Planet Networking & Communication MH-5000 User manual

1
Multi-Homing Security
Gateway
MH-5000
Quick Installation Guide

2
Before You Begin
It s best to usea computer with an Ethernet adapter for configuring the MH-5000.
The default IP address for the MH-5000 is 192.168.1.254 (LAN1 at the port number
4) witha Subnet Maskof 255.255.255.0.You will need to assign your computer a
Static IP address within thesame range as theMH-5000 s IP address, say
192.168.1.2 to configure the MH-5000.
Device default value
You should have an Internet account alreadysetup and have been given most of
the following information asthe followingtable. Fill out this table when youeditthe
web configuration ofMH-5000.
Items Default value Newvalue
Password: admin
IP Address ____.____.____.____
Subnet Mask ____.____.____.____
Gateway IP ____.____.____.____
Primary DNS ____.____.____.____
Fixed IP
Secondary DNS ____.____.____.____
PPPoE Username____.____.____.____
PPPoE
PPPoE Password ____.____.____.____
WAN1
(Port 1)
DHCP
Not initialized
IP Address ____.____.____.____
Subnet Mask ____.____.____.____
Gateway IP ____.____.____.____
Primary DNS ____.____.____.____
Fixed IP
Secondary DNS ____.____.____.____
PPPoE Username____.____.____.____
PPPoE
PPPoE Password ____.____.____.____
WAN2
(Port 2)
DHCP
Not initialized
IP Address 10.1.1.254 ____.____.____.____
DMZ1(Port 3) IP Subnet Mask 255.255.255.0 ____.____.____.____
IP Address 192.168.1.254 ____.____.____.____
LAN1(Port 4) IP Subnet Mask 255.255.255.0 ____.____.____.____
IP Address 192.168.2.254 ____.____.____.____
LAN2(Port 5) IP Subnet Mask 255.255.255.0 ____.____.____.____

3
System Architecture
MH-5000is anintegratedsolutionthat can provide enterprises the maximum
securityandthe best resource utilization.Itcontainsstateful inspectionFirewall,
NAT,VPN,IntrusionDetectionSystem,Dynamic Routing,ContentFiltering,
Bandwidth Management, WANload balancer, Anti-Virus and Anti-Spamin asingle
box. Italso features highperformance accelerator andwire-speedVPN
encryption/decryption. It is the most cost-effective solution for enterprise.
Figure 1 MH-5000 default topologyand port value settings.

4
Connectingthe MH-5000
A. First, connectthepower cord to the Power Socket at theback
panelofthe MH-5000 andthen plugthe other end ofthe power
adapter to awall outlet orpower strip. Press the switch to ON
position.The Power LED will turn ON to indicate proper operation.
B. Using an Ethernet cable, insert one end ofthe cabletothe WAN
port on the front panel ofthe MH-5000 andtheother end ofthe
cable to aDSL / Cable modemor other internet access devices.
C. Computers with anEthernet adapter canbe directlyconnected to
anyofthe LANports usinga cross-over Ethernet cable.
D. Computers that act as servers to provide Internet services should
be connectedto the DMZ port usingan Ethernet Cable.

5
Using the Setup Wizard
Acomputer on your LAN1must be assignedanIP address and subnetmaskfrom
the samerange as the IP address andsubnet maskassignedtotheMH-5000,in
order tobeabletomakeanHTTPS connectionusing awebbrowser. TheMH-5000
is assignedan IP address of192.168.1.254 with asubnet mask of255.255.255.0by
default. The computer that will be used to configure theMH-5000 must be assigned
an IPaddress between192.168.1.1 and192.168.1.253withasubnetmaskof
255.255.255.0 to be able toconnect totheMH-5000.This address rangecanbe
changedlater. There are instructions in the MH-5000User sGuide,ifyou donot
knowhow to set the IP address and subnet maskfor your computer.
Step 1 Login
Type “admin”in the
account field, “admin”in
the Password field and
click Login.
Step 2 Run
Setup Wizard
Click the Run Setup
Wizard.
After login to MH-5000 web configuration
BASIC SETUP > Wizard
Open your Web browser
and
type http://192.168.1.254:8080”
or https://192.168.1.254”
into the
URL address box. Then press the
Enter or Return key.

6
Step 3
System Name
Enter the Host Name
and the Domain Name,
followed by clicking the
Next.
BASIC SETUP > Wizard
Step 4 WAN
Connectivity
To setup the firstWAN
link, make WAN1 as the
Default WAN link.
Choose the type of IP
Address Assignment
provided by your ISP to
access the Internet.Here
we have four types to
select. This will
determine howthe IP
address of WAN1 is
obtained.Click Next to
proceed.
BASIC SETUP > Wizard > Next
Step 4.a —
DHCPclient
If DHCP is selected,MH-
5000 will request for IP
address, netmask, and
DNS servers from your
ISP. You can use your
preferred DNS by
clicking the DNS IP
Address and then
completing the Primary
DNS and Secondary
DNS server IP addresses.
Click Next to proceed.
BASIC SETUP > Wizard > Next > DHCP

7
Step 4.b —
Fixed IP
If Fixed IP Address
is selected, enter the
ISP-given IP Address,
Subnet Mask,
Gateway IP, Primary
DNS and Secondary
DNS IP. Click Next to
proceed.
BASIC SETUP > Wizard > Next > Fixed IP
Step 4.c —
PPPoE client
If PPP over Ethernet
is selected, enter the
ISP-given User Name,
Password and the
optional Service Name.
Click Next to proceed.
BASIC SETUP > Wizard > Next > PPPoE
Step 4.d —
Alert Message
Please Note thatan alert
message box “When
changing to none
fixed ip mode,
system will delete
all ip alias!”will
appearwhile you change
Get IP
Automatically
(DHCP) or PPP over
Ethernet but not
Fixed IP Address as
your WAN link.

8
Step 5
SystemStatus
Here we select Fixed
IP method in WAN1
port. Then the MH-5000
provides a short
summary of the system.
Please check if anything
mentioned above is
properly set into the
system. Click Finish to
close the wizard.
BASIC SETUP > Wizard > Next > Next

9
BasicSetup
Setting up aVPN and configuring the Firewall on the MH-5000requires adeeper
understandingofthe protocols andsecurityfeatures ofthe MH-5000than canbe
presentedhere. Ifyouneed additionalinformationabout settingup aVPNor
configuringthe Firewall, please consultyour MH-5000 User s Guide or your Network
Administrator.
Please Note:
Each configuration pagehasbuttons on thebottomlabeled Apply and Reset.When
youconfigure anypage,youmust press the Apply button to makethe configuration
effective. You CANNOT configure multiple pages, and then press Apply.Each page
must havetheconfiguration information ‘applied before going on to the next page.
WAN Settings
The WAN Settings pageallowsyoutomodifytheprotocol thattheMH-5000will use
to connect to your ISP and obtain the necessarynetworkaddress information.
The usage ofthese pages is essentiallythe sameas those introducedin the wizard
pages. The ISP Settings pageallowsyoutomodifythewaythattheMH-5000
obtains its networksettings fromyour Internet Service Provider (ISP). The entry
fields on the page will change depending uponwhich ofthe following options you
choose: Fixed IPAddress,Get IP Automatically, and PPPoE.
1. Get IP Automatically
Ifyour ISP uses the Dynamic Host Configuration Protocol (DHCP) to assignanIP
address, subnet mask, defaultgatewayand DNS addresses, choose this option.

10
2. Fixed IPAddress
Ifyour ISP has assignedyou an IP address that will never change,choosethis
option. When this optionischosen, thefollowingfieldsappear to allowyoutoenter
the networkaddress information. The example showsthat the ISP assigns anIP
61.2.1.1, anetmask255.255.255.248, adefault gateway61.2.1.6, andDNS
(168.95.1.1).

11
3. PPPoE
If your ISP uses Point-to-PointProtocol over Ethernet (PPPoE), choose this option.
When this option is chosen,the followingfields appear to allowyou to enter the
related account information.
IP Address
Assignment FIELD DESCRIPTION
Default WAN
link
(Gateway/DNS)
When Default WAN link is enabled.
All the packets sent out from MH-5000
will be via this port.
Get DNS
Automaticaslly
or DNS IP
Address
Get DNS Automatically àGet DNS
related information from DHCP Server
DNS IP Address àmanuallyspecify
these Primaryand SecondaryDNS
Server information
Routing
Protocol
Determine to enable the dynamic
routingprotocol, to receive RIP
message, to send out the RIP message if
the RIP message is received or not.
Get IP
Automatically
(DHCP)
OSPF Area IDSpecifyOSPF area ID number

12
Default WAN
link
When Default WAN link is enabled.
All the packets sent out from MH-5000
will be via this port.
IP Address /
Subnet Mask Specified IP address and subnet mask
GatewayIPDefault gatewayIP address
DNS IP
Address
Specified Primaryand SecondaryDNS
Server address
Routing
Protocol
Determine to enable the dynamic
routingprotocol, to receive RIP
message, to send out the RIP message if
the RIP message is received or not.
Fixed IP
Address
OSPF Area IDSpecifyOSPF area ID number
Default WAN
link
When Default WAN link is enabled.
All the packets sent out from MH-5000
will be via this port.
Service NameISP vendor (Optional)
User NameThe user name of PPPoE account
Password The password of PPPoE account
Get DNS
Automatically/
DNS IP
Address
Get DNS Automatically àGet DNS
related information from PPPoE ISP
DNS IP Address àmanuallyspecify
these Primaryand SecondaryDNS
Server information
PPP over
Ethernet
Disconnect
button
Throughclick Disconnect button to
disconnect PPPoE line
To simplifythe initial settings of the MH-5000, the NetworkAddress Translation
is automaticallyconfigured if the NAT Basic mode is selected. Then the MH-
5000will let all private-IPtraffic from the subnets of LAN/DMZ ports to access
the Internet using the global IPaddress assigned by the ISP.

13
LAN Settings
The LANSettingspageallowsyou tomodifytheIPaddress andsubnetmaskthat
will identifytheMH-5000 onyour LAN. This is the IPaddress youwill enter in the
URL fieldofyour webbrowser to connect totheMH-5000.ItisalsotheIPaddress
that all ofthe computers and devices on your LAN will use as their Default Gateway.
IP Address -this is theIP address thatwill beassigned totheLAN port. The
default is 192.168.1.254with a subnet maskof255.255.255.0.
IP Subnet Mask -this is the subnet maskcorresponding totheLAN port s IP
address, above. The default is 255.255.255.0.
The IP address assigned totheMH-5000here,mustbe onthe samesubnet(be
withinthesameIP address range) specifiedonthe DHCPServers.The DHCP
Server fields allowyou toconfiguretheMH-5000tobeaDHCPServer on yourLAN.
The MH-5000 can thenautomaticallyassign IPaddresses, subnet masks, default
gatewayandDNS server addresses tocomputers onyourLAN. Thecomputers on
your LAN must have aDHCP client enabled toget their network address information
fromthe MH-5000.
IP PoolStarting Address -the first IP address ofthe range fromwhich the MH-
5000 will assign to each of the computers on your LAN.
Pool Size -the number ofIP addresses whichtheMH-5000 will assign to the
computers on youLAN.

14
FIELD DESCRIPTION Range / Limitation
IP Address LAN port IP address IPv4 format
IP Subnet
Mask LAN port IP subnet masknetmask format
Enable DHCP
Server
Enable LAN port of the
DHCP Sever or not Enable/Disable
IP Pool
Starting
Address
Specifythestartingaddress
of the DHCP IPaddress.
IPv4 format in the LAN
address range
Pool Size(max
size:253)
Specifythe numbers of the
DHCP IP address. 1 ~253
PrimaryDNS
Server
SpecifythePrimaryDNS
Server IPaddress of the
DHCP information.
IPv4 format
Secondary
DNS Server
Specifythe Secondary
DNS Server IPaddressof
the DHCP information.
IPv4 format
Lease time(sec)
SpecifyDHCP information
lease time greater than 0
Routing
Protocol
Determine to enable the
dynamic routingprotocol
(RIP), to receive RIP
message, to send out RIP
message if the messageis
received or not.
None / RIPv1In /
RIPv1In+out / RIPv2In /
RIPv2In+out / OSPF
OSPF Area ID SpecifyOSPF area ID
number
IPv4 format or digital string
(Max9 bits)

15
DMZ Settings
The MH-5000 has one DMZ port for connecting servers that areexposed to the
public Internet for accesses. The DMZ port is assignedan IP address of10.1.1.254
with a subnet maskof255.255.255.0 bydefault.Notethat the DMZ IP address is on
the 10.1.1.x subnet while the LAN ports are on the 192.168.1.x subnet bydefault.
IP Address -this is theIP address thatwill beassigned totheDMZ port. The
default is 10.1.1.254with a subnet maskof255.255.255.0.
IP Subnet Mask -this is the subnet maskcorresponding totheDMZ port s IP
address, above. The default is 255.255.255.0.
The IP address assigned totheMH-5000here,mustbe onthe samesubnet(be
withinthesameIP address range) specifiedonthe DHCPServers.The DHCP
Server fields allowyoutoconfigure the MH-5000to be aDHCP Server on your DMZ.
The MH-5000 can thenautomaticallyassign IPaddresses, subnet masks, default
gatewayand DNS server addresses to computers on your DMZ. The computers on
your DMZ must have aDHCP client enabled toget their networkaddress
information fromthe MH-5000.
IP PoolStarting Address -the first IP address ofthe range fromwhich the MH-
5000 will assign to each of the computers on your DMZ.
Pool Size -the number ofIP addresses whichtheMH-5000 will assign to the
computers on youDMZ.

16
FIELD DESCRIPTION Range / Limitation
IP Address DMZport IPaddress IPv4 format
IP Subnet
Mask DMZport IP subnet mask netmask format
Enable DHCP
Server
Enable DMZport of the
DHCP Sever or not Enable/Disable
IP Pool
Starting
Address
Specifythe startingaddress
of the DHCP IPaddress.
IPv4 format in the DMZ
address range
Pool Size(max
size:253)
Specifythe numbers of the
DHCP IP address. 1 ~253
PrimaryDNS
Server
Specifythe PrimaryDNS
Server IP address of the
DHCP information.
IPv4 format
Secondary
DNS Server
Specifythe Secondary
DNS Server IP address of
the DHCP information.
IPv4 format
Lease time(sec)
SpecifyDHCP information
lease time greater than 0
Routing
Protocol
Determine to enable the
dynamic routingprotocol
(RIP), to receive RIP
message, to send out RIP
message if the message is
received or not.
None / RIPv1In /
RIPv1In+out / RIPv2In /
RIPv2In+out / OSPF
OSPF Area ID SpecifyOSPF area ID
number
IPv4 format or digital string
(Max9 bits)

17
Virtual Server Settings
VirtualServers are computers connectedusing the DMZ port. Theyact as servers
to provideservices to your LAN ports or other Internet users on the WAN ports. The
Virtual Server settingpagemaps one global IP address -anIP address that is valid
on theInternet,usuallyassigned byyour ISP -to onelocalIP address fromthe IP
address rangeassignedtothe MH-5000 s DMZ port. The defaultDMZ IPaddress is
10.1.1.254, so theservers IP must range from10.1.1.1to 10.1.1.253,withasubnet
maskof255.255.255.0.
Figure 2 Internet host connects to the Virtual Server behind MH-5000.
As the aboveFigure 2illustrated, the server 10.1.1.5 provides FTP service and is
located on the DMZ region behind MH-5000. Bythis way,MH-5000 will act as a
Virtual Server role which redirects thepackets to the real server 10.1.1.5.And you
can announce to the internet users that the ftp server ip/port is 61.2.1.1/44444. So,
all ofthe internet users canconnect the 61.2.1.1/44444 to get ftp service.
Anexamplevirtual server: Customizethe rule nameas the ftpServer. For any
packets withits destinationIP equalingtotheWAN1 IP (61.2.1.1) anddestination
port equalingto 44444,ask MH-5000 totranslate thepacket sdestinationIP/port
into10.1.1.5/21.Checkthe Passive FTP client atthis port tomaximizethe
compatibilityoftheFTPprotocol. This is useful ifyouwanttoprovideconnectivityto
passive FTPclients. For passive FTPclients, the server will return themthe private
IP address andtheportnumber for themto connectbackto dodatatransmissions.
Since the private IPfromthemcannot be routed toour zone, thedataconnections
would fail. After enablingthis feature,theMH-5000will translatetheprivateIP/port
intoan IP/port ofits own. Thus theproblemis gracefullysolved.

18
Another point is to be sure to check “Auto update to Firewall/NATrules when you
Applythis page?”. Then,the virtual server rule will add Firewall/NATrules
automatically.ClickApplyto proceed.
FIELD DESCRIPTION
Activate this rule The Virtual Server rule isenabled or not
Status Rule name The Virtual Server rule name
Sessions from
Internet
connectingto
Which interface does the connected session
come from?
External IPThe public IPaddress ofthe Virtual Server.
Service TCP or UDP protocol
Type Port is Single or Range
Dest Port The port number in the internet.
Condition
Passive FTP
client?
If the Passive FTP client is checked, it will
connect to the internal DMZFTP server of
MH-5000 when FTP client uses passive
mode. Otherwise, it will not work.

19
Redirect to
internal server
under
The subnet which is located the virtual
server.
Translated dest IP The IPaddress which is actuallytransferred
to the internal DMZ
Translated dest
port
The port number which is actually
transferred to the internalDMZ.
Auto update to
Firewall rules
when you Apply
this page?
Ifyou checked this, it will add a Firewall
rule automaticallywhen you add a virtual
server rule.
Action
Auto update to
NAT rules when
you Applythis
page?
Ifyou checked this, it will add a NAT rule
automaticallywhen you add a virtual server
rule.