D-Link DSL-G604T user guide: Firewall

Firewall

The Firewall Configuration menu allows the Router to enforce specific predefined policies intended to protect against certain common types of attacks. There are two general types of protection (DoS and Port Scan) that can be enabled on the Router, as well as filtering for specific packet types sometimes used by hackers.

You can choose to Enable or Disable protection against a customized basket of attack and scan types. To enable DoS Protection or Port Scan Protection, select the Enable radio button for the protection type and click in the selection boxes for the various types of protection listed under each.

Figure 4-4. Firewall Configuration Menu

When DoS, Port Scan, or Service Filtering Protection is enabled, it will create a firewall policy to protect your network against the following:

A DoS "denial-of-service" attack is characterized by an explicit attempt by attackers to prevent legitimate users of a service from using that service. Examples include: attempts to "flood" a network, thereby preventing legitimate network traffic, attempts to disrupt connections between two machines, thereby preventing access to a service, attempts to prevent a particular individual from accessing a service, or, attempts to disrupt service to a specific system or person.

Port scan protection is designed to block attempts to discover vulnerable ports or services that might be exploited in an attack from the WAN.

The Service Filtering options allow you to block FTP, Telnet response, Pings, etc, from the external network. Check the category you want to block to enable filtering of that type of packet.

When you have selected the desired Firewall policies, click the Apply button to enforce the policies. Remember to save any configuration changes.

Static Routing

Use Static Routing to specify a route used for data traffic within your Ethernet LAN or to route data on the WAN. This is used to specify that all packets destined for a particular network or subnet use a predetermined gateway.

Figure 4-5. Static Routing menu

To add a static route to a specific destination IP on the local network, enter a Destination IP address, Netmask, click the Gateway radio button and type in the Gateway's IP address. Click Apply to enter the new static route in the table below. The route becomes active immediately upon creation.

To add a static route to a specific destination IP on the WAN, click the Connection radio button and choose a connection from the pull-down menu, then enter a Destination IP address and Netmask. Click Apply to enter the new static route in the table below. The route becomes active immediately upon creation

To remove a static route from the table in the bottom half of the window, choose to Delete it from the table and click the Apply button. Remember to save the configuration changes.

Dynamic Routing (RIP)

The Router supports RIP v1 and RIP v2 used to share routing tables with other Layer 3 routing devices on your local network or remote LAN.

Figure 4- 6. RIP menu

To enable RIP, select Enabled from the RIP pull-down menu, select the Protocol (RIPv1, RIPv2 and RIPv1 Compatible) and Direction (In, Out, or Both), and click Apply.

The RIPv1 Compatible option will respond to or send RIP requests compatible with both RIP v1 and RIP v2.

The direction configuration refers to the RIP request. Select In to allow RIP requests from other devices. Select Out to instruct the Router to make RIP requests for routing tables from other devices. Select Both to share routing tables in both directions.

ATM VC

The ATM Virtual Circuit connection menu is used to configure the WAN connection. If you are using multiple PVCs, you can change the configuration of any PVC in this menu. To create new or additional PVCs, read the section below on Multiple PVCs.

This menu can be used as an alternative menu to configure the same settings found on the WAN menu in the Home directory.

Figure 4- 7. ATM Virtual Circuit configuration menu

To configure an existing PVC configuration set, click the corresponding notepad icon in the right-hand column of the ATM VCs List. The PVCs current settings appear above in the entry fields of the ATM VC Settings menu. Configure the appropriate settings and click the Apply button to put the new settings into effect.

Advanced Wireless LAN Configuration

The menus used to configure Wireless LAN settings available in the Advanced directory includ the Wrieless Performance and Wireless Management menus. Wireless security settings are configured using the Wireless Settings menu located in the Home directory. The wireless performance, management and security features are described below.

Wireless Performance

If you want to tweek wireless settings, click the Wireless Performance menu button in the Advanced directory.

It is recommended for most users to use the default Wireless LAN Performance settings. Any changes made to these settings may adversely affect your wireless network. Under certain circumstances, changes may benefit performance. Carefully consider and evaluate any changes to these wireless settings.

Figure 4- 8. Wireless LAN Performance settings

Wireless Security

The wireless LAN interface of the DSL-G604T has various security features used to limit access to the device or to encrypt data and shared information. The available standardized security for wireless LAN includes WEP, 802.1x, WPA and WPA-PSK Wireless security is configured with the Wireless Settings menu located in the Home directory.

The wireless access point is not enabled by default. It may be enabled using the Setup Wizard as previously described, or use the Wireless Settings menu. To enable the wireless access point, click the Enable AP option so that a check mark appears in the box. Click the Apply button to begin wireless operation. To disable the access point, deselect the Enable AP option and click the Apply button.

Configure Security Protocols

In the Wireless Settings menu, select the type of security you want to configure. The menu will change to present the settings specific to the method being configured.

Figure 4- 9. Configure WEP Wireless Security

SSID and Channel

The SSID used for your wireless network can be any character string up to 16 characters in length. Type the desired SSID in the space provided, select the channel you want to use from the drop-down Channel menu and click on the Apply button to begin operation with the new SSID and channel.

Disable SSID Broadcast

By default the access point will broadcast the SSID that has been configured. This can be disabled by selecting the Disabled radio button listed to the right of SSID Broadcasting and clicking on the Apply button. This change goes into effect immediately. When SSID broadcasting is disabled, each wireless station or access point that associates with the DSL-G604T must have the SSID setting configured. Wireless nodes will not be able to discover the SSID.

If SSID has been disabled, it can be enabled in the same Wireless Settings menu. The change is effective as soon as it is applied.

WEP Encryption

WEP (Wireless Encryption Protocol or Wired Equivalent Privacy) encryption can be enabled for security and privacy. WEP encrypts the data portion of each frame transmitted from the wireless adapter using one of the predefined keys. Decryption of the data contained in each packet can only be done if the both the receiver and transmitter have the correct key.

WEP can use different methods of Authentication. Use the Authentication Type: drop-down menu to choose Open or Shared.

• Select Open to allow any wireless station to associate with the access point.
• Select Shared to only allow stations using a shared key encryption to associate with it. Shared key requires additional configuration of the keys to be used. Follow the instructions below to configure the Shared Keys.

WEP is disabled by default. To enable WEP, select the Enable option. Configure the Encryption Keys as desired and click the Apply button. The encryption key setup is described below.

Setup Encryption Keys

WEP Keys are available in Hexadecimal format. Hexadecimal digits are defined as the numerical digits 0 – 9 and the letters A – F (upper and lower case are recognized as the same digit). The length of the key depends on the level of encryption used.

Select the Key Length from the drop-down menu. The available key lengths are 64, 128 or 256-bit encryption. The length of the character string used of the keys depends on the level (Key Length) of encryption selected. Only one key can be active. The active key is selected by clicking the radio button for the key you want to use.

Click the Apply button when you have configured WEP as desired to put the changes into effect.

Configure WPA Settings

WPA security for wireless communication has been developed to overcome some of the shortcomings of WEP. WPA combines the key generation of WEP with the authentication services of a RADIUS (802.1x) server.

Figure 4- 10. Configure WPA Security for WLAN

To configure WPA settings, select the WPA option. The menu will change to offer the appropriate settings. Type in the IP address of the RADIUS server used in the Server IP Address field. Change the Port: if necessary, type in the password in the Secret field and change the Group Key Interval as desired. Click the Apply button to put the changes into effect.

Configure WPA-PSK Settings

WPA-PSK requires a shared key and does not use a separate server for authentication. PSK keys can be ASCII or Hex type.

Figure 4- 11. Configure WPA-PSK Security for WLAN

To configure WPA settings, select the WPA-PSK option. The menu will change to offer the appropriate settings. Type in the IP address of the RADIUS server used in the Server IP Address field. Change the Group Key Interval as desired. Select either PSK Hex or PSK String key and type the key in the space provided. Click the Apply button to put the changes into effect.

Wireless Management (MAC Access and Multiple SSID)

The Wireless Management menu located in the Advanced directory is used to control MAC address access to the wireless access point and to view a list of MAC addresses that are currently associated with the access point. This menu is also be used to enable and configure use of multiple SSIDs. To use more than one SSID, WEP and WPA security must first be disabled (see below).

Figure 4- 12. Wireless Management Access List

To view a list of stations currently associated with the access point, click the Associated Stations radio button.

Configure Wireless Access Control

To create a list of MAC addresses that are banned or allowed association with the wireless access point:

1. Click in the Enable Access List option box to select it.
2. Select the action to perform on the MAC address to be specified. Choose to Allow or Ban association.
3. Type in the MAC Address in the entry field provided.
4. Click the Add button to add the MAC address to the list. The AMC address will appear listed in the table below.
5. After compiling the list of MAC addresses as desired, click the Apply button to enforce access control for the MAC addresses in the list.

To remove any MAC address from the list, click the radio button in the left column of the list for the MAC address to be removed and click the Apply button.

Configure Multiple SSID

Multiple SSID cannot be used if the access point has either WPE or WPA enabled. This must first be disabled in the Wireless menu located in the Home directory.

Figure 4- 13. Wireless Management - Multiple SSID

To configure multiple SSID:

1. Disable WEP or WPA in the Wireless menu of the Home directory.
2. Click in the Enable Multiple SSID option box to select it.
3. Enter the SSID you want to add.
4. Click the Add button to add the SSID to the list.
5. Click the Apply button to enable the listed SSIDs.

To remove an SSID from the list, click the radio button in the left column of the list for the SSID to be removed and click the Apply button.

Tools and Utilities

Click the Tools tab to reveal the menu buttons for various functions located in this directory. These menus are used to change the system password used to access the web manager, to save or load Router configuration settings, upgrade the device firmware, save current configuration settings, restore default settings, and to perform miscellaneous actions such performing Ping tests. These menus are described below.

Change System Password

To change the password used to access the Router web manager, click the Admin button in the Tools directory to display the Administrator Settings menu. Under the Administrator heading, type the New Password and Confirm Password to be certain you have typed it correctly. Click the Apply button to activate the new password. The System User Name (Login Name) remains "admin", this cannot be changed using the web manager interface. Be sure to save the new setting (see below).

Figure 4- 14. Administrator Settings Menu

Enable Remote Web Management and Telnet Access

The Administrator Settings menu (see above) is also used to enable remote Telnet management and remote web management access to the Router. To enable remote management of the Router, select the Enabled radio button for either Remote Web or Remote Telnet Management and type the IP Address and Netmask of the remote network or system used for management. Click the Apply button to activate remote management from the chosen IP address. Be sure to save the new setting (see below).

Time & Date

The Router provides a number of options to maintain current date and time including SNTP.

Figure 4- 15. Time & Date Configuration

To configure system time on the Router, select the method used to maintain time. The options available include SNTP, using your computer's system clock (default) or set the time and date manually. If you opt to use SNTP, you must enter the SNTP server URL or IP address. Click the Apply button to set the system time.

Save Configuration File to PC

Once you have configured the Router to your satisfaction, it is a good idea to back up the configuration file to your computer. Use the System Setting menu to save the existing configuration file to the hard drive of the system you are using to access the web manager. To save the system configuration file to your computer, click the Save button. You will be prompted to select a location on your computer to put the file. The file type is .cfg and may be named anything you wish.

Load Saved Configuration Files

To load a previously saved configuration file, click the Browse button and locate the file on your computer. Or type the full path and file name of the .cfg file in the space provided. Click the Load button to begin transferring and loading the .cfg file to the Router. Confirm that you want to load the file when prompted and the process is completed automatically. The Router will reboot and begin operating with the configuration settings that have just been loaded.

Figure 4- 16. System Settings

Restore Factory Default Settings

To reset the Router to its factory default settings, click the Restore button. You will be prompted to confirm your decision to reset the Router. The Router will reboot with the factory default settings including IP settings.

Firmware Upgrade

Performing a Firmware Upgrade can sometimes change the configuration settings. Be sure to back-up the Router's configuration settings before upgrading the firmware.

Use the Firmware Upgrade menu to load the latest firmware for the device. Note that the device configuration settings may return to the factory default settings, so make sure you save the configuration settings with the System Settings menu described above.

Figure 4- 17. Firmware Upgrade

To upgrade firmware, type in the name and path of the file or click on the Browse button to search for the file. Click the Apply button to begin copying the file. The file will load and restart the Router automatically.

Misc. Settings

Figure 4- 18. Miscellaneous Configuration menu

Other functions available in Miscellaneous Configuration menu are a Ping test and IGMP enable/disable.

Ping Test

The Ping test functions on the WAN and LAN interfaces. Type the IP address you want to check in the space provided and click the Ping button. Read the Ping test result in the space immediately below.

I GMP

This is Disabled by default. This setting will not allow IGMP (Internet Group Management Protocol) packets to be forwarded to the LAN. IGMP is used to manage multicasting on TCP/IP networks, most users will not need to enable this. Some ISPs use IGMP to perform remote configuration for client devices, such as the Router. If you are unsure, check with your ISP. To enable IGMP service to the LAN interface, select Enabled and click the Apply button.

Save Router Configuration Settings

When you have completed configuration of the Router, make sure you save the current configuration settings to flash memory or risk losing the settings. To save the current configuration settings, click the Misc. menu button to view the Miscellaneous Configuration menu and click the Save and Reboot button. The current settings will be saved to NV-RAM and the system will restart. Do not turn off the Router during this process. It should take about two minutes to complete. After restarting, it is a good idea to backup the Router configuration file to your computer. See the instructions below to save configuration files to your PC.

Diagnostic Test

This section provides connection information based on the Virtual Circuit that is selected. To view other Virtual Circuits, select from the drop down menu.

Router Status Information

Use the various read-only menus to view system information and monitor performance.

Device Information Display

Use the Device Information window to quickly view basic current information about the LAN, WAN and Wireless interfaces. The basic information available in this window is summarized below.

LAN

The MAC Address of the Ethernet LAN connection, IP Address, and Subnet Mask information will be displayed, as well as the setting (Enabled/Disabled) for the DHCP Server.

WAN (ADSL)

The MAC Address of the Ethernet WAN connection, IP Address, Subnet Mask, Default Gateway, and DNS (Domain Name Server) information will be listed. The connection type includes Dynamic, Static, and PPPoE. You may click the DHCP Release or Renew the IP address assigned by the ISP for the WAN port for the Dynamic Setting Option. For PPPoE setting, you may click the button to Connect and Disconnect the DSL connection.

Figure 4- 19. Display Information window

This page is blank.

Multiple Virtual Connections

The Router supports multiple virtual connections. Up to eight PVCs to eight separate destinations can be created and operated simultaneously utilizing the same bandwidth. Additional PVC connections can be added for various purposes. For example, you may want to establish a private connection to remote office in order to create an extended LAN, or setup a server on a separate connection. Provisioning for additional PVC profiles must be done through your telecommunications services provider. Extended LAN operations employing multiple virtual connections require ADSL routers or modems at the remote site for a successful connection. Contact your ISP or telecommunications service provider if you are interested in setting up multiple virtual connections.

After the necessary arrangements have been made to use the Router with multiple virtual connections, follow the instructions below to setup the Router using the VPI/VCI settings given to you by your server provider.

Configure Multiple PVCs

Additional PVCs can be configured by first accessing the WAN configuration menu in the Home directory.

Figure 4- 20. Select new PVC to configure in the WAN menu

The PVC pull-down menu offers 8 virtual connections available for configuration. The default VC used by the Router is labeled Pvc0. Any additional connections that are configured must have a VPI/VCI combination that is unique to the Router. These numbers will have been already been established by your service provider on their network.

To add a new virtual connection:

1. Select the new PVC to configure from the pull-down menu.
2. Enter the values for the VPI and VCI given to you by your service provider.
3. To activate the VC, select Enabled from the Virtual Circuit pull-down menu.
4. Configure the WAN Settings and Connection Type as desired.

In the example below, a new VC (Pvc2) has been added using the WAN Settings menu. The connection is setup as a bridged connection.

Figure 4- 21. Configure new VC

The new VC appears listed in the ATM VC Setting menu located in the Advanced directory.

Figure 4- 22. New VC listed in ATM VC Settings menu

Any VC may be configured in the ATM VC menu by clicking the notepad icon for the PVC you want to configure. VCs configured with PPP connection types can be further configured in the PPP menu.

Technical Specifications

General

| Standards | IEEE 802.11b/ 802.11gIEEE 802.3/ 802.3uIEEE 802.1dRFC 791 (IP Routing)RFC 792 (UDP)RFC 826 (ARP)RFC 1058 (RIP 1)RFC 1389 (RIP 2)RFC 1483 (Bridged Ethernet)RFC 1577 (IP over ATM)RFC 1661 (PPP)RFC 1994 (CHAP) | RFC 1334 (PAP)RFC 2364 (PPP over ATM)RFC 1631 (NAT)RFC 1877 (Automatic IP assignment)RFC 2516 (PPP over Ethernet)RFC 2131 (DHCP)ANSI T1.413 issue 2ITU G.992.1 (G.dmt)ITU G.992.2 (G.lite)ITU G.994.1 (G.Hs)ITU-T Rec. I.361Supports ATM Forum UNI V3.1/4.0 PVC |

Wireless

| Modulation | IEEE 802.11b: DQPSK, DBPSK, DSSS, and CCKIEEE 802.11g: BPSK, QPSK, 16QAM, 64QAM, OFDM | | Frequency | 2400 ~ 2484.5MHz ISM band | | Channels | 11 channels for United States13 channels for European Countries13 channels for Japan | | Wireless Data Rates | IEEE 802.11b: 11, 5.5, 2, and 1MbpsIEEE 802.11g: 6, 9, 12, 18, 24, 36, 48, 54Mbps* | | Media Access Protocol | CSMA/CA with ACK | | WEP | 64/128/256 bits | | Wireless Certification | Wi-Fi WPA | | ADSL Data Rates | G.dmt full rate: Downstream up to 8 MbpsUpstream up to 640 KbpsG.lite: Downstream up to 1.5 MbpsUpstream up to 512 KbpsRJ-11 port ADSL telephone line connection4 x RJ-45 ports for 10/100BASET Ethernet connection |

*Maximum wireless signal rate based on IEEE Standard 802.11g specifications. Actual data throughput will vary. Network conditions and environmental factors, including volume of network traffic, building materials and construction, and network overhead lower actual data throughput rate.

Physical and Environmental

B

IP Address Setup

The DSL-G604T is designed to provide network administrators maximum flexibility for IP addressing on the Ethernet LAN. The easiest IP setup choice in most cases is to let the Router do it using DHCP, which is enabled by default. This appendix briefly describes various options including DHCP, used for IP setup on a LAN. If you are new to IP networking, the next appendix provides some background information on basic IP concepts.

Assigning Network IP Addresses

The IP address settings, which include the IP address, subnet mask and gateway IP address are the first and most important internal network settings that need to be configured. The Router is assigned a default LAN IP address and subnet mask. If you do not have a preexisting IP network and are setting one up now, using the factory default IP address settings can greatly ease the setup process. If you already have a preexisting IP network, you can adjust the IP settings for the Router to fit within your existing scheme.

Using the Default IP Address

The Router is shipped with a preset default IP address setting of 192.168.1.1 for the LAN port. There are two ways to use this default IP address, you can manually assign an IP address and subnet mask for each PC on the LAN or you can instruct the Router to automatically assign them using DHCP. The simplest method is to use DHCP. The DHCP function is active by default.

Manual IP Address Assignment

Manually configuring IP settings for the LAN means you must manually set an IP address, subnet mask and IP address of the default gateway (the Router's IP address) on each networked computer. The example listed below describes IP configuration for computers running Windows 95 or Windows 98. Regardless of what operating system is used on each workstation, the three network IP settings must be defined so the network interface used by each workstation can be identified by the Router, and vice versa. For detailed information about configuring your workstations IP settings, consult the user's guide included with the operating system or the network interface card (NIC).

1. In Windows 95/98, click on the Start button, go to Settings and choose Control Panel.
2. In the window that opens, double-click on the Network icon.
3. Under the Configuration tab, select the TCP/IP component and click Properties.
4. Choose the Specify an IP address option and edit the address settings accordingly. Consult the table below for IP settings on a Class C network.

\begin{tabular}{|l|l|l|l|} \hline \multicolumn{4}{|c|}{\textbf{Using Default IP without DHCP}} \ \hline \textbf{Host} & \textbf{IP Address} & \textbf{Subnet Mask} & \textbf{Gateway IP} \ \hline \textbf{Router} & 192.168.1.1 & 255.255.255.0 & \ \hline \textbf{Computer #1} & 192.168.1.2 & 255.255.255.0 & 192.168.1.1 \ \hline \textbf{Computer #2} & 192.168.1.3 & 255.255.255.0 & 192.168.1.1 \ \hline \textbf{Computer #3} & 192.168.1.4 & 255.255.255.0 & 192.168.1.1 \ \hline \end{tabular}

IP Setup - Example #1

Please note that when using the default IP address as in the above example, the first number in the IP address must always be the same with only the second, third and fourth number changing. The first number defines the network IP address (all machines must belong to the same IP network), while the last three numbers denote the

host IP address (each computer must have a unique address to distinguish it on the network). The IP address scheme used in Example #1 can be used for any LAN that requires up to 253 separate IP addresses (excluding the Router). Notice that the subnet mask is the same for all machines and the default gateway address is the LAN IP address of the Router.

It is a good idea to make a note of each device’s IP address for reference during troubleshooting or when adding new stations or devices.

Using DHCP

The second way to use the default settings is to allow the Router to automatically assign IP settings for workstation using DHCP. To do this, simply make sure your computer’s IP addresses are set to 0.0.0.0 (under Windows, choose the option Obtain an IP address automatically in the TCP/IP network component described above). When the computers are restarted, their IP settings will automatically be assigned by the Router. The Router is set by default to use DHCP. See the discussion in Chapter 3 for information on how to use configure the Router for DHCP.

Changing the IP Address of the Router

When planning your LAN IP address setup, you may use any scheme allowed by rules that govern IP assignment. It may be more convenient or easier to remember an IP scheme that use a different address for the Router. Or you may be installing the Router on a network that has already established the IP settings. Changing the IP address is a simple matter and can be done using the web manager (see LAN IP Address in Chapter 5). If you are incorporating the Router into a LAN with an existing IP structure, be sure to disable the DHCP function. Also, consider the effects of NAT (Network Address Translation). This is enabled by default but may be disabled in the NAT menu of the Advanced directory.

An IP addressing scheme commonly used for Ethernet LANs establishes 10.0.0.1 as the base address for the network. Using Example #2 below, the Router is assigned the base address 10.0.0.1 and the remaining addresses are assigned manually or using DHCP.

IP Setup - Example #2

These two examples are only examples you can use to help you get started. Other common private network IP addressing schemes use a base address of 192.168.1.1 or 192.168.0.1. If you are interested in more advanced information on how to use IP addressing on a LAN there are numerous resources freely available on the Internet. There are also many books and chapters of books on the subject of IP address assignment, IP networking and the TCP/IP protocol suite.

C

IP Concepts

This appendix describes some basic IP concepts, the TCP/IP addressing scheme and shows how to assign IP Addresses.

When setting up the Router, you must make sure it has a valid IP address. Even if you will not use the WAN port (ADSL port), you should, at the very least, make sure the Ethernet LAN port is assigned a valid IP address. This is required for telnet, in-band SNMP management, and related functions such as “trap” handling and TFTP firmware download.

I P Addresses

The Internet Protocol (IP) was designed for routing data between network sites all over the world, and was later adapted for routing data between networks within any site (often referred to as “subnetworks” or “subnets”). IP includes a system by which a unique number can be assigned to each of the millions of networks and each of the computers on those networks. Such a number is called an IP address.

To make IP addresses easy to understand, the originators of IP adopted a system of representation called “dotted decimal” or “dotted quad” notation. Below are examples of IP addresses written in this format:

201.202.203.204 189.21.241.56 125.87.0.1

Each of the four values in an IP address is the ordinary decimal (base 10) representation of a value that a computer can handle using eight “bits” (binary digits — 1s and 0s). The dots are simply convenient visual separators.

Zeros are often used as placeholders in dotted decimal notation; 189.21.241.56 can therefore also appear as 189.021.241.056.

IP networks are divided into three classes on the basis of size. A full IP address contains a network portion and a “host” (device) portion. The network and host portions of the address are different lengths for different classes of networks, as shown in the table below.

Networks attached to the Internet are assigned class types that determine the maximum number of possible hosts per network. The previous figure illustrates how the net and host portions of the IP address differ among the

three classes. Class A is assigned to networks that have more than 65,535 hosts; Class B is for networks that have 256 to 65534 hosts; Class C is for networks with less than 256 hosts.

Note: All network addresses outside of these ranges (Class D and E) are either reserved or set aside for experimental networks or multicasting.

When an IP address's host portion contains only zero(s), the address identifies a network and not a host. No physical device may be given such an address.

The network portion must start with a value from 1 to 126 or from 128 to 223. Any other value(s) in the network portion may be from 0 to 255, except that in class B the network addresses 128.0.0.0 and 191.255.0.0 are reserved, and in class C the network addresses 192.0.0.0 and 223.255.255.0 are reserved.

The value(s) in the host portion of a physical device's IP address can be in the range of 0 through 255 as long as this portion is not all-0 or all-255. Values outside the range of 0 to 255 can never appear in an IP address (0 to 255 is the full range of integer values that can be expressed with eight bits).

The network portion must be the same for all the IP devices on a discrete physical network (a single Ethernet LAN, for example, or a WAN link). The host portion must be different for each IP device — or, to be more precise, each IP-capable port or interface — connected directly to that network.

The network portion of an IP address will be referred to in this manual as a network number; the host portion will be referred to as a host number.

To connect to the Internet or to any private IP network that uses an Internet-assigned network number, you must obtain a registered IP network number from an Internet-authorized network information center. In many countries you must apply through a government agency, however they can usually be obtained from your Internet Service Provider (ISP).

If your organization's networks are, and will always remain, a closed system with no connection to the Internet or to any other IP network, you can choose your own network numbers as long as they conform to the above rules.

If your networks are isolated from the Internet, e.g. only between your two branch offices, you can assign any IP Addresses to hosts without problems. However, the Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of IP Addresses specifically for private (stub) networks:

It is recommended that you choose private network IP Addresses from the above list. For more information on address assignment, refer to RFC 1597, Address Allocation for Private Internets and RFC 1466, Guidelines for Management of IP Address Space.

Subnet Mask

In the absence of subnetworks, standard TCP/IP addressing may be used by specifying subnet masks as shown below.

Subnet mask settings other than those listed above add significance to the interpretation of bits in the IP address. The bits of the subnet mask correspond directly to the bits of the IP address. Any bit an a subnet mask that is to correspond to a net ID bit in the IP address must be set to 1.

Microfilters and Splitters

Most ADSL clients will be required to install a simple device that prevents the ADSL line from interfering with regular telephone services. These devices are commonly referred to as microfilters or sometimes called (inaccurately) line splitters. They are easy to install and use standard telephone connectors and cable.

Some ADSL service providers will send a telecommunications technician to modify the telephone line, usually at the point where the telephone line enters the building. If a technician has divided or split your telephone line into two separate lines - one for regular telephone service and the other for ADSL – then you do not need to use any type of filter device. Follow the instructions given to you by your ADSL service provider about where and how you should connect the Router to the ADSL line.

Microfilters

Unless you are instructed to use a “line splitter” (see below), it is optional to install a microfilter (low pass filter) device for each telephone or telephone device (answering machines, Faxes etc.) that shares the line with the ADSL service. Microfilters are easy-to-install, in-line devices, which attach to the telephone cable between the telephone and wall jack. Microfilters that install behind the wall plate are also available. A typical in-line microfilter installation is shown in the diagram below.

Microfilter Installation

Important: Do not install the microfilter between the Router and the telephone jack. Microfilters are only intended for use with regular telephones, Fax machines and other regular telephone devices.

Line Splitter

If you are instructed to use a “line splitter”, you must install the device between the Router and the phone jack. Use standard telephone cable with standard RJ-11 connectors. The splitter has three RJ-11 ports used to connect to the wall jack, the Router and if desired, a telephone or telephone device. The connection ports are typically labeled as follows:

Line - This port connects to the wall jack.

ADSL – This port connects to the Router.

Phone – This port connects to a telephone or other telephone device.

The diagram below illustrates the proper use of the splitter.

Line Splitter Installation