Planet Networking & Communication MH-1000 User manual

Multi-Homing Security Gateway User’s Manual
Multi-Homing Security
Gateway
MH-1000
User’s Manual

Multi-Homing Security Gateway User’s Manual
Copyright
Copyright (C) 2006 PLANET Technology Corp. All rights reserved.
The products and programs described in this User’s Manual are licensed products of PLANET Technology, This User’s
Manual contains proprietary information protected by copyright, and this User’s Manual and all accompanying hardware,
software, and documentation are copyrighted.
No part of this User’s Manual may be copied, photocopied, reproduced, translated, or reduced to any electronic medium
or machine-readable form by any means by electronic or mechanical. Including photocopying, recording, or information
storage and retrieval systems, for any purpose other than the purchaser's personal use, and without the prior express
written permission of PLANET Technology.
Disclaimer
PLANET Technology does not warrant that the hardware will work properly in all environments and applications, and
makes no warranty and representation, either implied or expressed, with respect to the quality, performance,
merchantability, or fitness for a particular purpose.
PLANET has made every effort to ensure that this User’s Manual is accurate; PLANET disclaims liability for any
inaccuracies or omissions that may have occurred.
Information in this User’s Manual is subject to change without notice and does not represent a commitment on the part of
PLANET. PLANET assumes no responsibility for any inaccuracies that may be contained in this User’s Manual. PLANET
makes no commitment to update or keep current the information in this User’s Manual, and reserves the right to make
improvements to this User’s Manual and/or to the products described in this User’s Manual, at any time without notice.
If you find information in this manual that is incorrect, misleading, or incomplete, we would appreciate your comments and
suggestions.
CE mark Warning
This is a class B device, in a domestic environment; this product may cause radio interference, in which case the user
may be required to take adequate measures.
To avoid the potential effects on the environment and human health as a result of the presence of hazardous
substances in electrical and electronic equipment, end users of electrical and electronic equipment should
understand the meaning of the crossed-out wheeled bin symbol. Do not dispose of WEEE as unsorted
municipal waste and have to collect such WEEE separately.
Trademarks
The PLANET logo is a trademark of PLANET Technology.
This documentation may refer to numerous hardware and software products by their trade names. In most, if not all cases,
these designations are claimed as trademarks or registered trademarks by their respective companies.
Customer Service
For information on customer service and support for the Multi-Homing Security Gateway, please refer to the following
Website URL:
http://www.planet.com.tw
Before contacting customer service, please take a moment to gather the following information:
♦Multi-Homing Security Gateway serial number and MAC address
♦Any error messages that displayed when the problem occurred
♦Any software running when the problem occurred
♦Steps you took to resolve the problem on your own
Revision
User’s Manual for PLANET Multi-Homing Security Gateway
Model: MH-1000
Rev: 1.0 (February, 2006)

Multi-Homing Security Gateway User’s Manual
Table of Contents
CHAPTER 1: INTRODUCTION ........................................................................................................................ 1
1.1 FEATURES................................................................................................................................................................1
1.2 PACKAGE CONTENTS ..............................................................................................................................................2
1.3 MH-1000 FRONT VIEW...........................................................................................................................................2
1.4 MH-1000 REAR PANEL...........................................................................................................................................2
1.5 SPECIFICATION ........................................................................................................................................................3
CHAPTER 2: ROUTER APPLICATION............................................................................................................ 4
2.1 OVERVIEW ...............................................................................................................................................................4
2.2 BANDWIDTH MANAGEMENT WITH QOS...................................................................................................................4
2.3 OUTBOUND TRAFFIC ...............................................................................................................................................9
2.4 INBOUND TRAFFIC .................................................................................................................................................10
2.5 DNS INBOUND.......................................................................................................................................................12
2.6 VIRTUAL PRIVATE NETWORKING ...........................................................................................................................16
CHAPTER 3: GETTING STARTED ................................................................................................................ 19
3.1 OVERVIEW .............................................................................................................................................................19
3.2 BEFORE YOU BEGIN..............................................................................................................................................19
3.3 CONFIGURING PCS FOR TCP/IP NETWORKING...................................................................................................19
3.4 FACTORY DEFAULT SETTINGS ...............................................................................................................................25
3.5 INFORMATION FROM YOUR ISP.............................................................................................................................25
CHAPTER 4: ROUTER CONFIGURATION.................................................................................................... 27
4.1 OVERVIEW .............................................................................................................................................................27
4.2 STATUS ..................................................................................................................................................................28
4.3 QUICK START .........................................................................................................................................................34
4.4 CONFIGURATION ....................................................................................................................................................37
4.5 SAVE CONFIGURATION TO FLASH .........................................................................................................................80
4.6 LOGOUT .................................................................................................................................................................81
CHAPTER 5: TROUBLESHOOTING ............................................................................................................. 82
5.1 BASIC FUNCTIONALITY ..........................................................................................................................................82
5.2 LAN INTERFACE ....................................................................................................................................................83
5.3 WAN INTERFACE...................................................................................................................................................87
5.4 ISP CONNECTION..................................................................................................................................................87
5.5 PROBLEMS WITH DATE AND TIME..........................................................................................................................89
5.6 RESTORING FACTORY DEFAULTS..........................................................................................................................89

Multi-Homing Security Gateway User’s Manual
APPENDIX A: VIRTUAL PRIVATE NETWORKING....................................................................................... 90
A.1 WHAT IS THE VPN? ..............................................................................................................................................90
A.2 WHAT IS THE IPSEC?............................................................................................................................................90
APPENDIX B: IPSEC LOGS AND EVENTS.................................................................................................. 96
B.1 IPSEC LOG EVENT CATEGORIES ..........................................................................................................................96
B.2 IPSEC LOG EVENT TABLE.....................................................................................................................................96
APPENDIX C: BANDWIDTH MANAGEMENT WITH QOS............................................................................ 99
C.1 OVERVIEW.............................................................................................................................................................99
C.2 WHAT IS QUALITY OF SERVICE?...........................................................................................................................99
C.3 WHAT IS QUALITY OF SERVICE?...........................................................................................................................99
C.4 WHO NEEDS QOS? ..............................................................................................................................................99
APPENDIX D: ROUTER SETUP EXAMPLES ............................................................................................. 102
D.1 OUTBOUND FAIL OVER .......................................................................................................................................102
D.2 OUTBOUND LOAD BALANCING............................................................................................................................103
D.3 INBOUND FAIL OVER ...........................................................................................................................................106
D.4 DNS INBOUND FAIL OVER..................................................................................................................................108
D.5 DNS INBOUND LOAD BALANCING ...................................................................................................................... 111
D.6 DYNAMIC DNS INBOUND LOAD BALANCING ...................................................................................................... 113
D.7 VPN CONFIGURATION ........................................................................................................................................ 117
D.8 IP SEC FAIL OVER (GATEWAY TO GATEWAY)..................................................................................................... 119
D.9 IP VPN CONCENTRATOR....................................................................................................................................122
D.10 PROTOCOL BINDING .........................................................................................................................................127
D.11 INTRUSION DETECTION.....................................................................................................................................128
D.12 PPTP REMOTE ACCESS BY WINDOWS XP .....................................................................................................129
D.13 PPTP REMOTE ACCESS ..................................................................................................................................135

Multi-Homing Security Gateway User’s Manual
Chapter 1: Introduction
PLANET’s Multi-Homing Security Gateway, MH-1000 integrated with cutting-edge technology including
Load Balancing, VPN and Firewall for central sites to establish office network and connect with branch
offices, remote dial up and tele-workers. It is designed for business requiring application-based network
solution at low-capital investment and is perfectly catering to the needs of small and medium sized business.
Built-in multiple WAN interfaces can prevent your Internet connection from failure, and also reduces the risks
of potential shutdown if one of the Internet connections fails. Moreover, it allows you to perform
load-balancing by distributing the traffic through two WAN connections.
In addition to a multi-homing device, PLANET’s Multi-Homing Security Gateway provides a complete
security solution in a box. The policy-based firewall, content filtering function and VPN connectivity with
3DES and AES encryption make it a perfect product for your network security. Bandwidth management
function is also supported to offers network administrators an easy yet powerful means to allocate network
resources based on business priorities, and to shape and control bandwidth usage.
1.1 Features
♦WAN Fail-over: Auto failover feature can be configured for a second connection to ensure redundant
connectivity when the primary line fails.
♦Load Balancing: MH-1000 provides the ability to balance the workload by distributing incoming traffic
across the two connections.
♦DNS inbound load balance: The MH-1000 can be configured to reply the WAN2 IP address for the
DNS domain name request if WAN1 fails.
♦VPN Connectivity: The security gateway support PPTP and IPSec VPN. With DES, 3DES and AES
encryption and SHA-1 / MD5 authentication, the network traffic over public Internet is secured.
♦PPTP Server: The MH-1000 also provides PPTP server feature, the remote user can connect to
MH-1000 PPTP server without too many complex setting and to access the LAN resource.
♦Content Filtering: The security gateway can block network connection based on URLs, Scripts (The
Pop-up, Java Applet, cookies and Active X).
♦SPI Firewall: Built-in Stateful Packet Inspection (SPI) can determine if a data packet is allowed through
the firewall to the private LAN.
♦Denial of Service (DoS): The MH-1000 protects against hackers attack by DoS, it can allow private LAN
securely connected to the Internet.
♦Quality of Service (QoS): Network packets can be classified based on IP address and TCP/UDP port
number and give guarantee and maximum bandwidth with three levels of priority.
♦Dynamic Domain Name Service (DDNS): The Dynamic DNS service allows users to alias a dynamic IP
address to a static hostname.
- 1 -

Multi-Homing Security Gateway User’s Manual
1.2 Package Contents
The following items should be included:
MH-1000
Multi-Homing Security Gateway
User’s Manual CD-ROM
This Quick Installation Guide
Power Adapter
Bracket x 2 (For rack-mounted)
Screw x 4 (For rack-mounted)
If any of the contents are missing or damaged, please contact your dealer or distributor immediately.
1.3 MH-1000 Front View
MH-1000 Front Panel
LED Description
PWR A solid light indicates a steady connection to a power source
STATUS A blinking light indicates the device is writing to flash memory
LAN 1 - 8 Lit when connected to an Ethernet device
10/100: Lit green when connected at 100Mbps
Not lit when connected at 10Mbps
LNK/ACT: Lit when device is connected.
Blinking when data is transmitting /receiving
WAN1,
WAN2
Lit when connected to an Ethernet device
10/100: Lit green when connected at 100Mbps
Not lit when connected at 10Mbps
LNK/ACT: Lit when device is connected.
Blinking when data is transmitting /receiving
1.4 MH-1000 Rear Panel
MH-1000 Rear Panel
- 2 -

Multi-Homing Security Gateway User’s Manual
Port or button Description
RESET To reset device and restore factory default settings, after
the device is fully booted, press and hold RESET until the
Status LED begins to blink.
WAN 1,
WAN2
Connect to your xDSL/Cable modem or other Internet
connection devices
LAN 1- 8 Connect to your local PC, switch or other local network
device
DC 12V Connect DC Power Adapter here (12VDC)
1.5 Specification
Product Multi-homing Security Gateway
Model MH-1000
Hardware
LAN 8 x 10/100 Based-TX RJ-45
Ethernet
WAN 2 x 10/100 Based-TX RJ-45
Performance
Firewall throughput 90Mbps
IPSec VPN throughput 30Mbps
PPTP VPN throughput 10Mbps
Maximum Concurrent
sessions 10,000
Software
Management Web
Network Protocol and
features
Static IP, PPPoE, PPTP, Big Pond and DHCP client connection to ISP
NAT, Static Route, RIP-2
Dynamic Domain Name System (DDNS)
Virtual Server and DMZ
DHCP server
NTP
Load Balancing Increased bandwidth of outbound and inbound trafficDNS inbound load
balance
Firewall Srateful Packet Inspection (SPI) and Denial of Service (DoS) prevention
Packet Filter (by IP, port number and packet type)
E-mail alert and logs of attack
MAC Address Filtering
Content Filtering URL Filtering
Java Applet/Active X/Web Proxy/Surfing of IP Address/Cookie Blocking
VPN Tunnels IPSec: 100, PPTP: 4
VPN Functions PPTP, IPSec VPN support
DES, 3DES and AES encrypting
SHA-1 / MD5 authentication algorithm
Remote access VPN (Client-to-Site) and Site to Site VPN
IPSec, PPTP, L2TP pass through
QoS Support DiffServ approach
Prioritization and bandwidth managed by IP, Port number and MAC address
Log and Alert Syslog support
E-mail Alert
- 3 -

Multi-Homing Security Gateway User’s Manual
Chapter 2: Router Application
2.1 Overview
MH-1000 is a versatile device that can be configured to not only protect your network from malicious
attackers, but also ensure optimal usage of available bandwidth with Quality of Service (QoS) and both
Inbound and Outbound Load Balancing. Alternatively, MH-1000 can also be set to redirect incoming and
outgoing network traffic with the Fail Over capability, ensuring minimal downtime and increased reliability.
2.2 Bandwidth Management with QoS
Quality of Service (QoS) gives you full control over which types of outgoing data traffic should be given
priority by the router. By doing so, the router can ensure that latency-sensitive applications like voice,
bandwidth-consuming data like gaming packets, or even mission critical files efficiently move through the
router even under a heavy load. You can throttle the speed at which different types of outgoing data pass
through the router. In addition, you can simply change the priority of different types of upload data and let
the router sort out the actual speeds.
2.2.1 Transparent Mode Connection Example
QoS generally involves the prioritization of network traffic. QoS is comprised of three major components:
Classifier, Meter, and Scheduler. Each of these components has a distinct role in ensuring that incoming
and outgoing data is managed according to user specifications.
The Classifier analyses incoming packets and marks each one according to configured parameters. The
Meter communicates the drop priority to the Scheduler and measures the temporal priorities of the output
stream against configured parameters. Finally, the Scheduler schedules each packet for transmission
based on information from both the Classifier and the Meter.
- 4 -

Multi-Homing Security Gateway User’s Manual
2.2.2 QoS Policies for Different Applications
By setting different QoS policies according to the applications you are running, you can use MH-1000 to
optimize the bandwidth that is being used on your network.
Normal PCs
VoIP
Restricted PC
As illustrated in the diagram above, applications such as Voice over IP (VoIP) require low network latencies
to function properly. If bandwidth is being used by other applications such as an FTP server, users using
VoIP will experience network lag and/or service interruptions during use. To avoid this scenario, this
- 5 -

Multi-Homing Security Gateway User’s Manual
network has assigned VoIP with a guaranteed bandwidth and higher priority to ensure smooth
communications. The FTP server, on the other hand, has been given a maximum bandwidth cap to make
sure that regular service to both VoIP and normal Internet applications is uninterrupted.
2.2.3 Guaranteed / Maximum Bandwidth
Setting a Guaranteed Bandwidth ensures that a particular service receives a minimum percentage of
bandwidth. For example, you can configure MH-1000 to reserve 10% of the available bandwidth for a
particular computer on the network to transfer files.
Alternatively you can set a Maximum Bandwidth to restrict a particular application to a fixed percentage of
the total throughput. Setting a Maximum Bandwidth of 20% for a file sharing program will ensure that no
more than 20% of the available bandwidth will be used for file sharing.
2.2.4 Policy Based Traffic Shaping
Policy Based Traffic Shaping allows you to apply specific traffic policies across a range of IP addresses or
ports. This is particularly useful for assigning different policies for different PCs on the network. Policy
based traffic shaping lets you better manage your bandwidth, providing reliable Internet and network
service to your organization.
- 6 -

Multi-Homing Security Gateway User’s Manual
2.2.5 Priority Bandwidth Utilization
Assigning priority to a certain service allows MH-1000 to give either a higher or lower priority to traffic from
this particular service. Assigning a higher priority to an application ensures that it is processed ahead of
applications with a lower priority and vice versa.
- 7 -

Multi-Homing Security Gateway User’s Manual
2.2.6 Management by IP or MAC address
MH-1000 can also be configured to apply traffic policies based on a particular IP or MAC address. This
allows you to quickly assign different traffic policies to a specific computer on the network.
2.2.7 DiffServ (DSCP Marking)
DiffServ (a.k.a. DSCP Marking) allows you to classify traffic based on IP DSCP values. These markings
can be used to identify traffic within the network. Other interfaces can match traffic based on the DSCP
markings. DSCP markings are used to decide how packets should be treated, and is a useful tool to give
precedence to varying types of data.
- 8 -

Multi-Homing Security Gateway User’s Manual
2.3 Outbound Traffic
This section outlines some of the ways you can use MH-1000 to manage outbound traffic.
2.3.1 Outbound Fail Over
Configuring MH-1000 for Outbound Fail Over allows you to ensure that outgoing traffic is uninterrupted.
In the above example, PC 1 (IP_192.168.2.2) and PC 2 (IP_192.168.2.3) are connected to the Internet via
WAN1 (IP_230.100.100.1) on MH-1000. Should WAN1 fail, Outbound Fail Over tells MH-1000 to reroute
outgoing traffic to WAN2 (IP_213.10.10.2). Configuring your MH-1000 for Outbound Fail Over provides a
more reliable connection for your outgoing traffic.
Please refer to appendix D for example settings.
2.3.2 Outbound Load Balancing
Outbound Load Balancing allows MH-1000 to intelligently manage outbound traffic based on the amount of
load of each WAN connection.
- 9 -

Multi-Homing Security Gateway User’s Manual
192.168.2.2
192.168.2.3 213.10.10.2
230.100.100.1
ISP
In the above example, PC 1 (IP_192.168.2.2) and PC 2 (IP_192.168.2.3) are connected to the Internet via
WAN1 (IP_230.100.100.1) and WAN2 (IP_213.10.10.2) on MH-1000. You can configure MH-1000 to
balance the load of each WAN port with one of two mechanisms:
1. Session (by session/by traffic/weight of link capability)
2. IP Hash (by traffic/weight of link capability)
The IP Hash mechanism will ensure that the traffic from the same source IP address and destination IP
address will go through the same WAN port. This is useful for some server applications that need to identify
the source IP address of the client.
By balancing the load between WAN1 and WAN2, your MH-1000 can ensure that outbound traffic is
efficiently handled by making sure that both ports are equally sharing the load, preventing situations where
one port is completely saturated by outbound traffic.
Please refer to appendix D for example settings.
2.4 Inbound Traffic
Learn how MH-1000 can handle inbound traffic in the following section.
2.4.1 Inbound Fail Over
Configuring MH-1000 for Inbound Fail Over allows you to ensure that incoming traffic is uninterrupted by
having MH-1000 default to WAN2 should WAN1 fail.
- 10 -

Multi-Homing Security Gateway User’s Manual
ftp.planet.com.tw
Before Fail Over
192.168.2.2
192.168.2.3
ftp.planet.com.tw
After Fail Over
ftp://ftp.planet.com.tw
Remote Access from Internet
ftp://ftp.planet.com.tw
Remote Access from Internet
FTP
HTTP
192.168.2.2
192.168.2.3
FTP
HTTP
In the above example, an FTP Server (IP_192.168.2.2) and an HTTP Server (IP_192.168.2.3) are
connected to the Internet via WAN1 (ftp.planet.com.tw) on MH-1000. A remote computer is trying to access
these servers via the Internet. Under normal circumstances, the remote computer will gain access to the
network via WAN1. Should WAN1 fail, Inbound Fail Over tells MH-1000 to reroute incoming traffic to WAN2
by using the Dynamic DNS mechanism. Configuring your MH-1000 for Inbound Fail Over provides a more
reliable connection for your incoming traffic.
Please refer to appendix D for example settings.
2.4.2 Inbound Load Balancing
Inbound Load Balancing allows MH-1000 to intelligently manage inbound traffic based on the amount of
load of each WAN connection.
- 11 -

Multi-Homing Security Gateway User’s Manual
In the above example, an FTP server (IP_192.168.2.2) and an HTTP server (IP_192.168.2.3) are
connected to the Internet via WAN1 (www.planet2.com.tw) and WAN2 (www.planet3.com.tw) on MH-1000.
Remote PCs are attempting to access the servers via the Internet. Using Inbound Load Balancing,
MH-1000 can direct incoming requests to the correct WAN port based on group assignment. For example,
a sales force can be directed to www.planet2.com.tw while the R&D group can access www.planet3.com.tw.
By balancing the load between WAN1 and WAN2, your MH-1000 can ensure that inbound traffic is
efficiently handled with both ports equally sharing the load, preventing situations where service is slow
because one port is completely saturated by inbound traffic.
Please refer to appendix D for example settings.
2.5 DNS Inbound
Using DNS Inbound is a great way to intelligently direct network traffic.
www.planet2.com.tw
Remote Access from Internet
www.planet3.com.tw
www.planet3.com.tw
www.planet2.com.tw
192.168.2.2
192.168.2.3
HTTP
ISP
ISP
FTP
DNS Inbound is a three step process. First, a DNS request is made to the router via a remote
PC. MH-1000, based on settings specified by the user, will direct the requesting PC to the correct WAN
- 12 -

Multi-Homing Security Gateway User’s Manual
port by replying the selected WAN IP address through the built-in DNS server. The remote PC then
accesses the network via the specified WAN port. How MH-1000 directs this traffic through the built-in DNS
server depends on whether it is configured for Fail Over or Load Balancing.
Learn how to make DNS Inbound on MH-1000 work for you in the following section.
2.5.1 DNS Inbound Fail Over
MH-1000 can be configured to reply the WAN2 IP address for the DNS domain name request should
WAN1 fail.
Built-in DNS
S
192.168.2.2
192.168.2.3
FTP
HTTP
200.200.200.1
www.mydomain.com
200.200.200.1
Authoritative Domain Name Server
f
di
Before Fail Over
100.100.100.1
After Fail Over
100.100.100.1
DNS
DNS
Built-in DNS
S
192.168.2.2
192.168.2.3
1st connection
2nd connection
1st connection
2nd connection
www.mydomain.com
DNS
DNS
HTTP
FTP
In the above example, an FTP Server (IP_192.168.2.2) and an HTTP Server (IP_192.168.2.3) are
connected to the Internet via WAN1 (IP_200.200.200.1) on MH-1000. A remote computer is trying to
access these servers via the Internet, and makes a DNS request. The DNS request (www.mydomain.com)
will be sent through WAN1 (200.200.200.1) to the built-in DNS server. The DNS server will reply
200.200.200.1 because this is the only active WAN port. Should WAN1 fail, MH-1000 will instead reply with
WAN2’s IP address (100.100.100.1), and the remote PC will gain access to the network via WAN2. By
configuring MH-1000 for DNS Inbound Fail Over, incoming requests will enjoy increased reliability when
accessing your network.
Please refer to appendix D for example settings.
- 13 -

Multi-Homing Security Gateway User’s Manual
2.5.2 DNS Inbound Load Balancing
DNS Inbound Load Balancing allows MH-1000 to intelligently manage inbound traffic based on
the amount of load of each WAN connection by assigning the IP address with the lowest traffic
load to incoming requests.
Built-in DNS
S
192.168.2.2
192.168.2.3
FTP
HTTP
200.200.200.1
www.mydomain.com
200.200.200.1
Authoritative Domain Name Server
di
100.100.100.1
100.100.100.1
DNS Re
q
uest
DNS Reply
Built-in DNS
S
www.mydomain.com
Heav
y
l
oad on WAN
Heav
y
load on WAN
WAN 1
WAN 2
WAN 1
WAN 2
100.100.100.1
200.200.200.1
DNS Reply
DNS Re
q
uest
f
192.168.2.2
192.168.2.3
FTP
HTTP
In the above example, an FTP server (IP_192.168.2.2) and an HTTP server (IP_192.168.2.3) are
connected to the Internet via WAN1 (IP_200.200.200.1) and WAN2 (IP_100.100.100.1) on MH-1000.
Remote PCs are attempting to access the servers via the Internet by making a DNS request, entering a
URL (www.mydomain.com).
Using a load balancing algorithm, MH-1000 can direct incoming requests to either WAN port based on the
amount of load each WAN port is currently experiencing. If WAN2 is experiencing a heavy load, MH-1000
responds to incoming DNS requests with WAN1.
By balancing the load between WAN1 and WAN2, your MH-1000 can ensure that inbound traffic is
efficiently handled, making sure that both ports are equally sharing the load and preventing situations
where service is slow because one port is completely saturated by inbound traffic.
Please refer to appendix D for example settings.
A typical scenario of how traffic is directed with DNS Inbound Load Balancing is illustrated below:
- 14 -

Multi-Homing Security Gateway User’s Manual
WAN 1 WAN 2
DNS Server
Bandwidth Monitor
1
2
3
4
5
6
URL Host Map
7
8
9
10
DNS Re
q
uest
DNS Re
p
l
y
HTTP Re
q
uest
HTTP Re
p
l
y
11
HTTP Serve
r
In the example above, the client is making a DNS request.
(1). The request is sent to the DNS server of MH-1000 through WAN2.
(2). WAN2 will route this request to the embedded DNS server of MH-1000.
(3). MH-1000 will analyze the bandwidth of both WAN1 and WAN2 and decide which WAN IP to reply to the
request.
(4). After the decision is made, MH-1000 will route the DNS reply to the user through WAN2.
(5). The user will receive the DNS reply with the IP address of WAN1.
(6). The browser will initiate an HTTP request to the WAN1 IP address.
(7). The HTTP request will be send to MH-1000’s URL Host Map.
(8). The Host Map will then redirect the HTTP request to the HTTP server.
(9). The HTTP server will reply.
(10). The URL Host Map will route the packet through WAN1 to the user.
(11). Finally, the client will receive an HTTP reply packet.
- 15 -

Multi-Homing Security Gateway User’s Manual
2.6 Virtual Private Networking
A Virtual Private Network (VPN) enables you to send data between two computers across a shared or
public network in a manner that emulates the properties of a point-to-point private link. As such, it is perfect
for connecting branch offices to headquarters across the Internet in a secure fashion.
The following section discusses Virtual Private Networking with MH-1000.
2.6.1 General VPN Setup
There are typically three different VPN scenarios. The first is a Gateway to Gateway setup, where two
remote gateways communicate over the Internet via a secure tunnel.
The next type of VPN setup is the Gateway to Multiple Gateway setup, where one gateway
(Headquarters) is communicating with multiple gateways (Branch Offices) over the Internet. As with all
VPNs, data is kept secure with secure tunnels.
The final type of VPN setup is the Client to Gateway. A good example of where this can be applied is
when a remote sales person accesses the corporate network over a secure VPN tunnel.
100.100.100. myID.dyndns.org
192.168.2.x
Secure Tunnel VPN Client
100.100.100.1
200.200.200.1
192.168.2.x
192.168.3.x
Secure Tunnel
201.201.201.1
192.168.4.x
Secure Tunnel
192.168.2.x
192.168.3.x
Secure Tunnel
100.100.100.1 200.200.200.1
- 16 -