User manual SMC BR21VPN

[. . . ] Printed in Taiwan Trademarks: SMC is a registered trademark; and EZ Connect is a trademark of SMC Networks, Inc. Other product and company names are trademarks or registered trademarks of their respective holders. LIMITED WARRANTY Limited Warranty Statement: SMC Networks, Inc. ("SMC") warrants its products to be free from defects in workmanship and materials, under normal use and service, for the applicable warranty term. All SMC products carry a standard 90-day limited warranty from the date of purchase from SMC or its Authorized Reseller. [. . . ] If you want to open a new website, you must delete the order of forbidding all and then enter the new domain name. At last, re-enter the "forbid all" order again. 108 STEP 1Enter the following in URL of Content Filtering function: Click New Entry URL String: Enter ~yahoo, and click OK Click New Entry URL String: Enter ~google, and click OK Click New Entry URL String: Enter , and click OK Complete setting a URL Blocking policy (Figure9-1) Figure9-1 Content Filtering Table 109 STEP 2Add a Outgoing Policy and use in Content Blocking function: (Figure9-2) Figure9-2 URL Blocking Policy Setting STEP 3Complete the policy of permitting the internal users only can access to some specific website in Outgoing Policy function: (Figure9-3) Figure9-3 Complete Policy Settings Afterwards the users only can browse the website that include "yahoo" and "google" in domain name by the above policy. 110 SCRIPT Restrict the Internal Users to access to Script file of Website STEP 1Select the following data in Script of Content Blocking function: Select Popup Blocking Select ActiveX Blocking Select Java Blocking Select Cookies Blocking Click OK Complete the setting of Script Blocking (Figure9-4) Figure9-4 Script Blocking WebUI 111 STEP 2Add a new Outgoing Policy and use in Content Blocking function: (Figure9-5) Figure9-5 New Policy of Script Blocking Setting STEP 3Complete the policy of restricting the internal users to access to Script file of Website in Outgoing Policy: (Figure9-6) Figure9-6 Complete Script Blocking Policy Setting The users may not use the specific function (like JAVA, cookie. . . etc. ) to browse the website through this policy. It can forbid the user browsing stock exchange website. . . etc. 112 Download Restrict the Internal Users to access to video, audio, and some specific sub-name file from http or ftp protocol directly STEP 1Enter the following settings in Download of Content Blocking function: Select All Types Blocking Click OK Complete the setting of Download Blocking. (Figure9-13) Figure9-13 Download Blocking WebUI 113 STEP 2Add a new Outgoing Policy and use in Content Blocking function: (Figure9-14) Figure9-14 Add New Download Blocking Policy Setting STEP 3Complete the Outgoing Policy of restricting the internal users to access to video, audio, and some specific sub-name file by http protocol directly: (Figure9-15) Figure9-15 Complete Download Blocking Policy Setting 114 P2P / IM Limit internal user access internet resources by P2P software. Step1. In IM / P2P Blocking Setting, add the following settings Click New Entry. Fig. Select eDonkey, Bit Torrent, WinMX, Foxy, KuGoo, AppleJuice, AudioGalaxy, DirectConnect, iMesh and MUTE. 10-6 Fig. 10-5 P2P blocking setting Fig. 10-6 Complete the P2P blocking setting 115 Step2. In Policy Outgoing, add one policy applied to P2P blocking setting. Fig. In Policy Outgoing , complete the policy setting of limit internal user to access internet resources by P2P software Fig. 10-8 Fig. 10-8 Complete the Policy setting of P2P blocking 116 Use P2P will seriously occupy network bandwidth and it can change its service port. So the MIS engineer not only set the service port in Service, but also need to set IM / P2P Blocking P2P Blocking. 117 Chapter 10 Virtual Server Virtual Server The real IP address provided from ISP is always not enough for all the users when the system manager applies the network connection from ISP. (Take HTTP, POP3, SMTP, and DNS Group for example) 116 Ex3 Ex4 120 Preparation Apply for two ADSL that have static IP (WAN1 static IP is 61. 11. 11. 10~ 61. 11. 11. 14) (WAN2 static IP is 211. 22. 22. 18~ 211. 22. 22. 30) 121 Example Make a single server that provides several services such as FTP, Web, and Mail, to provide service by policy STEP 1Setting a server that provide several services in LAN, and set up the network card's IP as 192. 168. 1. 100. STEP 2Enter the following setting in LAN of Address function: (Figure10-1) Figure10-1 Mapped IP Settings of Server in Address STEP 3Enter the following data in Mapped IP of Virtual Server function: Click New Entry WAN IP: Enter 61. 11. 11. 12 (click Assist for assistance) Map to Virtual IP: Enter 192. 168. 1. 100 Click OK Complete the setting of adding new mapped IP (Figure10-2) Figure10-2 Mapped IP Setting WebUI 122 STEP 4Group the services (DNS, FTP, HTTP, POP3, SMTP. . . ) that provided and used by server in Service function. And add a new service group for server to send mails at the same time. (Figure10-3) Figure10-3 Service Setting STEP 5Add a policy that includes settings of STEP3, 4 in Incoming Policy. (Figure10-4) Figure10-4 Complete the Incoming Policy STEP 6Add a policy that includes STEP2, 4 in Outgoing Policy. It makes the server to send e-mail to external mail server by mail service. (Figure10-5) Figure10-5 Complete the Outgoing Policy 123 STEP 7Complete the setting of providing several services by mapped IP. (Figure10-6) Figure10-6 A Single Server that Provides Several Services by Mapped IP Strong suggests not to choose ANY when setting Mapped IP and choosing service. Otherwise the Mapped IP will be exposed to Internet easily and may be attacked by Hacker. 124 Make several servers that provide a single service, to provide service through policy by Virtual Server (Take Web service for example) STEP 1Setting several servers that provide Web service in LAN network, which IP Address is 192. 168. 1. 101, 192. 168. 1. 102, 192. 168. 1. 103, and 192. 168. 1. 104 125 STEP 2Enter the following data in Server 1 of Virtual Server function: Click the button next to Virtual Server Real IP ("click here to configure") in Server 1 Virtual Server Real IP: Enter 211. 22. 22. 23 (click Assist for assistance) Click OK (Figure10-7) Figure10-7 Virtual Server Real IP Setting Click New Entry Service: Select HTTP (80) External Service Port: Change to 8080 Load Balance Server1: Enter 192. 168. 1. 101 Load Balance Server2: Enter 192. 168. 1. 102 Load Balance Server3: Enter 192. 168. 1. 103 Load Balance Server4: Enter 192. 168. 1. 104 Click OK Complete the setting of Virtual Server (Figure10-8) Figure10-8 Virtual Server Configuration WebUI 126 STEP 3Add a new policy in Incoming Policy, which includes the virtual server, set by STEP2. (Figure10-9) Figure10-9 Complete Virtual Server Policy Setting In this example, the external users must change its port number to 8080 before entering the Website that set by the Web server. STEP 4Complete the setting of providing a single service by virtual server. (Figure10-10) Figure10-10 Several Servers Provide a Single Service by Virtual Server 127 The external user use VoIP to connect with VoIP of LAN (VoIP Port: TCP 1720, TCP 15328-15333, UDP 15328-15333) STEP 1Set up VoIP in LAN network, and its IP is 192. 168. 1. 100 STEP 2Enter the following setting in LAN of Address function: (Figure10-11) Figure10-11 Setting LAN Address WebUI STEP 3Add new VoIP service group in Custom of Service function. [. . . ] UpstreamThe percentage of Upstream and the value of each LAN service server who uses SMC BR21VPN to WAN users. First PacketWhen the first packet is sent from WAN users to LAN service server, the sent time will be recorded by the SMC BR21VPN. Last PacketWhen the last packet is sent from LAN service server to WAN users, the sent time will be recorded by the SMC BR21VPN. DurationThe period of time starts from the first packet to the last packet to be recorded. [. . . ]