Enable SPI:

SPI (Stateful Packet Inspection, also known as dynamic packet filtering) helps to prevent cyber attacks by tracking more state per session. It validates that the traffic passing through the session conforms to the protocol.

NAT Endpoint Filtering:

Select one of the following for TCP and UDP ports:

Endpoint Independent – Any incoming traffic sent to an open port will be forwarded to the application that opened the port. The port will close if idle for 5 minutes.

Address Restricted – Incoming traffic must match the IP address of the outgoing connection.

Address + Port Restriction – Incoming traffic must match the IP address and port of the outgoing connection.

Enable DMZ Host:

If an application has trouble working from behind the D-Link router, you can expose one computer to the Internet and run the application on that computer.

Note: Placing a computer in the DMZ may expose that computer to a variety of security risks. Use of this option is only recommended as a last resort.

IP Address:

Specify the IP address of the computer on the LAN that you want to have unrestricted Internet communication. If this computer obtains it’s IP address automatically using DHCP, be sure to make a static reservation on the Basic > DHCP page so that the IP address of the DMZ machine does not change.

Configuring the Virtual Server on D-Link DI-604:

Step 1: Access the device configuration by entering 192.168.0.1 in your web browser. Login with your username and password. The default username is admin and the password is blank.

Step 2a: If the port you need to forward is a common port, it will be under the predefined virtual server list at the bottom of the page. Click the pad and paper icon next to the virtual server entry you want to use. The Protocol Type and Service Port fields are preconfigured. Click the Enable radio button to use the virtual server. Enter the private IP address of the computer that will use the service port. Configure the Schedule as needed, then Apply your settings.

Step 2b: If the port you need to forward is not listed under the predefined virtual server list at the bottom of the page, you can create a new entry for your application. Click the Enable radio button to use the virtual server. Give your virtual server a name. Next, enter the private IP address of the computer that will use the service port. Then, select the Protocol Type and enter the Service Port. If you don’t know how to use Private and Public port assignment, then just enter the same port number in both fields. Configure the Schedule as needed and Apply your settings.

Step 1: Open the web browser and type the IP address of the D-Link router into address bar (default is 192.168.1.1). Press Enter.

Step 2: Click on the plus sign next to Objects and then select Sevices.

Step 3: Click on Add, and then select the type of service (TCP/UDP Service, ICMP Service, IP Protocol Service, Service Group) from the dropdown menu.

Step 4: Configure the custom service as followed:

Name: enter a name as desired.
Type: select an appropriate type for this service (TCP, UDP, TCP/UDP).
Source: leave as is (By default 0-65535).
Destination: enter a port for this custom service.
Click on OK.

Step 5: Click the Configuration tab and select Save and Activate from the dropdown menu. Click on OK to save and activate the settings.

SYDNEY, Aust. — August 8, 2011

D-Link Australia & New Zealand, the end-to-end networking solutions provider for business and consumers, today introduced the DFL-260E NetDefend™ Unified Threat Management (UTM) Firewall, providing small to mid-sized businesses with comprehensive defence against virus attacks, unauthorised intrusions and harmful content.

The D-Link DFL-260E is the latest addition to D-Link’s NetDefend UTM Firewall family designed to protect small to mid-sized businesses (SMBs) from a wide variety of network threats. It includes the same comprehensive security features as the DFL-860E NetDefend™ UTM Firewall released earlier this year but with capacities and pricing to suit smaller businesses.

The new UTM firewall provides integrated policy-based routing, Network Address Translation, Virtual Private Network (VPN), proactive network security, Intrusion Prevention System (IPS), Web Content Filtering, Anti-Virus Protection, traffic load balancing and bandwidth management in one rack-mountable chassis.

The firewall’s hardware is designed to increase performance, and a web surfing control database contains millions of URLs for Web Content Filtering. Real-time IPS, anti-virus and URL database update services protect the network from application exploits, network worms, malicious code attacks, and provide everything needed to manage employee Internet access behaviour.

The DFL-260E’s network management features include Remote Management, Bandwidth Control Policies, URL/Keyword Blocking, Access Policies and SNMP. For network monitoring, the firewall supports e-mail alerts, system log, consistency checks and real-time statistics.

Maintaining an effective defence requires that all three databases used by the UTM firewall are kept up to date. To provide a robust defence, D-Link offers optional 12-month NetDefend Firewall UTM Services subscriptions which include distinct NetDefend service updates for IPS, Anti-Virus and Web Content Filtering (free three-month trials are also available).

The objective of this document is to provide a guide describing how to configure the devices to achieve the same environment as show at the network topology. Users of this document are expected to already possess basic knowledge of D-Link devices and TheGreenBow VPN program, and are familiar with how to perform basic configurations. Only important configurations, such as those pertaining to interfacing and integrating, will be described in this document.

2. Product used

TheGreenBow_VPN_Client 4.61.003 and DFL-800 are used in the FAQ. The same applies to all other DFL products with Netdefend OS.

3. Network Diagram

Note: Router is set to allow IPSec pass through.

4. Configurations

In this document, we will only describe the main configurations for this Scenario. The configurations setting for all the D-Link products will not be described here and for more detail about the product you can download their user guide.

4.1 TheGreenBow VPN client and DFL-800

In this scenario the user can connect back to the headquarter database by using TheGreenBow VPN client tunneling to DFL-800.

All configurations are based on DFL-800 and TheGreenBow
VPN Client (F/W: 4.61.003)
The steps in this configuration are:
• Setup DFL-800 for VPN tunneling
• Setup Pre-shared Key
• Phase 1 and Phase 2 algorithms setup
• Setting up IPSec-Tunnel
• Setup IP Rules
• Setup TheGreenBow VPN client
• Setup Phase 1
• Setup Phase 2

4.1.1) Setup DFL-800 for VPN tunneling
4.1.1.1) Setup Pre-Shared Key

1) Login to the DFL-800 and click “Authenticate Objects” and add a new “Pre-shared Key” and fill in the passphrase and name

4.1.1.2) Phase 1 and Phase 2 algorithms setup

1) At the “IKE Algorithms”, select the Encryption and Integrity algorithms for your phase 1 authenticate.

2) Next is the “IPSec Algorithms”, select the Encryption and Integrity algorithms for the phase 2.

4.1.1.3) Setting up IPSec-Tunnel

1) After we finish setting up the algorithms, next we will need to create the “IPSec-Tunnel” as show below.

2) Next, click on the “Authentication” tab and select the “PreShared Key” you have setup at the steps 1.

3) After selecting the Pre-Shared Key, next is to enable the “Dynamically add route” at the routing tab.

4) Last step is to make sure the DH Group at the IKE setting is the same setting for the TheGreenBow Client.

4.1.1.4) Setup IP Rules

Now is to setup the IP Rules so there the DFL-800 knows where to direct all the traffic to.

1) First add a new interface group name “IPSec-LAN” by grouping up “IPSec-Tunnel” and “LAN”

2) Next, click “IP Rules” and add a new IP rule as show below.

4.1.2) Setup TheGreenBow VPN Client
4.1.2.1) Setup Phase 1

1) Right click on the “Root” to add a new “Phase1”, next fill in the IP address for this VPN client and Remote gateway IP follow by Preshared Key and IKE setting.

Note: the Preshared Key and IKE must be the same setting set in the DFL-800

4.1.2.2) Setup Phase 2

1) Right click on the “Phase1” to add a new “Phase2”, next fill in the VPN Client address for this VPN client and Remote gateway IP follow by ESP setting.

Note: the ESP Encryption and Authentication setting must be the same in the DFL-800 IPSec-Tunnel.

5.1) Test Result

a. The VPN tunnel will be open at any negotiate mode set in Phase 1 and Phase 2.

b. The DFL will show the tunnel is up at their VPN status.

c. Client is able to Ping to the remote network.

If port 80 is not available (for example , if you are already using port 80 to run a Web server or your ISP blocks access to on port 80*) or are using multiples cameras, you MUST open a second port and designate a new Web server port.

The ports that are opened must be unique for each camera in order to successfully view the images remotely.

Step 1: Open a web browser and type the ip address of your router http://192.168.0.1 in order to open port 81.

Step 2: On your D-link router click on Advanced tab at the top then click on Virtual Server on the left side.

Step 3: Enter valid ports on the Virtual Server section of your router. Please make sure to check the box next to the camera name on the Virtual Server List to enable your settings.

Step 4: Open a web browser and type the IP address of your camera (192.168.0.99) and click on the Setup Tab.

Step 5: Click Network Setup on the left side.

Step 6: Click Enabled, next to Second HTTP Port, and type in the port number you want to use. You can use any port number that is not being used.

Step 7: Click on Save settings.

Step 1 Open a web browser and type the IP address of the DWL-G730AP in the address bar (default is 192.168.0.30). Press Enter.

Step 2 The default username is admin (all lower case) and the default password is blank (nothing). Click OK

Step 3 Click the Advanced tab and then click Firewall to the left.

Step 4 Configure the following:

• Select Enabled to enable the firewall rule or select Disabled to disable it.
• Name – Enter a name to identify the firewall entry.
• Action Select Allow to allow traffic to pass through or Deny to deny traffic to pass through.
• Source – Specify source details:
  • Interface – From the drop-down list select the source interface (WAN, LAN, *).
  • IP Range Start – Enter the starting IP address.
  • IP Range End – Enter the ending IP address.
• Destination – Specify destination details:
  • Interface – From the drop-down list select the destination interface (WAN, LAN, *).
  • IP Range Start – Enter the starting IP address.
  • IP Range End – Enter the ending IP address.
  • Protocol – Select the protocol (TCP, UDP, ICMP, *).
  • Port Range – Enter the starting and ending port numbers.
• Schedule – Select Always to enable the firewall rule or select From to enable the firewall rule on a schedule.

Step 5 Click Apply to add the new firewall rule.

Note: Rules at the bottom of the Firewall Rules List have lower priority then those at the top of the list.

Step 1: Open a web browser and type the IP address of the firewall into the address bar (default is 192.168.1.1). Press Enter.

Step 2: Click on the plus sign (+) next to Interfaces and select PPPoE

Step 3: Click the Add button and Select PPPoE Tunnel.

Step 4: Create the PPPoE Tunnel as Followed:

Step 5: Click OK.

Step 6: Click on the plus sign next to Rules select IP Rules and Select lan_to_wan

Step 7: Right click the drop_smb-all and select Edit.

Step 8: Change the Destination Interface to your Created PPPoE Interface and Click OK.

Allow_standardStep 10: Click on the Configuration tab and select Save and Activate from the dropdown menu. Click on OK to save and activate your changes.

Step 1: Make sure the firewall is using at least firmware 1.30 If the firmware is lower than 1.30 download and install the firmware from the support site.

Step 2: Click on Firewall at the top then VPN on the left hand side.

Step 3: Click on Add new PPTP Server. Give the server a friendly name, set the client IP pool outside of the DHCP scope, and enable proxy arp. Hit the apply button.

Step 4: Click on Users on the left hand side.

Step 5: Click on Add new in the Local User Database.

Step 6: Create a username(Dlink) and password, then hit apply.

Step 7: Click on the Activate Changes button in the lower left corner.

Step 8: Click on the Activate Changes button in the middle of the screen.

2.Configuration of Win2k/WinXP PPTP client

Step 1: Right-click My Network Places and select Properties.

Step 2: Create a New Connection.

Step 3: The Network Wizard will appear. Click on Next to continue.

Step 4: Choose your Network Connection Type (You will be connecting to a private network). Click Next.

Step 5: Enter the Destination Address. This will be your public IP address found on the Status tab of the DFL.

Step 6: Select All Users for the Connection Availability and click Next.

Step 7: Add a shortcut to your desktop and click on Finish.

Step 8: Enter your Username and Password to connect to the virtual private connection. Click the Connect button to authenticate to the DFL. You will see a balloon pop-up indicating that you have connection.

Step 1: Open a web browser and type the IP address of the D-Link DIR series router into the address bar (default is 192.168.0.1).

Step 2: The default username is admin (all lower case) and the default password is blank (nothing). Click on OK.

Step 3: Click on the Tools tab at the top and then click on Schedule on the lefthand side.

Step 4: Configure the following:

• Name – Give your schedule a name
• Day(s) – Check the box for All Week or select the desired time frame.
• All Day 24hrs – Enabling this will have the rule active for a period of 24hrs.
• Start and End time – If 24hrs is not checked you will need to configure your start and end time.

Step 5: Click on Save Settings to save your configuration.