- DL manuals
- QNO
- Network Router
- Security QoS Firewall Router
- User Manual
QNO Security QoS Firewall Router User Manual
Summary of Security QoS Firewall Router
Page 1
English user’s manual security qos firewall router 2x100mbps wan + 2x100mbps switch lan (wan2/dmz) fully integrated smb solution.
Page 2
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r i product manual using permit agreement [product manual (hereafter the "manual") using permit agreement] hereafter the "agreement" is the using permit of the manual, and the relevant rights and obligations between the users and qno ...
Page 3
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r ii commercial loss to the user or relevant personnel due to the possible omission. 【4-2】in order to protect the autonomy of the business development and adjustment of qno, qno reserves the right to adjust or terminate the software /...
Page 4
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r iii content i. Introduction .................................................................................................................................. 6 ii. Multi- wan security qos router installation ..........................
Page 5
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r iv 8.1 bandwidth management ............................................................................................................................... 72 8.1.1 the maximum bandwidth provided by isp ................................
Page 6
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r v appendix i: user interface and user manual chapter cross reference .............................................. 148 appendix ii：troubleshooting........................................................................................
Page 7
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 6 i. Introduction security qos router (referred as security qos router hereby) is a business level security router that efficiently integrates new generation multiple wan-port devices. It meets the needs of medium enterprises, inter...
Page 8
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 7 ii. Multi- wan security qos router installation in this chapter we are going to introduce hardware installation. Through the understanding of multi-wan setting process, users can easily setup and manage the network,making security...
Page 9
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 8 2.2 setting flow chart below is the description for each setting process, and the crospondent contents and purposes. For detailed functions, please refer to appendix i: setting inferface and chapter index. # setting content purpos...
Page 10
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 9 7 set firewall: prevent attack and improper access to network resources block attack, set access rule and restrict web access. Administrators can block bt to avoid bandwidth occupation, and enable access rules to restrict employee...
Page 11
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 10 iii. Hardware installation in this chapter we are going to introduce hardware interface as well as physical installation. 3.1 led signal led signal description led color description power green green led on: power on diag amber a...
Page 12
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 11 installing router on a wall the router has two wall-mount slots on its bottom panel. When mounting the device on a wall, please ensure that the heat dissipation holes are facing sideways as shown in the following picture for safe...
Page 13
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 12 3.2 security qos router network connection wan connection：a wan port can be connected with xdsl modem, fiber modem, switching hub, or through an external router to connect to the internet. Lan connection: the lan port can be conn...
Page 14
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 13 iv. Login this chapter is mainly introducing web- based ui after conneting the device. First, check up the device’s ip address by connecting to dos through the lan pc under the device. Go to start → run, enter cmd to commend dos,...
Page 15
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 14 then, open webpage browser, ie for example, and key in 192.168.1.1 in the website column. The login window will appear as below: the device’s default username and password are both “admin”. Users can change the login password in ...
Page 16
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 15 v. Device spec verification, status display and login password and time setting this chapter introduces the device specification and status after login as well as change password and system time settings for security. 5.1 home pa...
Page 17
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 16 ddns： indicates if dynamic domain name is activated. The default configuration is “off”. Quality of service： indicates how many qos rules are set. Manual connect： when “obtain an ip automatically” is selected, two buttons (releas...
Page 18
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 17 the current port setting status information will be shown in the port information table. Examples: type (10base-t/100base-tx), iniferface (wan/ lan/ dmz), link status (up/ down), physical port status (port enabled/ port disabled)...
Page 19
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 18 5.1.3 system information lan ip/subnet mask： identifies the current device ip address. The default is 192.168.1.1. Working mode： indicates the current working mode. Can be nat gateway or router mode. The default is “nat gateway” ...
Page 20
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 19 5.1.4 firewall status spi (stateful packet inspection)： indicates whether spi (stateful packet inspection) is on or off. The default configuration is “on”. Dos (denial of service)：indicates if dos attack prevention is activated. ...
Page 21
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 20 5.2 change and set login password and time 5.2.1 password setting when you login the device setting window every time, you must enter the password. The default value for the device username and password are bo th “admin”. For sec...
Page 22
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 21 apply： click “apply” to save the configuration. Cancel： click “cancel" to leave without making any change. This action will be effective before ”apply” to save the configuration. 5.2.2 time the device can adjust time setting. Use...
Page 23
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 22 ntp server： if you have your own preferred time server, input the server ip address. Apply： after the changes are completed, click “apply” to save the configuration. Cancel： click “cancel" to leave without making any change. This...
Page 24
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 23 vi. Network this network page contains the basic settings. For most users, completing this general setting is enough for connecting with the internet. However, some users need advanced information from their isp. Please refer to ...
Page 25
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 24 necessary in most environments, some isps in some countries may require it. 6.1.2 lan setting this is configuration information for the device current lan ip address. The default configuration is 192.168.1.1 and the default subne...
Page 26
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 25 changes to internal pcs. Users can make changes according to their actual network structure. 6.1.3 wan & dmz settings wan setting： interface: an indication of which port is connected. Connection type: obtain an ip automatically, ...
Page 27
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 26 use the following dns server addresses： select a user-defined dns server ip address. Dns server： input the dns ip address set by isp. At least one ip group should be input. The maximum acceptable groups is two ip groups. Enable l...
Page 28
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 27 backup interface： select another wan port as link backup when port binding is configured. Users should select the port that employs the same isp. After the changes are completed, click “apply” to save the configuration, or click ...
Page 29
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 28 dns server input the dns ip address issued by isp. At least one ip group should be input. The maximum acceptable is two ip groups. Enable line-dropped scheduling the wan disconnection schedule will be activated by checking this o...
Page 30
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 29 user name input the user name issued by isp. Password input the password issued by isp. Connect on demand this function enables the auto-dialing function to be used in a pppoe dial connection. When the client port attempts to con...
Page 31
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 30 enable line-dropped scheduling the wan disconnection schedule will be activated by checking this option. In some areas, there is a time limitation for wan connection service. For example: the optical fiber service will be disconn...
Page 32
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 31 wan ip address this option is to configure a static ip address. The ip address to be configured could be one issued by isp. (the ip address is usually provided by the isp when the pc is installed. Contact isp for relevant informa...
Page 33
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 32 connect on demand this function enables the auto-dialing function to be used for a pptp dial connection. When the client port attempts to connect with the internet, the device will automatically connect with the default isp auto ...
Page 34
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 33 integrate existing networks without changing the original structure. Select the transparent bridge mode for the wan connection mode. In this way, users will be able to connect normally with the internet while keeping the original...
Page 35
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 34 dns server input the dns ip address set by isp. At least one ip group should be input. The maximum acceptable is two ip groups. Internal lan ip range input the available ip range issued by isp. If isp issued two discontinuous ip ...
Page 36
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 35 ip address: indicates the current default static ip address. Config.: indicates an advanced configuration modification: click edit to enter the advanced configuration page. The dmz configuration can be classified by subnet and ra...
Page 37
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 36 ip range: input the ip range located at the dmz port. After the changes are completed, click “apply” to save the configuration, or click “cancel" to leave without making any changes..
Page 38
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 37 6.2 multi- wan setting when you have multiple wan gateways, you can use traffic management and protocol binding function to fulfill wan road balancing, so that we can have highest network bandwidth efficiency..
Page 39
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 38 6.2.1 load balance mode auto load balance mode when auto load balance mode is selected, the device will use sessions or ip and the wan bandwidth automatically allocate connections to achieve load balancing for external connection...
Page 40
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 39 addresses or servers that are configured in the connection rule will follow the rule for external connections; those which are not configured in the rule will still follow the device auto load balance system. Please refer to the ...
Page 41
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 40 routing policy (division of traffic between telecom and netcom is to be used in china) embedded in the device. All you have to do is to select the wan (or wan group) which is connected with netcom; the device will then automatica...
Page 42
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 41 cancel: click “cancel” to cancel the modification. This only works before “apply” is clicked. After the configuration is completed, in the china netcom policy window users can select wans in combination to connect with netcom. Im...
Page 43
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 42 note! China netcom strategy and self-defined strategy can coexist. However, if a destination ip is assigned by both china netcom strategy and self-defined strategy, china netcom strategy will take priority. In other words, traffi...
Page 44
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 43 click “advanced function” to enter the setting window： destination auto binding： indicates that the session will be connected with the same wan ip when the destination ip is in the same class b range. For example, there are wan1-...
Page 45
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 44 user define dis. Or port auto binding： indicates that the intranet ip will connect through the same wan ip when the service ports are self- defined. You can self- define the service ports and destination ip. (if the destination i...
Page 46
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 45 47 it will go through the same wan ip. As for which wan will be selected, this follows the first- chosen wan ip distributed by the original session balance mechanism. For example, there are two intranet ip- 192.168.100.1 and 192....
Page 47
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 46 retry timeout: delay time for external connection detection latency. The default is 30 seconds. After the retry timeout, external service detection will restart. When fail: (1) generate the error condition in the system log: if a...
Page 48
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 47 isp host: this is the detected location for the isp port, such as the dns ip address of isp. When configuring an ip address for this function, make sure this ip is capable of receiving feedback stably and speedily. (please input ...
Page 49
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 48 bandwidth configuration when auto load balance mode is selected, the device will select sessions or ip and the wan bandwidth will automatically allocate connections to achieve load balancing for external connections. The network ...
Page 50
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 49 service: this is to select the binding service port to be activated. The default (such as all-tcp&udp 0~65535, www 80~80, ftp 21 to 21, etc.) can be selected from the pull-down option list. The default service is all 0~65535. Opt...
Page 51
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 50 connections to destination ip address 210.11.1.1 are to be restricted to wan1, the external static ip address 210.1.1.1 ~ 210.1.1.1 should be input. If a range of destinations is to be assigned, input the range such as 210.11.1.1...
Page 52
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 51 from “service management” to arrange the list, as described in the following： service name: in this box, input the name of the service port which users want to activate, such as bt, etc. Protocol: this option list is for selectin...
Page 53
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 52 auto load balancing mode when enabled： the collocation of the auto load balance mode and the auto load mode will enable more flexible use of bandwidth. Users can assign specific intranet ip addresses to specific destination appli...
Page 54
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 53 example 2：how do i set up auto load balance mode to keep intranet ip 192.168.1.150 ~ 200 from going through wan2 when the destination port is port 80? As in the figure below, select “http [tcp/80~80]” from the pull-down option li...
Page 55
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 54 with only the above rule, packets that do not go to port 80 may be transmitted through wan2; therefore, a second rule is necessary. The second rule: select “all ports [tcp&udp/1~65535]” from the pull- down option list “service”, ...
Page 56
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 55 routing” can it bring the function into full play. Example 1：how do i set up the assigned routing mode to keep all intranet ip addresses from going through wan2 when the destination is port 80, and keep all other services from go...
Page 57
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 56 example 2：how do i configure protocol binding to keep traffic from all intranet ip addresses from going through wan2 when the destinations are ip 211.1.1.1 ~ 211.254.254.254 as well as the whole class a group of 60.1.1.1 ~ 60.254...
Page 58
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 57.
Page 59
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 58 vii. Intranet configuration this chapter introduces how to configure ports and understand how to configure intranet ip addresses. 7.1 port management through the device, users can easily manage the setup for wan ports, lan ports ...
Page 60
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 59 speed status： this feature allows users to select the network hardware connection speed for the ethernet port. The options are 10mbps and 100mbps. Duplex status： this feature allows users to select the network hardware connection...
Page 61
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 60 7.2 port status summary： there are network connection type, interface, link status (up/down), port activity (port enabled), priority setting (high or normal), speed status (10mbps or 100mbps), duplex status (half duplex or full d...
Page 62
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 61 7.3 ip/ dhcp with an embedded dhcp server, it supports automatic ip assignation for lan computers. (this function is similar to the dhcp service in nt servers.) it benefits users by freeing them from the inconvenience of recordin...
Page 63
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 62 dynamic ip： client lease time： check the option to activate the dhcp server automatic ip lease function. If the function is activated, all pcs will be able to acquire ip automatically. Otherwise, users should configure static vir...
Page 64
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 63 7.4 dhcp status this is an indication list of the current status and setup record of the dhcp server. The indications are for the administrator’s reference when a network modification is needed. Dhcp server： this is the current d...
Page 65
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 64 host name： the name of the current computer. Ip address： the ip address acquired by the current computer. Mac address： the actual mac network location of the current computer. Client lease time： the lease time of the ip released ...
Page 66
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 65 add to llist add the items into the list below. Delete selected item delete the items chosen. ※ note! (1) users must enable dchp server service to enable dns local database. (2) users must set dhcp server dns ip address as the ro...
Page 67
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 66 (1) system tool => diagnostic => dns name lookup (2) enter tw.Yahoo.Com for lookup. (3) the ip is 10.10.10.199, confirming the corresponding ip in dns local database..
Page 68
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 67 7.5 ip & mac binding administrators can apply ip & mac binding function to make sure that users can not add extra pcs for internet access or change private ip addresses..
Page 69
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 68 there are two methods for setting up this function： (1)、block mac address not on the list this method only allows mac addresses on the list to receive ip addresses from dhcp and have internet access. When this method is applied, ...
Page 70
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 69 (2)、ip & mac binding static ip： there are two ways to input static ip: 1. If users want to set up a mac address to acquire ip from dhcp, but the ip need not be a specific assigned ip, input 0.0.0.0 in the boxes. The boxes cannot ...
Page 71
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 70 name： for distinguishing clients, input the name or address of the client that is to be bound. The maximum acceptable characters are 12. Enabled： activate this configuration. Add to list： add the configuration or modification to ...
Page 72
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 71 viii. Qos (quality of service) qos is an abbreviation for quality of service. The main function is to restrict bandwidth usage for some services and ip addresses to save bandwidth or provide priority to specific applications or s...
Page 73
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 72 8.1 bandwidth management.
Page 74
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 73 8.1.1 the maximum bandwidth provided by isp in the boxes for wan1 and wan2 bandwidth, input the upstream and downstream bandwidth which users applied for from bandwidth supplier. The bandwidth qos will make calculations according...
Page 75
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 74 attention！ the unit of calculation in this example is kbit. Some software indicates the downstream/upstream speed with the unit kb. 1kb = 8kbit. 8.1.2 qos to satisfy the bandwidth requirements of certain users, the device enables...
Page 76
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 75 interface： select on which wan the qos rule should be executed. It can be a single selection or multiple selections. Service port： select what bandwidth control is to be configured in the qos rule. If the bandwidth for all servic...
Page 77
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 76 ip address： this is to select which user is to be controlled. If only a single ip is to be restricted, input this ip address, such as “192.168.1.100 to 100”. The rule will control only the ip 192.168.1.100. If an ip range is to b...
Page 78
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 77 bandwidth sharing ： sharing total bandwidth with all ip addresses: if this option is selected, all ip addresses or service ports will share the bandwidth range (from minimum to maximum bandwidth). Assign bandwidth for each ip add...
Page 79
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 78 example 1. How to set up the maximum download speed to 50 kbit for the ftp protocol on all wan interfaces ? Please refer to the following as a setup example. Click before both wan1 and wan2; then choose "ftp [tcp/21~21]" in servi...
Page 80
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 79 example 2. How to set up the maximum download speed of each wan to 512kbit/sec for each lan user? One by one ip to set up? No need to set up one by one. Below is the example. Click both wan1 and wan2; then choose “no check port[t...
Page 81
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 80
Page 82
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 81 8.2 session control session management controls the acceptable maximum simultaneous sessions of intranet pcs. This function is very useful for managing connection quantity when p2p software such as bt, thunder, or emule is used i...
Page 83
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 82 when single ip exceed __： if this function is selected, when the user’s port session reach the limit, this user will not be able to make a new session for five minutes. Even if the previous session has been closed, new sessions c...
Page 84
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 83 exempted service port or ip address service port： choose the service port. Source ip： input the ip address range or ip group. Enabled： activate the rule. Add to list： add this rule to the list. Delete seleted item： remove the rul...
Page 85
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 84 8.3 smart qos the smart qos function enables the administrators to constrain the bandwidth occupied automatically without any configuring. Enabled qos： choose to apply qos function. When the usage of any wan ’s bandwidth is over ...
Page 86
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 85 scheduling： if “always” is selected, the rule will be executed around the clock. If “from…” is selected, the rule will be executed according to the configured time range. For example, if the time control is from monday to friday,...
Page 87
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 86 ix. Firewall this chapter introduces firewall general policy, access rule, and content filter settings to ensure network security. 9.1 general policy the firewall is enabled by default. If the firewall is set as disabled, feature...
Page 88
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 87 dos (denial of service)： this averts dos attacks such as syn flooding, smurf, land, ping of death, ip spoofing and so on. Block wan request： if set as enabled, then it will shut down outbound icmp and abnormal packet responses in...
Page 89
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 88 advanced setting packet type: this device provides three types of data packet transmission: tcp-syn-flood, udp-flood and icmp-flood. Wan threshold: when all packet values from external attack or from single external ip attack rea...
Page 90
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 89 show blocked ip： show the blocked ip list and the remained blocked time. Restricted web features： it supports the block that is connected through: java, cookies, active x, and http proxy access. Apply： click “apply” to save the c...
Page 91
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 90 9.2 restrict application users can check msn/ skype/ qq/ bt and the device will block the service users checked. However, to provide this service for certain ip address in the intranet, users may check the following item and then...
Page 92
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 91 user name： input the information of the qq number, etc. Exempted qq number： input the number. Add to list： add the number to the list. Delete selected item： delete the selected rule in the list..
Page 93
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 92 9.3 access rule users may turn on/off the setting to permit or forbid any packet to access internet. Users may select to set different network access rules: from internal to external or from external to internal. Users may set di...
Page 94
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 93 in addition to the default rules, all the network access rules will be displayed as illustrated above. Users may follow or self- define the priority of each network access rule. The device will follow the rule priorities one by o...
Page 95
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 94 9.3.1 add new access rule action： allow: permits the pass of packets compliant with this control rule deny: prevents the pass of packets not compliant with this control rule service： from the drop-down menu, select the service th...
Page 96
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 95 dest. Ip： select the destination ip range (such as any, single, range, or preset ip group name) if single or range is selected; please enter a single ip address or an ip address within a session. Scheduling： select “always” to ap...
Page 97
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 96.
Page 98
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 97 example 2.：how to forbid intranet ip range from 192.168.1.200 to 230 to access service port 80? Action：forbid service port：tcp 80 source interface：lan (meaning to service port 80 which blocks the traffic from intranet to internet...
Page 99
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 98 content filter the device supports two webpage restriction modes: one is to block certain forbidden domains, and the other is to give access to certain web pages. Only one of these two modes can be selected. Block forbidden domai...
Page 100
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 99 add： enter the websites to be controlled such as www.Playboy.Com add to list： click ”add to list” to create a new website to be controlled. Delete selected item： click to select one or more controlled websites and click this opti...
Page 101
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 100 website blocking by keywords： enabled： click to activate this feature. The default setting is disabled. For example: if users enter the string ”sex”, any websites containing ”sex” will be blocked. Keywords（only for english keywo...
Page 102
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 101 enabled： activate the function. The default setting is “disabled.” add： input the allowed domain name, etc. Www.Google.Com add to list： add the rule to list. Delete selected item： users can select one or more rules and click to ...
Page 103
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 102 exception ip here ip/ip ranges are exempted from “accept allowed domain” through this method. Exception ip address input unrestricted ip/ip range add to list： click this button to add new unrestricted ips delete selected item： s...
Page 104
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 103 always： select “always” to apply the rule on a round-the-clock basis. Select “from”, and the operation will run according to the defined time. …to…： select "always" to apply the rule on a round-the-clock basis. If “from” is sele...
Page 105
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 104 x. Advanced function 10.1 dmz host/ port range forwarding 10.1.1 dmz host when the nat mode is activated, sometimes users may need to use applications that do not support virtual ip addresses such as network games. We recommend ...
Page 106
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 105 use the firewall function to set up the host as a virtual host, and then convert the actual ip addresses (the internet ip addresses) with port 80 (the service port of www is port 80) to access the internal server directly. In th...
Page 107
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 106 service port management the services in the list mentioned above are frequently used services. If the service users want to activate is not in the list, we recommend that users use “service port management” to add or remove port...
Page 108
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 107 delete selected item： to remove the selected services. Apply： click the “apply” button to save the modification. Cancel： click the “cancel” button to cancel the modification. This only works before “apply” is clicked. Close： qui...
Page 109
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 108 10.2 upnp upnp (universal plug and play) is a protocol set by microsoft. If the virtual host supports upnp system (such as windows xp), users could also activate the pc upnp function to work with the device. Service port: select...
Page 110
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 109 10.3 routing in this chapter we introduce the dynamic routing information protocol and static routing information protocol. 10.2.1 dynamic routing the abbreviation of routing information protocol is rip. There are two kinds of r...
Page 111
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 110 rip is a very simple routing protocol, in which distance vector is used. Distance vector determines transmission distance in accordance with the number of routers, rather than based on actual session speed. Therefore, sometimes ...
Page 112
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 111 dest. Ip： subnet mask： input the remote network ip locations and subnet that is to be routed. For example, the ip/subnet is 192.168.2.0/255.255.255.0. Gateway： the default gateway location of the network node which is to be rout...
Page 113
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 112 10.4 one to one nat as both the device and atu-r need only one actual ip, if isp issued more than one actual ip (such as eight adsl static ip addresses or more), users can map the remaining real ip addresses to the intranet pc v...
Page 114
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 113 enabled one to one nat： to activate or close the one-to-one nat function. (check to activate the function). Private ip range begin： input the private ip address for the intranet one-to-one nat function. Public ip range begin： in...
Page 115
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 114 denial rule for access, as described firewall. 10.5 ddns- dynamic domain name service ddns supports the dynamic web address transfer for qnoddns.Org.Cn、3322.Org、 dyndns.Org and dtdns.Com. This is for vpn connections to a website...
Page 116
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 115 * the ui might vary from model to model, depending on different product lines. Interface this is an indication of the wan port the user has selected. Ddns check either of the boxes before dyndns.Org, 3322.Org, dtdns.Com and qnod...
Page 117
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 116 apply after the changes are completed, click “apply” to save the network configuration modification. Cancel click “cancel" to leave without making any changes. Register for qno ddns 1． please go to qno website and register the p...
Page 118
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 117 2． input the e-mail address which users used to register this product and the serial number of the product to log in to the qnoddns service system. Be sure to input an available e-mail address so that the password sent from the ...
Page 119
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 118 3． rules for applying a domain name: ●the domain should have at least 4 letters and no more than 63 letters. ●the domain name should only consist of a-z (lowercase letter) and 0-9 (numerals) and the first character should be an ...
Page 120
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 119.
Page 121
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 120 10.6 mac clone some isp will request for a fixed mac address (network card physical address) for distributing ip address, which is mostly suitable for cable mode users. Users can input the network card physical address (mac addr...
Page 122
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 121 xi. System tool this chapter introduces the management tool for controlling the device and testing network connection. For security consideration, we strongly suggest to change the password. Password and time setting is in chapt...
Page 123
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 122 ping this item informs users of the status quo of the outbound session and allows the user to know the existence of computers online. On this test screen, please enter the host ip that users want to test such as 192.168.5.20. Pr...
Page 124
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 123 11.2 firmware upgrade users may directly upgrade the device firmware on the firmware upgrade page. Please confirm all information about the software version in advance. Select and browse the software file, click "firmware upgrad...
Page 125
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 124 11.3 configration backup import configuration file： this feature allows users to integrate all backup content of parameter settings into the device. Before upgrade, confirm all information about the software version. Select and ...
Page 126
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 125 11.4 snmp simple network management protocol (snmp) refers to network management communications protocol and it is also an important network management item. Through this snmp communications protocol, programs with network manag...
Page 127
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 126 enabled： activate snmp feature. The default is activated. System name： set the name of the device such as qno. System contact： set the name of the person who manages the device (i.E. John). System location： define the location o...
Page 128
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 127 11.5 system recover users can restart the device with system recover button. System recover as the figure below, if clicking “restart router” button, the dialog block will pop out, confirming if users would like to restart the d...
Page 129
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 128 return to factory default setting if clicking “return to factory default setting, the dialog block will pop out, if the device will return to factory default..
Page 130
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 129 xii. Log from the log management and look up, we can see the relevant operation status, which is convenient for us to facilitate the setup and operation. 12.1 system log its system log offers three options: system log, e-mail al...
Page 131
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 130 syslog server： the device provides external system log servers with log collection feature. System log is an industrial standard communications protocol. It is designed to dynamically capture related system message from the netw...
Page 132
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 131 general log the device provides the following warning message. Click to activate the feature. System error message, blocked regulations, regulation of passage permission, system configuration change and registration verification...
Page 133
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 132 outgoing packet log： view system packet log which is sent out from the internal pc to the internet. This log includes lan ip, destination ip, and service port that is applied. It is illustrated as below..
Page 134
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 133 incoming packet log： view system packet log of those entering the firewall. The log includes information about the external source ip addresses, destination ip addresses, and service ports. It is illustrated as below. Clear log ...
Page 135
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 134 12.2 system statistic the device has the real-time surveillance management feature that provides system current operation information such as port location, device name, current wan link status, ip address, mac address, subnet m...
Page 136
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 135.
Page 137
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 136 12.3 traffic statistic six messages will be displayed on the traffic statistic page to provide better traffic management and control. Inbound ip source address： the figure displays the source ip address, bytes per second, and pe...
Page 138
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 137 inbound ip service： the figure displays the network protocol type, destination ip address, bytes per second, and percentage. Outbound ip service： the figure displays the network protocol type, destination ip address, bytes per s...
Page 139
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 138 inbound ip session： the figure displays the source ip address, network protocol type, source port, destination ip address, destination port, bytes per second and percentage. Outbound session： the figure displays the source ip ad...
Page 140
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 139 specific ip status： enter the ip address that users want to inquire, and then the entire destination ip connected to remote devices as well as the number of ports will be displayed..
Page 141
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 140 specific port status： enter the service port number in the field and ip that are currently used by this port will be displayed. 12.5 connection statistic (future feature) connection statistic function is used to record the numbe...
Page 142
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 141 pc there are currently traffic： display current pc amounts having outbound connections. If the pc does not boot up or is not connected to internet, it will not be counted in the statistic. Lan pc data ordering by： select this fu...
Page 143
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 142 refresh： click the refresh button that the latest data and list will be updated. 12.6 qrtg (qno router traffic grapher) qrtg utilizes dynamic gui and simple statistic to display system status of qno firewall/ router presently, i...
Page 144
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 143 ii. Wan traffic statistic (hourly) graphic and average (up/down stream) (as in the following figures).
Page 145
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 144 * the ui might vary from model to model, depending on different product lines. Iii. Wan traffic statistic (day) graphic and average (up/down stream)(as in the following figures).
Page 146
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 145 * the ui might vary from model to model, depending on different product lines. Iv. Wan traffic statistic (week) graphic and average (up/down stream)(as in the following figures).
Page 147
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 146 * the ui might vary from model to model, depending on different product lines..
Page 148
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 147 xiii. Log out on the top right corner of the web- based ui, there is alogout button. Click on it to log out of the web- based ui. To enter next time, open the web browser and enter the ip address, user name and password to log i...
Page 149
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 148 appendix i: user interface and user manual chapter cross reference this appendix is to show the corresponding index for each chapter and user interface. Users can find how to setup quickly and understand the security qos router ...
Page 150
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 149 general policy 9.1 general policy 9.2 restricted application access rule 9.3 access rule content filter 9.4 content filter advanced function x. Advanced setting dmz/forwarding 10.1 dmz host/ port range forwarding upnp 10.2 upnp-...
Page 151
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 150 appendix ii：troubleshooting (1) block bt download to block bt and prevent downloading by users, go to the “firewall -> content filter" and select "enable website block by keywords," followed by the input of "torrent." this will ...
Page 152
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 151 （2）shock wave and worm virus prevention since many users have been attacked by shock wave and worm viruses recently, the internet transmission speed was brought down and the session bulky increase result in the massive processin...
Page 153
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 152 use the same method to add udp [udp135~139] and tcp [445~445] ports. C. Enhance the priority level of these three to the highest..
Page 154
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 153 （3）block qqlive video broadcast setting qqlive video broadcast software is a stream media broadcast software. Many clients are bothered by the same problem: when several users apply qqlive video broadcast software, a greater sha...
Page 155
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 154 c). Input the following ip address in dest. Ip with repeat operation. 121.14.75.115 60.28.234.117 60.28.235.119 222.28.155.17 qq liveversion：qq live 2008 (7.0.4017.0) tested on: 2008-07-29 after repeated addition, users may see ...
Page 156
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 155 （4）arp virus attack prevention 1. Arp issue and information recently, many cyber cafes in china experienced disconnection (partially or totally) for a short period of time, but connection is resumed quickly. This is caused by th...
Page 157
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 156 arp inquiry except host device b, which responds to host device a when receiving this frame: “the mac address of 192.168.1.1 is 00-aa-00-62-c6- 09”. So host a knows the mac address of host b, and it can send data to host b. Mean...
Page 158
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 157 conduct operation, pining the lan ip to see the packet loss. Enter the ping 192.168.1.1 (gateway ip address) as illustrated. If there are cases of packet loss of the ping lan ip and lf later there is connection, it is possible t...
Page 159
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 158 b) bind the gateway ip and mac address for each pc this prevents the arp from cheating ip and its mac address. First, find out the gateway ip and mac address on the device end. On every pc, start or operate cmd to enter the dos ...
Page 160
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 159 go online or there is packet loss of ping, in the dos screen, input arp –a command to check if the mac address of the gateway is the same with the device mac address. If not, the pc corresponding to the mac address is the source...
Page 161
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 160 after an item is added to the list, the corresponding message will be displayed in the white block on the bottom. However, such method is not recommended because the inquiry of ip/mac addresses of all hosts creates heavy workloa...
Page 162
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 161 click to display ip and mac binding list dialog box. In this box, the unbinding ip and mac address corresponding to the pc are displayed. Enter the "name" of the computer and click on "enabled" with the display of the “√” icon a...
Page 163
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 162 though these basic operations can help solve the problem but qno's technical engineers suggest that further measures should be taken to prevent the arp attack. 1. Deal with virus source as well as the source device affected by v...
Page 164
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 163 4. Provide system administrators with a sophisticated and strong password for different accounts. It would be best if the password consists of a combination of more than 12 letters, digits, and symbols. Forbid and delete some re...
Page 165
S s e e c c u u r r i i t t y y q q o o s s r r o o u u t t e e r r 164 appendix iii：qno technical support information for more information about the qno's product and technology, please log onto the qno's bandwidth forum, refer to the examples of the ftp server, or contact the technical department ...