D-Link DI-804 Instruction Manual

DI-804 VPN connection with another DI-804HV
(This example is using Static WAN IP addresses)
Date: 23 Oct 2003
Doc version: 1.1
Author: Neil Stent
Workstation
192.168.0.156 Workstation
192.168.1.20
DI-804V
192.168.0.5 DFL-600
192.168.1.5
ISP and
INTERNET
Cable / DSL modem
202.192.109.87 Cable / DSL modem 202.129.109.74
DFL-600 (firmware 4.73)
LAN: 192.168.0.10 255.255.255.0
WAN: 202.129.129.87 255.255.255.224
WAN gateway: 202.129.109.65 255.255.255.224
Workstation A:
PC: 192.168.0.156 225.255.255.0
PC gateway: 192.168.0.10 225.255.255.0
DI-804HV (firmware 1.30)
LAN: 192.168.1.5 255.255.255.0
WAN: 202.129.129.74 255.255.255.224
WAN gateway: 202.129.109.65 255.255.255.224
Workstation B:
PC: 192.168.1.20 225.255.255.0
PC gateway: 192.168.1.5 225.255.255.0
Please note:
For any VPN you need to make sure that the LAN subnet on each location is different. As above you can see
that the IP of the DFL-600 is 192.168.0.5 and the 804HV is 192.168.1.5. If you had a third location it should be
192.168.2.x etc… x being anything from 1 to 254.
If you are using DSL-300, DSL-300+, DSL-302G modem or DSL-500, DSL-504, DSL-604+ router please see
Appendix 3 at the end of this document.

DFL-600 Settings:
Log into the router’s WEB interface and then go into Home > LAN. Change the IP address of the LAN port
of the router to required IP.
Once you have changed the LAN IP address on the router, make sure your PC has an IP address from the same
subnet (192.168.2.x in this example), you may just need to renew IP on your PC or reboot.

Next go to the Home > WAN page, choose the type of connection your ISP requires. In our example
it is Static IP Address.
You need to have a static IP address the on WAN port of at least one unit out of two participating in VPN
connection. Some PPPoE connections have a static IP as well (in most of such cases you do not have to specify
the IP – your ISP will be providing you with the same IP every time you connect).
After setting up the WAN port click on Apply to save settings.

Next make sure you can access the Internet (that will confirm that you have set WAN settings
correctly), then log back into the router and go into Advanced > VPN-IPSec.
Make sure you have IPSec Status box ticked.

Next click on Tunnel Setting on the top tab.
Then fill out the page as needed.
The Ter

DI-804HV VPN Connection settings:

Make sure you have VPN enabled box ticked.
Type in any name for the Tunnel Name
Then click on the “more” button to the right of the ID “1”

Next enter in your Local information then the remote.
Make sure that you tell the 804HV the remotes Public IP under “remote gateway”.
For the Preshare Key this can be anything up to 31 in length.
Then click Apply, then click on “Select IKE…”

For the test here we used DES, DES is a lower Encryption the 3DES.
If you have a slow internet connection you may want to use this as it can increase the data transfer through the
VPN.
Down the bottom of the page click on the drop down for Proposal ID and click on 1, then click on “add to”. At
the top of the page you should see the IKE proposal index now has ID 1 in there.
After the setup click on Apply, don’t click on restart yet.
Next click on Back then click on “select IPSEC…”

You should now see this page.
Do the same setup as on the last page.
After the setup click on Apply, then click on reboot and hit OK.
The unit will save the setting then restart the DI-804HV.

Once this is all done go into dos, Start > Run, type in command then hit enter.
Depending on what location you are on will depend on what you type in.
If you are located on the 192.168.0.x side type in the red part:
Ping 192.168.1.5 (this is the IP of the remote unit)
Or if your location is 192.168.1.x type in the red part:
Ping 192.168.0.10 (this is the IP of the remote unit)
You should see something like the below.

Appendix 3
Note to DSL-300, DSL-300+, DSL-302G modems users
and DSL-500, DSL-504, DSL-604+ users.
If you are using DSL-300 to connect your DI-804HV to the Internet please avoid using 192.168.1.x
addresses on your networks as it is the temporary subnet used by the modem.
If you are using DSL-300+ to connect your DI-804HV to the Internet please avoid using 192.168.0.x
addresses on your networks as it is the temporary subnet used by the modem. Also note that DSL-
300+ links to the MAC address of the device connected to it directly. So if you configured the modem
while it was connected to your PC directly or to another router, you will need to reconfigure it while it
is connected to your DI-804HV. Here are the steps:
1. Connect the DSL-300+ modem to the WAN port of your DI-804HV.
2. Set WAN port on DI-804HV to “Dynamic IP” and set LAN port to subnet different from
192.168.0.x (e.g. 192.168.3.1)
3. Renew IP address on your computer so it will be on 192.168.3.x subnet and log into the
DSL-300+ using your Internet browser: http://192.168.0.1
4. In the DSL-300+ interface select Account Management. Put a tick next to your account and
click on Delete.
5. Select Account Configuration and reconfigure the modem according to your ISP requirements.
Click on OK to save settings.
If you are using DSL-500, DSL-504, DSL-604+ router to connect your DI-804HV to the Internet
please avoid using 192.168.0.x addresses on your networks as it is the default LAN subnet used by
the routers. You may change it to a different subnet (e.g. 192.168.33.1) if you wish, under
Configuration > Ethernet IP.
Note that you need to enable VPN passthrough on the router. Or go to NAT Configuration and
enable DMZ: specify the IP address of the WAN port of DI-804HV there.
DI-804HV WAN port should be set with static IP from the same subnet as DSL-xxx LAN port. Default
Gateway should be set as DSL-xxx LAN port IP address.
Please keep in mind that with DSL-xxx routers with NAT enabled your public IP address will be
located on the WAN port of DSL-xxx router. WAN port of DI-804HV will have private IP address.
When setting up Remote Gateway in VPN you will need to use public IPs on DSL-xxx routers’ WAN
ports, e.g. 202.129.109.87 (see example with DSL-302G below).

With DSL-302G the setup is similar. This modem uses 10.1.1.1 address on LAN.
In order to enable VPN traffic passthrough in this modem you need to do the following:
Log into the modem’s WEB interface and select WAN > NAT. Under NAT Options select NAT Rule
Entry. Click on Add button.
Under Rule Flavor select BIMAP. Set Rule ID as next number in the rules table (in our case it is 2). IF
Name = ALL. Local Address will be the IP on the WAN port of your DI-804HV which is connected to
this modem. Global address leave as 0.0.0.0:
Then click on Submit to apply the settings.
When setting up Remote Gateway in VPN you will need to use public IP on DSL-302G’s WAN port.
D-Link Australia & NZ Technical Support Team can be contacted on [phone] or [e-mail]
~ End of Document ~