D-LINK SYSTEMS, INC | WIRELESS ROUTER | HOME

Product Page : DIR-685

Hardware Version : A1

Firmware Version : 1.00NA

| Setup | Advanced | Storage | Tools | Status | Support

- Menu
- Setup
- Advanced
- Storage
- Tools
- Status

# Advanced

- Port Forwarding
- Application Rules
- QoS Engine
- Network Filter
- Website Filter
- Firewall Settings
- Routing
- Advanced Wireless
- Advanced Network
- Guest Zone
- Wake on LAN

## Port Forwarding

The Advanced Port Forwarding option gives Internet users access to services on your LAN. This feature is useful for hosting online services such as FTP, Web or game servers. For each entry, you define a public port on your router for redirection to an internal LAN IP Address and LAN port.

Advanced Port Forwarding Parameters
Name - Assign a meaningful name to the virtual server, for example Web Server. Several well-known types of virtual server are available from the "Application Name" drop-down list. Selecting one of these entries fills some of the remaining parameters with standard values for that type of server.
IP Address - The IP address of the system on your internal network that will provide the virtual service, for example 192.168.0.50. You can select a computer from the list of DHCP clients in the "Computer Name" drop-down menu, or you can manually enter the IP address of the server computer.
Application Name - A list of pre-defined popular applications that users can choose from for faster configuration.
Computer Name - A list of DHCP clients.
Traffic Type - Select the protocol used by the service. The common choices -- UDP, TCP and both UDP and TCP -- can be selected from the drop-down menu.
Private Port - The port that will be used on your internal network.
Public Port - The port that will be accessed from the Internet.

## Application Rules

Some applications require multiple connections, such as Internet gaming, video conferencing, Internet telephony and others. These applications have difficulties working through NAT (Network Address Translation). If you need to run applications that require multiple connections, specify the port normally associated with an application in the "Trigger Port" field, select the protocol type as TCP (Transmission Control Protocol) or UDP (User Datagram Protocol), then enter the public ports associated with the trigger port in the Firewall Port field to open them for inbound traffic. There are already defined well-known applications in the Application Name drop-down menu.
Name - This is the name referencing the application.
Trigger Port - This is the port used to trigger the application. It can be either a single port or a range of ports.
Traffic Type - This is the protocol used to trigger the application.
Firewall Port - This is the port number on the WAN side that will be used to access the application. You may define a single port or a range of ports. You can use a comma to add multiple ports or port ranges.
Traffic Type - This is the protocol used for the application.

## QoS Engine

This Smart QoS improves your VoIP voice quality or streaming by ensuring that your VoIP or streaming traffic is prioritized over other network traffic, such as FTP or Web. For best performance, please tick the "lag eliminated" option to automatically set the priority for your applications.

## Network Filter

Filters are used to deny or allow LAN computers from accessing the Internet and also your network. Within your network, the unit can be setup to allow or deny Internet access to computers using their MAC addresses.

MAC Filters
Use MAC Filters to deny computers within the local area network from accessing the Internet. You can either manually add a MAC address or select the MAC address from the list of clients that are currently connected to the unit.
Select "Turn MAC Filtering ON and ALLOW computers with MAC address listed below to access the network" if you only want selected computers to have network access and all other computers not to have network access.
Select "Turn MAC Filtering ON and DENY computers with MAC addresses listed below to access the network" if you want all computers to have network access except those computers in the list.
MAC Address - The MAC address of the network device to be added to the MAC Filter List.
DHCP Client List - DHCP clients will have their hostname listed in the Computer Name drop-down menu. You can select the client computer you want to add to the MAC Filter List and click the arrow button. This will automatically add that computer's MAC address to the appropriate field.

Users can use the Always drop-down menu to select a previously defined schedule or click the Add New button to add a new schedule.

The check box is used to enable or disable a particular entry.

## Website Filter

Along with the ability to filter devices from accessing your network and the Internet, the DIR-685 can also be configured to allow or deny access, for the computers on your network, to inappropriate websites by using a domain name or keywords.

Parental control
Parental control is used to allow or deny computers on your network from accessing specific web sites by using keywords or specific Domain Names. Select "Turn Website Filtering ON and ALLOW computers access to ONLY these sites" to only allow computers on your network to access the specified URLs and Domain Names. "Turn Website Filtering ON and DENY computers access to ONLY these sites" in order to deny computers on your network to access the specified URLs and Domain Names.

Example 1:
If you wanted to block LAN users from any website containing a URL relating to shopping, you would need to select "Turn Website Filtering ON and DENY computers access to ONLY these sites" and then enter "shopping" into the Website Filtering Rules list. Sites like these will be denied access to LAN users because they contain the keyword in the URL.
http://www.yahoo.com/shopping/stores.html
http://www.msn.com/search/shopping-spree.html

Example 2:
If you want your children to only access particular sites, you would then choose " Turn Website Filtering ON and ALLOW computers access to ONLY these sites" and then enter the domains you want your children to have access to.

- Google.com
- Cartoons.com
- Discovery.com

## Firewall Settings

The Firewall Settings section contains an option to configure a DMZ Host.

Enable SPI
SPI ("stateful packet inspection" also known as "dynamic packet filtering") helps to prevent cyber attacks by tracking more states per session. It validates that the traffic passing through that session conforms to the protocol. When the protocol is TCP, SPI checks that the packet sequence numbers are within the valid range for the session, discarding those packets that do not have valid sequence numbers. Whether SPI is enabled or not, the router always tracks TCP connection states and ensures that each TCP packet's flags are valid for the current state.

DMZ
If you have a computer that cannot run Internet applications properly from behind the DIR-685, then you can allow the computer to have unrestricted Internet access. Enter the IP address of that computer as a DMZ (Demilitarized Zone) host with unrestricted Internet access. Adding a client to the DMZ may expose that computer to a variety of security risks; so only use this option as a last resort.

Firewall Rules
Firewall Rules are used to allow or deny traffic coming in to or going out of the router based on the source and destination IP addresses as well as the traffic type and the specific port the data runs on.
Name - Users can specify a name for a Firewall Rule.
Action - Users can choose to allow or deny traffic.
Interface
Source - Use the Source drop-down menu to select if the starting point of the traffic that's to be allowed or denied is from the LAN or WAN interface.
Dest - Use the Dest drop-down menu to select if the ending point of the traffic that's to be allowed or denied is arriving on the LAN or WAN interface.
IP Address - Here you can specify a single source or dest IP address by entering the IP address in the top box or enter a range of IP addresses by entering the first IP address of the range in the top box and the last IP adress of the range in the bottom one.
Protocol - Use the Protocol drop-down menu to select the traffic type.
Port Range - Enter the same port number in both boxes to specify a single port or enter the first port of the range in the top box and last port of the range in the bottom one to specify a range of ports.
Schedule - Use the Always drop-down menu to select a previously defined schedule or click on Add New button to add a new schedule.

## Routing

The Routing option allows you to define static routes to specific destinations.
Enable - Specifies whether the entry will be enabled or disabled.
Interface - Specifies the interface -- WAN or WAN Physical -- that that the IP packet must use to transit out of the router, when this route is used.
Interface (WAN) - This is the interface used to receive the IP Address from the ISP to access the Internet.
Interface (WAN Physical) - This is the interface used to receive the IP Address from the ISP to access the Internet.
Destination - The IP address of packets that will take this route.
Subnet Mask - One bit in the mask that specifies which bits of the IP address must match.
Gateway - Specifies the next hop to be taken if this route is used. A gateway of 0.0.0.0 implies there is no next hop, and the IP address matched is directly connected to the router on the interface specified: WAN or WAN Physical.

## Advanced Wireless

The options on this page should be changed by advanced users or if you are instructed to by one of our support personnel, as this can negatively affect the performance of your router if configured incorrectly.

Transmit Power - You can lower the output power of the DIR-685 by selecting a lower percentage of Transmit Power values from the drop-down menu. Your choices are: 100%, 50%, 25%, and 12.5%.

Beacon Interval - Beacons are packets sent by an Access Point to synchronize with the wireless network. Specify a Beacon interval value between 20 and 1000. The default value is set to 100 milliseconds.

RTS Threshold - This value should remain at its default setting of 2346. If you encounter inconsistent data flow, only minor modifications to the value range between 256 and 2346 are recommended. The default value for RTS Threshold is set to 2346.

Fragmentation - This value should remain at its default setting of 2346. If you experience a high packet error rate, you may slightly increase your "Fragmentation" value within the value range of between 1500 and 2346. Setting the Fragmentation value too low may result in poor performance.

DTIM Interval - Enter a value between 1 and 255 for the Delivery Traffic Indication Message (DTIM). A DTIM is a countdown informing clients of the next window for listening to broadcast and multicast messages. When the Access Point has buffered broadcast or multicast messages for associated clients, it sends the next DTIM with a DTIM Interval value. AP clients hear the beacons and awaken to receive the broadcast and multicast messages. The default value for DTIM interval is set to 1.

Preamble Type - The Preamble Type defines the length of the CRC (Cyclic Redundancy Check) block for communication between the Access Point and roaming wireless adapters. Make sure you select the appropriate preamble type and click the Apply button.

Note: High network traffic areas should use the shorter preamble type. CRC is a common technique for detecting data transmission errors.

CTS Mode - Select None to disable this feature. Select Always to force the router to require each wireless device on the network to perform an RTS/CTS handshake before they are allowed to transmit data. Select Auto to allow the router to decide when RTS/CTS handshakes are necessary.

## Advanced Network

This section contains settings which can change the way the router handles certain types of traffic. We recommend that you don't change any of these settings unless you are already familiar with them or have been instructed to change them by one of our support personnel.

UPnP
UPnP is short for Universal Plug and Play which is a networking architecture that provides compatibility between networking equipment, software, and peripherals. The DIR-685 is a UPnP enabled router, meaning that it will work with other UPnP devices/software. If you do not want to use the UPnP function, it can be disabled by selecting "Disabled".

WAN Ping
When you Enable WAN Ping respond, you are causing the public WAN (Wide Area Network) IP address on the device to respond to ping commands sent by Internet users. Pinging public WAN IP addresses is a common method used by hackers to test whether your WAN IP address is valid.

WAN Port Speed
This allows you to select the speed of the WAN interface of the DIR-685: Choose 100Mbps, 10Mbps, or 10/100/1000Mbps Auto.

Multicast Streams
Enable this option to allow Multicast traffic to pass from the Internet to your network more efficiently.

## Guest Zone

Guest Zone Selection
The selection helps you to define the Guest Zone scale.
Enable Guest Zone - Specifies whether the Guest Zone will be enabled or disabled.
Include LAN Port - Specifies which LAN port will be included in Guest Zone.
Include Wireless - Specifies whether extra wireless zone for Guest Zone to use or not.
Wireless Network Name - Provide a name for Guest Zone wireless network.

Wireless Security Mode
Securing your wireless network is important as it is used to protect the integrity of the information being transmitted over your wireless network. The DIR-685 is capable of 4 types of wireless security; WEP, WPA only, WPA2 only, and WPA/WPA2 (auto-detect)

WEP
Wired Equivalent Protocol (WEP) is a wireless security protocol for Wireless Local Area Networks (WLAN). WEP provides security by encrypting the data that is sent over the WLAN. The DIR-685 supports 2 levels of WEP Encryption: 64-bit and 128-bit. WEP is disabled by default. The WEP setting can be changed to fit an existing wireless network or to customize your wireless network.

Authentication - Authentication is a process by which the DIR-685 verifies the identity of a network device that is attempting to join the wireless network. There are two types authentication for this device when using WEP.
Open System -Select this option to allow all wireless devices to communicate with the DIR-685 before they are required to provide the encryption key needed to gain access to the network.
Shared Key - Select this option to require any wireless device attempting to communicate with the DIR-685 to provide the encryption key needed to access the network before they are allowed to communicate with the DIR-685.
WEP Encryption - Select the level of WEP Encryption that you would like to use on your network. The two supported levels of WEP encryption are 64-bit and 128-bit.
Key Type - The Key Types that are supported by the DIR-685 are HEX (Hexadecimal) and ASCII (American Standard Code for Information Interchange.) The Key Type can be changed to fit an existing wireless network or to customize your wireless network.
Keys - Keys 1-4 allow you to easily change wireless encryption settings to maintain a secure network. Simply select the specific key to be used for encrypting wireless data on the network.

WPA-Personal
Wi-Fi Protected Access authorizes and authenticates users onto the wireless network. WPA uses stronger security than WEP and is based on a key that changes automatically at a regular interval.

Cipher Type - The DIR-685 support two different cipher types when WPA is used as the Security Type. These two options are TKIP (Temporal Key Integrity Protocol) and AES (Advanced Encryption Standard).
PSK/EAP -When PSK is selected, your wireless clients will need to provide a Passphrase for authentication. When EAP is selected, you will need to have a RADIUS server on your network which will handle the authentication of all your wireless clients.
Passphrase - This is what your wireless clients will need in order to communicate with your DIR-685, when PSK is selected. Enter 8-63 alphanumeric characters. Be sure to write this Passphrase down as you will need to enter it on any other wireless devices you are trying to add to your network.
802.1X - This means of WPA authentication is used in conjunction with a RADIUS server that must be present on your network. Enter the IP address, port, and Shared Secret that you RADIUS is configured for. You also have the option to enter information for a second RADIUS server in the even that there are two on your network which you are using to authenticate wireless clients.

WPA2
Wi-Fi Protected Access 2 authorizes and authenticates users onto the wireless network. WPA2 uses stronger security than WEP and is based on a key that changes automatically at a regular interval.

Cipher Type - The DIR-685 support two different cipher types when WPA is used as the Security Type. These two options are TKIP (Temporal Key Integrity Protocol) and AES (Advanced Encryption Standard).
PSK/EAP - When PSK is selected, your wireless clients will need to provide a Passphrase for authentication. When EAP is selected, you will need to have a RADIUS server on your network which will handle the authentication of all your wireless clients.
Passphrase - This is what your wireless clients will need in order to communicate with your DIR-685, when PSK is selected. Enter 8-63 alphanumeric characters. Be sure to write this Passphrase down as you will need to enter it on any other wireless devices you are trying to add to your network.
802.1X - This means of WPA2 authentication is used in conjunction with a RADIUS server that must be present on your network. Enter the IP address, port, and Shared Secret that you RADIUS is configured for. You also have the option to enter information for a second RADIUS server in the even that there are two on your network which you are using to authenticate wireless clients.

WPA2-Auto
This option allows the DIR-685 to have both WPA2 and WPA clients connected to it simultaneously.

LAN Setup for Guest Zone
These are the settings of the Guest Zone LAN (Local Area Network) interface for the device. These settings may be referred to as "private settings". You may change the IP address if needed. The IP address is private to your internal network and cannot be seen on the Internet. The default IP address is 192.168.1.1 with a subnet mask of 255.255.255.0.

IP Address - IP address of the DIR-685, default is 192.168.1.1.
Subnet Mask - Subnet Mask of DIR-685, default is 255.255.255.0.

Enable Guest Zone Client Isolation :
Enable the function to prevent one guest client to access other clients in the Guest Zone. The guest client can access to the Internet only.

Enable Routing Between Zones :
Use this section to enable routing between Host Zone and Guest Zone, Guest clients can not access Host clients' data without enable the function.

DHCP Server for Guest Zone
DHCP stands for Dynamic Host Control Protocol. The DHCP server assigns IP addresses to devices on the network that request them. These devices must be set to "Obtain the IP address automatically". By default, the DHCP Server is enabled on the DIR-685. The DHCP address pool contains the range of the IP address that will automatically be assigned to the clients on the network.

Starting IP address - The starting IP address for the DHCP server's IP assignment.
Ending IP address -The ending IP address for the DHCP server's IP assignment.
Lease Time -The length of time in minutes for the IP lease. Dynamic DHCP client computers connected to the unit will have their information displayed in the Dynamic DHCP Client Table. The table will show the Host Name, IP Address, MAC Address, and Expired Time of the DHCP lease for each client computer.

## Wake on LAN

The Wake on LAN function can be used to remotely turn on a PC connected to the LAN side of the router. Specify the UDP port that will be used by the Wake on LAN magic packet to prevent the router from thinking the Wake on LAN request is a hostile attack and blocking it.
UDP Port - This is the unique port that the DIR-685 will use to listen for the magic packets that will turn on the PC.
Interface - (This setting can't currently be changed. It may be possible to change this setting in later firmware releases).

Copyright © 2004-2007 D-Link Systems, Inc.