstation (and this
is usually the default) or DHCP is enabled on the device, such as a router, via which the connection
is made then the workstation should not need further configuration. IP addresses are assigned
automatically with DHCP and the reader can skip to step 3.
If, for some reason, DHCP is not available then manual configuration of the workstation interface IP
address will be needed. There are a series of appendices at the back of this manual that describe how
to do this, depending on the computer and operating system used:
•Appendix B, Windows XP IP Setup
•Appendix C, Windows Vista IP Setup
•Appendix D, Windows 7 IP Setup
•Appendix E, Apple Mac IP Setup
3. Connect the Power
NetDefendOS starts up as soon as the DFL-160 unit is connected to the power supply (there is no
On/Off switch). Power is connected by plugging the cable from the power supply into the unit's
power plug socket and then plugging the supply into a normal wall socket.
Once power is connected, NetDefendOS will take a couple of seconds to boot up. When this process
is complete, the Status front panel light is lit and the DFL-160 is ready to be managed through a web
browser.
2.2. Web Browser Connection Chapter 2. Initial Setup
14

4. Connect to the DFL-160 by Surfing to the IP address 192.168.10.1
Using a web browser (Internet Explorer or Firefox is recommended), surf to the IP address
192.168.10.1. This can be done using either HTTP or the more secure HTTPS protocol in the URL.
These two alternatives are discussed next.
A. Using HTTP
Enter the address http://192.168.10.1 into the browser navigation window as shown below. This will
send an initial browser request to the DFL-160.
If the browser does not respond, check that the web browser does not have a proxy server
configured. For possible problems with the network connection, consult Section 2.3, “Browser
Connection Troubleshooting”.
B. Using HTTPS
To connect with the added security of HTTPS instead, enter https://192.168.10.1 in the browser.
When responding to an https:// request, NetDefendOS sends a self-signed certificate which will not
be initially recognized so it will be necessary to tell the browser to accept the certificate for this and
future sessions. Different browsers handle this in slightly different ways. For example, in Microsoft
Internet Explorer the following error message will be displayed in the browser window.
To continue, tell the Windows IE browser to accept the certificate by clicking the following link
which appears near the bottom of the browser window.
In FireFox, this procedure is called "Add a security exception" and is a similar process of telling the
browser to accept the unsigned certificate.
5. Logging on to the DFL-160
NetDefendOS will next respond like a web server with the initial login dialog page as shown below.
2.2. Web Browser Connection Chapter 2. Initial Setup
15

The available management web interface language options are selectable at the bottom of this
dialog. This defaults to the language set for the browser if NetDefendOS supports that language.
Now login with the username admin and the password admin. The full web interface will now
appear as shown below and you are ready to begin setting up the initial DFL-160 configuration.
This initial web interface page after login always displays the System option in the Status menu, as
shown above. As a first step, it is recommended to click on the different menus shown in the top
menu bar to a get a feel where different options are located. This menu structure is duplicated in the
layout of later chapters that describe the options.
During initial setup, the System menu is the only set of options that should need to be changed.
Logging Out
When you have finished working with the management web interface, it is recommended to always
logout to prevent other with access to the workstation getting unauthorized access to the DFL-160.
Logout by clicking on the Logout link at the top right of the management web interface.
Automatic Logout
Logout will occur automatically after a period of 15 minutes management inactivity and this length
2.2. Web Browser Connection Chapter 2. Initial Setup
16

of time is fixed. After automatic logout occurs, the next interaction with the management web
interface will take the browser to the login page.
Connecting to the Internet
In the typical DFL-160 installation the next step is to connect to the public Internet. To do this the
WAN interface should be connected to your Internet Service Provider (ISP). This is usually done
through other equipment such as a broadband modem.
The WAN interface is, by default, configured to use DHCP to automatically fetch the required
external IP addresses from the ISP. If required, detailed WAN interface configuration is done by
going to the System > Internet Connection menu (these options are described in Section 3.2,
“Internet Connection”).
Once a connection to the Internet is established, web surfing from clients on networks attached to
the LAN interfaces is then possible. This is not possible with the DMZ interface since connections
on that interface are blocked until they are explicitly allowed.
Setting Firewall Security Policies
A key feature of the DFL-160 product is the ability to act as a firewall and impose security policies
on what kinds of traffic can flow between interfaces and in what direction.
As a next step, it is recommended to go to the Firewall > Outbound LAN Traffic menu and decide
what kinds of traffic can be initiated by internal hosts and users (these options are described in
Section 4.1, “Outbound LAN Traffic Options”).
By default, everything is allowed for outbound connections on the LAN interface but it is
recommended to restrict this to the minimum necessary. For instance, allowing the HTTP and
HTTPS services may be sufficient for web surfing.
A corresponding set of firewall options exists for the DMZ interface (see Section 4.2, “Outbound
DMZ Traffic Options”) but on initial setup, no outbound traffic is allowed on this interface so
services must be explicitly allowed.
The Meaning of "Outbound"
Keep in mind that the term outbound refers to traffic that is initiated from "inside", behind the
DFL-160 (in other words, from hosts and clients connected to the LAN or DMZ interface). All web
surfing traffic, no matter if it is a server request from a client or the reply to that request, is
considered to be outbound (this point will be repeated later in the manual). Conversely, inbound
traffic is exchanges that are initiated from the "outside", on the public Internet.
Using the DMZ for Management
By default, the DMZ interface is allocated the IP address 192.168.11.1 on the 192.168.11.0/24
network. However, the DMZ interface can't be used for initial connection with a browser because it
is not enabled as a management interface.
Management access through the DMZ interface can be enabled after initial management connection
through the LAN interface.
Going Further
At this point the DFL-160 product should be operational and acting as a secure barrier between
internal networks and the public Internet. The next step for the administrator is to further explore the
2.2. Web Browser Connection Chapter 2. Initial Setup
17

features of the product and bring into use those which meet the needs of a particular installation.
It is recommended that administrators familiarize themselves with the web interface by clicking on
the main menu options and exploring the individual options available with each. The later part of
this manual has a structure which reflects the naming and order of these menu options.
In most instances the web interface provides a helpful text description on the right hand side for how
features are used as well as more detailed descriptions for individual fields and options.
2.2. Web Browser Connection Chapter 2. Initial Setup
18

2.3. Browser Connection Troubleshooting
If the management interface does not respond after the DFL-160 has powered up and NetDefendOS
has started, there are a number of simple steps to trouble shoot basic connection problems:
1. Check that the LAN interface is being used
The most obvious problem is that the wrong DFL-160 interface has been used for the initial
connection. Only the LAN interface is enabled for management access for the initial connection
from a browser after NetDefendOS starts for the first time.
2. Is the LAN interface properly connected?
Check the link indicator lights on the management interface. If they are dark then there may be a
cable problem.
3. Check the cable type connected to the management interface.
If the management interface is connected directly to the management workstation or another router
or host? In this case, an Ethernet "cross-over" cable may be needed for the connection, depending on
the capabilities of the interface.
4. Using the ifstat CLI command
To investigate a connection problem further, connect a console to the RS232 port on the DFL-160
after NetDefendOS starts. The details of making this connection are described below in Section 2.4,
“Console Port Connection”.
When you press the enter key, NetDefendOS should respond with the standard CLI prompt:
DFL-160:/>
Now enter the following command a number of times:
DFL-160:/> ifstat lan
This will display a number of counters for the LAN interface.
If the Input counters in the hardware section of the output are not increasing then the error is likely
to be in the cabling. However, it may simply be that the packets are not getting to the DFL-160 in
the first place. This can be confirmed with a packet sniffer if it is available.
If the Input counters are increasing, the LAN interface may not be attached to the correct physical
network. There may also be a problem with the routing information in any connected hosts or
routers.
5. Using the arpsnoop CLI command
A final diagnostic test is to try using the console command:
DFL-160:/> arpsnoop -all
This will show the ARP packets being received on the different interfaces and confirm that the
correct cables are connected to the correct interfaces.
2.3. Browser Connection
Troubleshooting Chapter 2. Initial Setup
19

2.4. Console Port Connection
Initial setup of the DFL-160 can be done using only the web interface but DFL-160 also provides a
Command Line Interface (CLI) which can be used for certain administrative tasks. This is accessed
through a console connected directly to the unit's RS232 COM port, which is shown below. All CLI
commands are listed in Appendix A, CLI Reference.
The console also provides the ability to interact directly with the firmware that controls the
operation of the DFL-160 (see Chapter 8, The Console Boot Menu).
Console Setup
When setting up a console connected directly to the DFL-160's RS232 port, the console can be a
traditional "dumb" console device but is more typically a PC or other computer running console
emulation software (such as the HyperTerminal software included with some Windows versions).
An included RS232 null modem cable is used to connect the console to the console port. This port is
marked COM, as shown in the image above.
The connected console must have the following communication settings:
• 9600 bps.
• No parity.
• 8 bits.
• 1 stop bit.
• No flow control.
Entering the Boot Menu
The Boot Menu is another feature that can only be accessed through the console. It is a direct
management interface to the DFL-160's firmware loader software which underlies the
NetDefendOS software. It allows the administrator to reset the DFL-160 unit as well as set a console
password.
The boot menu is entered by pressing any console key between power up and NetDefendOS
starting. The console will display the message Press any key to abort and load boot menu during
this interval. This feature is described further in Chapter 8, The Console Boot Menu.
Console Output Truncation
The only limitation with issuing CLI commands through the serial console is that there is a finite
2.4. Console Port Connection Chapter 2. Initial Setup
20