D-LINK SYSTEMS, INC. | WIRELESS ROUTER : HELP

Firmware Version : 1.10NA
Hardware Version : A1
Product Page : DAP-1350

| Setup | Advanced | Maintenance | Status | Help

- Menu
- Setup
- Advanced
- Maintenance
- Status

## Advanced Help

- Virtual Server
- Application Rules
- MAC Address Filter
- Website Filter
- Firewall Settings
- Advanced Wireless
- Wi-Fi Protected Setup
- UPNP Settings
- Guest Zone
- DMZ

### Virtual Server

The Virtual Server option gives Internet users access to services on your LAN. This feature is useful for hosting online services such as FTP, Web, or game servers. For each Virtual Server, you define a public port on your router for redirection to an internal LAN IP Address and LAN port.

Example:
  You are hosting a Web Server on a PC that has LAN IP Address of 192.168.0.50 and your ISP is blocking Port 80.
  1. Name the Virtual Server (for example: `Web Server`)
  2. Enter the IP Address of the machine on your LAN (for example: `192.168.0.50`)
  3. Enter the Private Port as [80]
  4. Enter the Public Port as [8888]
  5. Select the Protocol (for example `TCP`).
  6. Click Save to add the settings to the Virtual Servers List
  7. Repeat these steps for each Virtual Server Rule you wish to add. After the list is complete, click Save Settings at the top of the page.
  With this Virtual Server entry, all Internet traffic on Port 8888 will be redirected to your internal web server on port 80 at IP Address 192.168.0.50.

Virtual Server Parameters
  Name
    Assign a meaningful name to the virtual server, for example `Web Server`. Several well-known types of virtual server are available from the "Application Name" drop-down list. Selecting one of these entries fills some of the remaining parameters with standard values for that type of server.
  IP Address
    The IP address of the system on your internal network that will provide the virtual service, for example `192.168.0.50`. You can select a computer from the list of DHCP clients in the "Computer Name" drop-down menu, or you can manually enter the IP address of the server computer.
  Traffic Type
    Select the protocol used by the service. The common choices -- UDP, TCP, and both UDP and TCP -- can be selected from the drop-down menu. To specify any other protocol, select "Other" from the list, then enter the corresponding protocol number ( as assigned by the IANA) in the Protocol box.
  Private Port
    The port that will be used on your internal network.
  Public Port
    The port that will be accessed from the Internet.
8 -- Virtual Servers List
  Use the checkboxes at the left to activate or deactivate completed Virtual Server entries.

### Application Rules

An application rule is used to open single or multiple ports on your router when the router senses data sent to the Internet on a "trigger" port or port range. An application rule applies to all computers on your internal network.

Parameters for an Application Rule
  Example:
    You need to configure your router to allow a software application running on any computer on your network to connect to a web-based server or another user on the Internet.
  Name
    Enter a name for the Special Application Rule, for example `Game App`, which will help you identify the rule in the future. Alternatively, you can select from the Application list of common applications.
  Application
    Instead of entering a name for the Special Application rule, you can select from this list of common applications, and the remaining configuration values will be filled in accordingly.
  Trigger Port
    Enter the outgoing port range used by your application (for example `6500-6700`).
  Trigger Traffic Type
    Select the outbound protocol used by your application (for example `Both`).
  Firewall Port
    Enter the port range that you want to open up to Internet traffic (for example `6000-6200`).
  Firewall Traffic Type
    Select the protocol used by the Internet traffic coming back into the router through the opened port range (for example `Both`).

  With the above example application rule enabled, the router will open up a range of ports from 6000-6200 for incoming traffic from the Internet, whenever any computer on the internal network opens up an application that sends data to the Internet using a port in the range of 6500-6700.

8 -- Application Rules
  This section is where you define application rules. Enable or disable defined rules with the checkboxes at the left.

### (Network Filter)

The MAC address filter section can be used to filter network access by machines based on the unique MAC addresses of their network adapter(s). It is most useful to prevent unauthorized wireless devices from connecting to your network. A MAC address is a unique ID assigned by the manufacturer of the network adapter.

8 -- MAC Filtering Rules
  Configure MAC Filtering
    When "Disable" is selected, MAC addresses are not used to control network access. When "Accept" is selected, only computers with MAC addresses listed in the MAC Address List are granted network access. When "Reject" is selected, any computer with a MAC address listed in the MAC Address List is refused access to the network.
  MAC Address
    Enter the MAC address of the desired. Computers that have obtained an IP address from the router's DHCP server will be in the DHCP Client List. Select a device from the drop down menu, then click the arrow to add that device's MAC address to the list.
  Filter wireless clients:
    Apply MAC Filtering to devices that connect to the network via Wi-Fi. This is the normal usage of MAC Filtering.
  Clear
    Click the Clear button to remove the MAC address from the MAC Filtering list.

### Website Filter

Website Filter Parameters
  Website URL/Domain
    Enter the URL (address) of the Web Site that you want to allow or deny; for example: `google.com`. Do not enter the `http://` preceding the URL. Enter the most inclusive domain; for example, select allow and enter `dlink.com` and access will be permitted to both `www.dlink.com` and `support.dlink.com`.

    Note: Many web sites construct pages with images and content from other web sites. For example, to access `my.yahoo.com`, you would need to select allow and type `yahoo.com`, `yimg.com`, and `doubleclick.net`.

8 -- Website Filtering Rules
  The section lists the current denied or allowed web sites.

### Firewall Settings

The router provides a tight firewall by virtue of the way NAT works. Unless you configure the router to the contrary, the NAT does not respond to unsolicited incoming requests on any port, thereby making your LAN invisible to Internet cyberattackers. However, some network applications cannot run with a tight firewall. Those applications need to selectively open ports in the firewall to function correctly. The options on this page control several ways of opening the firewall to address the needs of specific types of applications. See also Advanced - Virtual Server, Advanced - Application Rules, and UPNP Settings for related options.

Firewall Settings
  Enable SPI
    SPI ("stateful packet inspection" also known as "dynamic packet filtering") helps to prevent cyberattacks by tracking more state per session. It validates that the traffic passing through that session conforms to the protocol. When the protocol is TCP, SPI checks that packet sequence numbers are within the valid range for the session, discarding those packets that do not have valid sequence numbers.

    Whether SPI is enabled or not, the router always tracks TCP connection states and ensures that each TCP packet's flags are valid for the current state.

NAT Endpoint Filtering

  The NAT Endpoint Filtering options control how the router's NAT manages incoming connection requests to ports that are already being used.

  Endpoint Independent
    Once a LAN-side application has created a connection through a specific port, the NAT will forward any incoming connection requests with the same port to the LAN-side application regardless of their origin. This is the least restrictive option, giving the best connectivity and allowing some applications (P2P applications in particular) to behave almost as if they are directly connected to the Internet.
  Address Restricted
    The NAT forwards incoming connection requests to a LAN-side host only when they come from the same IP address with which a connection was established. This allows the remote application to send data back through a port different from the one used when the outgoing session was created.
  Port And Address Restricted
    The NAT does not forward any incoming connection requests with the same port address as an already establish connection.

  Note that some of these options can interact with other port restrictions. Endpoint Independent Filtering takes priority over inbound filters or schedules, so it is possible for an incoming session request related to an outgoing session to enter through a port in spite of an active inbound filter on that port. However, packets will be rejected as expected when sent to blocked ports (whether blocked by schedule or by inbound filter) for which there are no active sessions. Port and Address Restricted Filtering ensures that inbound filters and schedules work precisely, but prevents some level of connectivity, and therefore might require the use of virtual servers to open the ports needed by the application. Address Restricted Filtering gives a compromise position, which avoids problems when communicating with certain other types of NAT router (symmetric NATs in particular) but leaves inbound filters and scheduled access working as expected.

  UDP Endpoint Filtering
    Controls endpoint filtering for packets of the UDP protocol.
  TCP Endpoint Filtering
    Controls endpoint filtering for packets of the TCP protocol.

  Formerly, the terms "Full Cone", "Restricted Cone", "Port Restricted Cone" and "Symmetric" were used to refer to different variations of NATs. These terms are purposely not used here, because they do not fully describe the behavior of this router's NAT. While not a perfect mapping, the following loose correspondences between the "cone" classification and the "endpoint filtering" modes can be drawn: if this router is configured for endpoint independent filtering, it implements full cone behavior; address restricted filtering implements restricted cone behavior; and port and address restricted filtering implements port restricted cone behavior.

Anti-Spoof checking

  This mechanism protects against activity from spoofed or forged IP addresses, mainly by blocking packets appearing on interfaces and in directions which are logically not possible.

### Advanced Wireless

Antenna Transmit Power
  Normally the wireless transmitter operates at 100% power. In some circumstances, however, there might be a need to isolate specific frequencies to a smaller area. By reducing the power of the radio, you can prevent transmissions from reaching beyond your corporate/home office or designated wireless area.
Beacon Period
  Beacons are packets sent by a wireless router to synchronize wireless devices. Specify a Beacon Period value between 20 and 1000. The default value is set to 100 milliseconds.
DTIM interval
  A DTIM is a countdown informing clients of the next window for listening to broadcast and multicast messages. When the wireless router has buffered broadcast or multicast messages for associated clients, it sends the next DTIM with a DTIM Interval value. Wireless clients detect the beacons and awaken to receive the broadcast and multicast messages. The default value is 1. Valid settings are between 1 and 255.
RTS threshold
  When an excessive number of wireless packet collisions are occurring, wireless performance can be improved by using the RTS/CTS (Request to Send/Clear to Send) handshake protocol. The wireless transmitter will begin to send RTS frames (and wait for CTS) when data frame size in bytes is greater than the RTS Threshold. This setting should remain at its default value of 2346 bytes.
Fragmentation threshold
  Wireless frames can be divided into smaller units (fragments) to improve performance in the presence of RF interference and at the limits of RF coverage. Fragmentation will occur when frame size in bytes is greater than the Fragmentation Threshold. This setting should remain at its default value of 2346 bytes. Setting the Fragmentation value too low may result in poor performance.
WMM Enable
  Enabling WMM can help control latency and jitter when transmitting multimedia content over a wireless connection.
Short GI
  Using a short (400ns) guard interval can increase throughput. However, it can also increase error rate in some installations, due to increased sensitivity to radio-frequency reflections. Select the option that works best for your installation.
IGMP Snooping
  The product uses the IGMP protocol to support efficient multicasting -- transmission of identical content, such as multimedia, from a source to a number of recipients. This option must be enabled if any applications on the LAN participate in a multicast group. If you have a multimedia LAN application that is not receiving content as expected, try enabling this option.
WLAN Partition
  Enabling WLAN Partition prevents associated wireless clients from communicating with each other.

### Wi-Fi Protected Setup

Wi-Fi Protected Setup
  Enable
    Enable the Wi-Fi Protected Setup feature.
PIN Settings

  A PIN is a unique number that can be used to add the router to an existing network or to create a new network. The default PIN may be printed on the bottom of the router. For extra security, a new PIN can be generated. You can restore the default PIN at any time. Only the Administrator ("admin" account) can change or reset the PIN.

  Current PIN
    Shows the current value of the router's PIN.
  Reset PIN to Default
    Restore the default PIN of the router.
  Generate New PIN
    Create a random number that is a valid PIN. This becomes the router's PIN. You can then copy this PIN to the user interface of the registrar.
Add Wireless Station

  This Wizard helps you add wireless devices to the wireless network.

  The wizard will either display the wireless network settings to guide you through manual configuration, prompt you to enter the PIN for the device, or ask you to press the configuration button on the device. If the device supports Wi-Fi Protected Setup and has a configuration button, you can add it to the network by pressing the configuration button on the device and then the on the router within 60 seconds. The status LED on the router will flash three times if the device has been successfully added to the network.

  There are several ways to add a wireless device to your network. Access to the wireless network is controlled by a "registrar". A registrar only allows devices onto the wireless network if you have entered the PIN, or pressed a special Wi-Fi Protected Setup button on the device. The router acts as a registrar for the network, although other devices may act as a registrar as well.

  Add Wireless Device with WPS
    Start the wizard.

### UPnP Settings

UPnP
  UPnP is short for Universal Plug and Play, which is a networking architecture that provides compatibility among networking equipment, software, and peripherals. This router has optional UPnP capability, and can work with other UPnP devices and software.
  Enable UPnP
    If you need to use the UPnP functionality, you can enable it here.

### Guest Zone

Guest Zone Selection

  The selection helps you to define the Guest Zone scale.

  Enable Guest Zone
    Specifies whether the Guest Zone will be enabled or disabled.
  Wireless Network Name
    Provide a name for Guest Zone wireless network.
  Enable Routing Between Zones
    Use this section to enable routing between Host Zone and Guest Zone, Guest clients can not access Host clients' data without enable the function.
  Security Mode
    Unless one of these encryption modes is selected, wireless transmissions to and from your wireless network can be easily intercepted and interpreted by unauthorized users.
  WEP

    A method of encrypting data for wireless communication intended to provide the same level of privacy as a wired network. WEP is not as secure as WPA encryption. To gain access to a WEP network, you must know the key. The key is a string of characters that you create. When using WEP, you must determine the level of encryption. The type of encryption determines the key length. 128-bit encryption requires a longer key than 64-bit encryption. Keys are defined by entering in a string in HEX (hexadecimal - using characters 0-9, A-F) or ASCII (American Standard Code for Information Interchange - alphanumeric characters) format. ASCII format is provided so you can enter a string that is easier to remember. The ASCII string is converted to HEX for use over the network. Four keys can be defined so that you can change keys easily. A default key is selected for use on the network.

    Example:
      64-bit hexadecimal keys are exactly 10 characters in length. (12345678FA is a valid string of 10 characters for 64-bit encryption.)
      128-bit hexadecimal keys are exactly 26 characters in length. (456FBCDF123400122225271730 is a valid string of 26 characters for 128-bit encryption.)
      64-bit ASCII keys are up to 5 characters in length (DMODE is a valid string of 5 characters for 64-bit encryption.)
      128-bit ASCII keys are up to 13 characters in length (2002HALOSWIN1 is a valid string of 13 characters for 128-bit encryption.)

    Note that, if you enter fewer characters in the WEP key than required, the remainder of the key is automatically padded with zeros.

  WPA-Personal and WPA-Enterprise

    Both of these options select some variant of Wi-Fi Protected Access (WPA) -- security standards published by the Wi-Fi Alliance. The WPA Mode further refines the variant that the router should employ.

    WPA Mode: WPA is the older standard; select this option if the clients that will be used with the router only support the older standard. WPA2 is the newer implementation of the stronger IEEE 802.11i security standard. With the "WPA2" option, the router tries WPA2 first, but falls back to WPA if the client only supports WPA. With the "WPA2 Only" option, the router associates only with clients that also support WPA2 security.

    Cipher Type: The encryption algorithm used to secure the data communication. TKIP (Temporal Key Integrity Protocol) provides per-packet key generation and is based on WEP. AES (Advanced Encryption Standard) is a very secure block based encryption. With the "TKIP and AES" option, the router negotiates the cipher type with the client, and uses AES when available.

  WPA-Personal:

    This option uses Wi-Fi Protected Access with a Pre-Shared Key (PSK).

    Pre-Shared Key: The key is entered as a pass-phrase of up to 63 alphanumeric characters in ASCII (American Standard Code for Information Interchange) format at both ends of the wireless connection. It cannot be shorter than eight characters, although for proper security it needs to be of ample length and should not be a commonly known phrase. This phrase is used to generate session keys that are unique for each wireless client.

    Example:
      `Wireless Networking technology enables ubiquitous communication`
  WPA-Enterprise

    This option works with a RADIUS Server to authenticate wireless clients. Wireless clients should have established the necessary credentials before attempting to authenticate to the Server through this Gateway. Furthermore, it may be necessary to configure the RADIUS Server to allow this Gateway to authenticate users.

    RADIUS Server IP Address: The IP address of the authentication server.

    RADIUS Server Port: The port number used to connect to the authentication server.

    RADIUS Server Shared Secret: A pass-phrase that must match with the authentication server.

    Advanced:

    Optional Backup RADIUS Server
      This option enables configuration of an optional second RADIUS server. A second RADIUS server can be used as backup for the primary RADIUS server. The second RADIUS server is consulted only when the primary server is not available or not responding. The fields Second RADIUS Server IP Address, RADIUS Server Port, Second RADIUS server Shared Secret provide the corresponding parameters for the second RADIUS Server.

### DMZ

Enable DMZ

  Note: Putting a computer in the DMZ may expose that computer to a variety of security risks. Use of this option is only recommended as a last resort.

DMZ IP Address
  Specify the LAN IP address of the LAN computer that you want to have unrestricted Internet communication. If this computer obtains its address Automatically using DHCP, then you may want to make a static reservation on the Setup - Network Settings page so that the IP address of the DMZ computer does not change.

Helpful Hints...

Click on the links for more informations of each section in the GUI.

Copyright © 2009 D-Link Corporation/D-Link System, Inc.