Smoothwall S4 User manual

Getting Started Guide
For future reference:
Serial number:
Date installed:
Smoothwall contact:

Disclaimer
Entire contents © 2001 – 2019 Smoothwall Ltd. All rights reserved.
Reproduction of this document in any form without prior permission is forbidden.
The information contained herein has been obtained from sources believed to be reliable. Smoothwall Ltd
disclaims all warranties as to the accuracy, completeness or adequacy of such information. Smoothwall Ltd shall
have no liability for errors, omissions or inadequacies in the information contained herein or for interpretation
thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended
results. The content herein is subject to change without notice.
All brands or product names used in this document are acknowledged.

Contents
About this guide 4
Audience and scope 4
Related information 4
Introduction to the appliance 5
About the appliance 5
Reviewing package contents 5
Reviewing the panel and ports 6
Panel Menu 7
Installing the appliance 8
Installing as a basic web proxy 8
Installing in firewall mode 9
Getting started 10
Registering the appliance 10
Configuring the appliance for your network 12
Change the IP address 12
Create an external connection 14
Updating the Smoothwall 16
Getting the latest guardian blocklists 17

Page 4 of 17
About this guide
This guide provides you with a walk through of the initial setup of your Smoothwall appliance.
Audience and scope
This guide is aimed at system administrators maintaining and deploying the appliance.
It assumes the following prerequisite knowledge:
lAn overall understanding of the functionality of Secure Web Gateway or Unified Threat Management.
lAn overall understanding of networking concepts.
Note: We strongly recommend that everyone working with Smoothwall products attend Smoothwall training. For information
on our current training courses, contact your Smoothwall representative.
Related information
For additional information relating to your appliance see:
lhttps://help.smoothwall.net/product_documentation contains the latest user assistance.
lhttps://kb.smoothwall.com contains helpful articles to help you troubleshoot problems.

Page 5 of 17
Introduction to the appliance
About the appliance
The S4 appliance is most suited to a small to medium sized business or retail environment, and is ideal for use in a regional office
in association with a larger appliance at your headquarters. The S4 can support between 100 and 500 users.
The Smoothwall appliances come preinstalled with Smoothwall and provides you with the hardware platform required to run
either:
Secure Web Gateway delivering the features you need to provide a security online experience for all types of users. Smoothwall’s
web content filtering analyzes actual page content to make an intelligent filtering decision.
OR
Unified Threat Management delivering all the features of the Secure Web Gateway paired with a next generation firewall to give you
total protection.
For the latest Smoothwall product documentation, refer to http://help.smoothwall.net/product_documentation.
Reviewing package contents
Your package contains the items needed to initially set up an Appliance.
For a detailed hardware specification, refer to your Smoothwall representative.
Component Information
S4/S8 The S4/S8 appliance.
AC power cord (US and UK) Provided with the appliance.
Ethernet crossover cable Provided with the appliance.
Getting started Guide This guide.
Information sheets Applicable warranty and certification sheets.

Page 6 of 17
Reviewing the panel and ports
The image below provides an overview of the appliance’s ports, buttons and screen:
Object Description
Ports Port 1 is the default interface.
All other ports can be used to provide internal networking zones and external connections.
If required, you can configure ports 3 and 4 to be shorted together to provide a bypass port.
This leaves the client network with unfiltered network access without having to re-cable.
Console Can be used to connect a console and administer the appliance.
USB ports Connection of external storage devices and keyboard, if required.
Power
Indicates when the power supply to the appliance is on. The power button on the rear of the
appliance.
To initiate a clean shutdown when the appliance is running, press the power button.
To force a power off, press and hold the power button for five seconds.
Note: It is not usually necessary to use the power button to power on the appliance, as
applying mains power should automatically start it.
Hard disk drive activity Indicates hard disk drive activity.
Reset Can be used to reset the appliance if it becomes unresponsive.
Screen By default, the panel screen runs in information mode and displays the following information:
lCurrent bandwidth usage on the external connection
lThe internal IP address
lCurrent memory usage
lThe hostname
lTime and date
This is also where you view and access the panel menu options available.
Up Used to access and scroll through the panel menu.
Down Used to access and scroll through the panel menu.
ESC Used to cancel panel menu options.

Page 7 of 17
Object Description
ENTER Used to select and confirm panel menu options. This button can also be used to advance the
display of information when the LCD is in idle mode.
Panel Menu
The panel menu enables you to reset administrator access and settings as well as reboot or shut down the appliance.
To access the panel menu:
1. On your keyboard, press either Up or Down to access the menu.
2. Continue to press Up or Down to navigate through the various menu options. The menu options available are:
lReset Admin Access — Select to reset the default rule which allows administrators to access and configure the
S4/S8 appliances from any source IP that can route to the first network interface.
lRestore Default Settings — Restores the S4/S8 appliances to the settings it had on first boot.
lReboot — Reboots the appliance immediately.
lShutdown — Prompts the appliance to perform a system shutdown.
3. Select the option you require and press ENTER to confirm your selection.

Page 8 of 17
Installing the appliance
This section describes the steps needed to install the appliance in a number of scenarios, including:
lInstalling as a basic web proxy
lInstalling in firewall mode
Installing as a basic web proxy
This is the simplest scenario. The appliance is deployed using only one interface plugged into the network. Typically, this is used in
a Secure Web Gateway installation.
To do a basic installation:
1. Place the appliance in a stable and secure location.
2. Connect an Ethernet cable from port 1 on the appliance to your network; the other ports are not used:
3. Using the supplied AC power cord, connect the appliance to the power supply. The appliance boots.
Note: On initial start-up your appliance will perform a series of system configuration tasks. Please be patient while your
appliance completes this initial start-up procedure.
If the appliance does not power on and boot automatically, hold down the key on the keypad for one second.

Page 9 of 17
Installing in firewall mode
This section describes how to install the appliance as a firewall. Typically, this is used in a Unified Threat Management installation.
To install the appliance as a firewall:
1. Place the appliance in a stable and secure location.
2. Connect an Ethernet cable from your network switch to port 1 of the appliance.
3. Connect an Ethernet cable from a port on the appliance to an external network, or internet connected router or firewall.
4. Using the AC power cord, connect the appliance to the power supply. The appliance boots.
Note: On initial start-up your appliance will perform a series of system configuration tasks. Please be patient while your
appliance completes this initial start-up procedure.
If the appliance does not power on and boot automatically, hold down the key on the keypad for one second.

Page 10 of 17
Getting started
This section describes the initial setup of the appliance, including:
lRegistering the appliance
lConfiguring the appliance for your network
lUpdating the Smoothwall
lGetting the latest guardian blocklists
Registering the appliance
You must register the appliance before you can use it.
Note: The appliance comes with pre-assigned internal IP addresses to allow access for the initial configuration, after which
you must change them.
To register the appliance:
1. From a device on the same subnet as the Smoothwall System, start a web browser and connect to Smoothwall System via
HTTPS, using the URL: https://192.168.110.1:441/
or via HTTP, using the following URL: http://192.168.110.1:81/
If the computer is not in the same subnet, you can add an alias or second IP to your computer’s network card, for example:
192.168.110.2 subnet mask 255.255.255.0.
If your appliance is used in a Secure Web Gateway installation, and you need to specify a gateway, use one appropriate to
your network.
2. Accept the appliance’s security certificate and when the Login page opens, enter the following credentials:
lUsername - Enter admin. This is the default account used to administer the Smoothwall System.
lPassword - Enter smoothwall. This is the default password for the admin username.
3. Click Login.
4. When prompted, enter the following information:
lSerial number - The software license key provided by your Smoothwall representative. The serial number determines
whether the appliance is configured as Secure Web Gateway or as Unified Threat Management.
lName - Your organization’s contact person in matters relating to the appliance.
lOrganization - The name of your organization.
lDepartment - The department within your organization that has ownership of the appliance.
lLocality or town - The town, or location, in which your organization is located.
lState - The state in which your organization is located.
lCountry - The country in which your organization is located.
lEmail - Email address of your organizations appliance contact.
5. Click Save. Review the information you have supplied.
6. Click Confirm. The appliance reboots and configures its initial settings. This can take up to five minutes to complete. Once
the appliance has rebooted, the browser will refresh back to the login prompt.
7. Re-enter the default username and password.
8. Click Login.

Page 11 of 17
9. When prompted, enter the following information:
lTimezone - From the Timezone drop-down list, select your timezone.
lAdmin password - Enter your new system administrator password, re-entering the new admin password in the Again
field to confirm consistent password entry.
lRoot password - Enter your new system root password, re-entering the new root password in the Again field to
confirm consistent password entry.
lInitial web filter policy setup - Select one of the following web filter policies:
Option/field Description
Education web filter
policy
This is designed to protect students and is highly restrictive. It is suitable to use as a basis
for British Educational Communications and Technology Agency (BECTA) compliance.
Workplace/productivity
web filter policy
This policy blocks adult, drug, and gambling content. It also blocks social networking, and
other sites that may impact productivity at work.
Workplace web filter
policy
This policy is a less restrictive workplace web filtering policy. It only blocks adult, drug, and
gambling content.
CIPA web filter policy
This is a minimal web filtering policy designed to comply with the USA's Children's Internet
Protection Act (CIPA).
Note: The CIPA web filter policy does not include an intolerance category as the
American Civil Liberties Union (ACLU) considers such a category to be a violation of
the USA constitution's First Amendment.
10. Click Save. The appliance applies your selection and displays the Dashboard which is its default home page containing
external connectivity controls and a number of reports. The browser will refresh back to the login prompt.
11. Enter your new login credentials and click Login.
Note: The S2 Appliance displays a warning message stating it is unable to register. This warning remains up to 5 minutes
after the appliance has an IP address and correct DNS assigned, and has successfully connected to the Internet.

Page 12 of 17
Configuring the appliance for your network
To use the appliance on your network, you must do the following:
lChange the IP address
lCreate an external connection
Change the IP address
The appliances have pre-assigned internal IP addresses. You must change them to make the appliance accessible on your
network.
Tip: The safest method is to add an additional IP address to the interface, then delete the preassigned address. This way,
should the wrong IP address be configured, you can still access the administration user interface to correct it.
To change the IP address, do the following:
1. Browse to Network >Configuration >Interfaces.
2. Click the IP addresses link for the relevant interface to display the Attached addresses table.
3. Click Add new IP address.
4. Complete the following:
lStatus — New IP addresses are enabled by default.
lType — Choose whether this IP address is assigned a static IP address (Static IPv4), or an IP address assigned via
DHCP (DHCP IPv4). Depending the type of IP address, additional parameters may require configuration:
Use as Additional Parameter Description
Static IPv4 IP address Enter the additional IP address for this interface.
Subnet mask Enter the subnet mask for the IP address.
Gateway
If traffic from this IP address needs to go through a gateway, select User defined,
and either enter it into the box provided, or choose it from the drop-down list.
Else, leave None selected.
Bandwidth
This parameter is only displayed if a User defined Gateway is configured.
If multiple gateways are configured and used, enter the minimum bandwidth used
to load balance traffic between connections. If a single gateway is configured,
load balancing is not used so this parameter can be left at 1.
Select whether the configured value is in kilobits per second (kbps), or in megabits
per second (Mbps).
Connection monitoring
This parameter is only displayed if a User defined Gateway is configured.
Connection monitoring is enabled by default.
It is not recommended you disable connection monitoring for external gateways,
otherwise the S2 assumes the gateway always has an internet connection.
DHCP IPv4
Bandwidth
If multiple gateways are configured and used, enter the minimum bandwidth used
to load balance traffic between connections. If a single gateway is configured,
load balancing is not used so this parameter can be left at 1.

Page 13 of 17
Use as Additional Parameter Description
Select whether the configured value is in kilobits per second (kbps), or in megabits
per second (Mbps).
Connection monitoring
Connection monitoring is enabled by default.
It is not recommended you disable connection monitoring for external gateways,
otherwise S2 assumes the gateway always has an internet connection.
DHCP client hostname Optionally, enter the DHCP client hostname as specified by the DHCP server.
lComment — If require, enter any information relating to this IP address.
If comments have been added, the Show comments button is displayed on the Attached addresses table. Clicking
this displays comments added for the IP address.
5. Click Add. The appliance applies the new IP address to the interface.
6. Log out of the administration user interface, and browse to the new IP address, via HTTPS using port 441 or HTTP using
port 81.
7. Browse to Network >Configuration >Interfaces.
8. Click the IP addresses link for the relevant interface to display the Attached addresses table.
9. Locate and select the pre-assigned IP address.
10. Click Delete.
11. Browse to Network >Configuration >DNS.
12. From the Global panel, select System internal DNS server.
13. Click Save changes.
14. From the DNS forwarders panel, click Add new DNS forwarders to configure the DNS servers for the DNS proxy service to use
when resolving requests as follows:
lStatus - New DNS forwarders are enabled by default.
lServer IP address - Either enter the server IP addresses, or select the relevant DNS IP addresses, or range from the
drop-down list.
For a detailed description about working with address objects, refer to the Smoothwall product help
https://help.smoothwall.com
lLink Load Balancing pool or Local IP address - Leave this option as Default.
For a detailed description about link load balancing, refer to the Smoothwall product help
https://help.smoothwall.com
lComment - Enter an optional comment for this DNS server.
lShow comments - Displayed on the DNS forwarders table if any comments have been added. Clicking this displays
the comments added for the server IP address.
15. Click Add.
16. Browse to the Web proxy >Web proxy >Settings.
17. Click Save and Restart to apply the changes to the web proxy.

Page 14 of 17
Create an external connection
If your Smoothwall system is to provide access to the Internet, you must configure the connection details as follows:
Note: The following instructions are for external connections made through a NIC (Network Interface Card) interface. You can
also configure an external connection to use a PPPoE connection. For a detailed description of how to configure a PPPoE
connection, refer to the Smoothwall product help https://help.smoothwall.net.
1. Browse to Network >Configuration >Interfaces.
2. Select the relevant interface, and click Edit.
3. Complete the following:
lName — Enter a meaningful name for this connection.
lUse as — Select External.
lSpoof MAC — If MAC address spoofing is required, enter the new MAC address here.
lMTU — If required, you can set the Maximum Transmission Unit (MTU) size, in bytes, for this connection.
lComment — Enter an optional comment for this external interface.
If any comments are added, a Show comments button is displayed allowing interface comments to be reviewed.
4. Click Save changes.
You must assign the IP address, and gateway if provided, as advised by your ISP. This can either be a static IP address or
one assigned dynamically.
5. Click the IP addresses link for the external interface to display the Attached addresses table.
6. Click Add new IP address.
7. Complete the following:
lStatus — New IP addresses are enabled by default.
lType — Choose whether this IP address is assigned a static IP address (Static IPv4), or an IP address assigned via
DHCP (DHCP IPv4).
Depending the type of IP address, additional parameters may require configuration:

Page 15 of 17
Use as Additional Parameter Description
Static IPv4 IP address Enter the additional IP address for this interface.
Subnet mask Enter the subnet mask for the IP address.
Gateway
If traffic from this IP address needs to go through a gateway, select User defined,
and either enter it into the box provided, or choose it from the drop-down list.
Else, leave None selected.
Bandwidth
This parameter is only displayed if a User defined Gateway is configured.
If multiple gateways are configured and used, enter the minimum bandwidth
used to load balance traffic between connections. If a single gateway is
configured, load balancing is not used so this parameter can be left at 1.
Select whether the configured value is in kilobits per second (kbps), or in
megabits per second (Mbps).
Connection monitoring
This parameter is only displayed if a User defined Gateway is configured.
Connection monitoring is enabled by default.
It is not recommended you disable connection monitoring for external gateways,
otherwise the S2 assumes the gateway always has an internet connection.
DHCP IPv4
Bandwidth
If multiple gateways are configured and used, enter the minimum bandwidth
used to load balance traffic between connections. If a single gateway is
configured, load balancing is not used so this parameter can be left at 1.
Select whether the configured value is in kilobits per second (kbps), or in
megabits per second (Mbps).
Connection monitoring
Connection monitoring is enabled by default.
It is not recommended you disable connection monitoring for external gateways,
otherwise S2 assumes the gateway always has an internet connection.
DHCP client hostname Optionally, enter the DHCP client hostname as specified by the DHCP server.
lComment — Enter an optional comment for this IP address.
If comments have been added, the Show comments button is displayed on the Attached addresses table. Clicking
this displays comments added for the IP address.
8. Click Add. The appliance applies the new IP address to the interface.

Page 16 of 17
Updating the Smoothwall
You must ensure the S2 Appliance has the latest Smoothwall software release and update:
lReleases provide new features and product improvements.
lUpdates provide bug fixes and enhancements to address potential security threats.
The Smoothwall must be connected to the Internet in order to discover, download and install system updates. Smoothwall’s
support systems are directly integrated with the Smoothwall’s update procedure.
To check for and install releases and updates:
1. Browse to System > Maintenance > Updates and releases.
2. In the Update: fix and patch your installed release section, click Check for updates.
lIf an update exists it will be listed under Available updates.
lIf a new release exists it will be listed under the Available releases, in the Releases: new functionality and major
upgrades section.
3. If you want to:
lReview Update/Release details:
a. Click Details. Review details of the current update including any previous release updates.
b. Click OK to close the Update information dialog.
lInstall the Smoothwall Update/ Release:
a. Click Install. Details of the update, including details of any previous release updates are displayed.
b. Click Install and reboot.
lSchedule the Smoothwall Update/ Release install at a later time:
a. Click Schedule.
b. Select the preferred update implementation time.
c. Click Apply.
Note: The scheduled update process will automatically reboot the system following the scheduled install.
For a detailed description of further configuration needed for your Smoothwall system, refer to the Smoothwall product help
https://help.smoothwall.net.

Page 17 of 17
Getting the latest guardian blocklists
Guardian blocklists are groups of settings, which are updated on a regular basis by Smoothwall, to maintain the Smoothwall
System’s list of undesirable, inappropriate or objectionable content.
To initiate Guardian blocklists download:
1. Browse to System >Maintenance >Licenses.
2. Within the Blocklist subscriptions panel, click Update.
The Smoothwall System downloads and installs the latest blocklist.
Note: After this initial blocklist download, the Smoothwall will check for updated blocklists hourly. When a new blocklist
becomes available, the Smoothwall automatically downloads and installs the updated blocklist.