My Digital Life

DFL-210 - Syslog event logging

Since I run my Media Center PC 24x7, I decided it would be a good idea to capture log messages from the DFL-210 firewall, my 2 Linksys access points and the SunRocket Innomedia VOIP gateway. I found the Kiwi Syslog Daemon to fit my needs since it worked with all my devices and they provide a freeware version. The Kiwi Syslog Daemon can be run as a service so you do not need to be logged on. You should also download the Kiwi Log Viewer to view the entire log file, the Syslog Daemon will only display the last 100 entries or so.

The key differences that I can between the paid and the freeware version is the ability to filter , better reports and DNS resolution of logged IP addresses. You can request a 30 day trial of the paid version. I may try it once I know my way around the software.

The DFL-210 is configured by adding a Log and Event Receiver under System.

• add a Syslog receiver
• Name = choose a name
• IP address = the IP address of the computer the Kiwi Syslog Daemon is running on
• Facility = a descriptor that will show up in your logs to identify the sender (I used local0)
• Port = 514 (standard syslog receiver port)
• In the Kiwi Syslog Daemon setup enable Inputs/UDP and if you have Linksys equipment enable Inputs/SNMP.
• On Windows XP control panel/firewall/Exceptions Add Port Name=Syslog Port=514

When you set up new items or rules on the DFL-210 you can manually set the logging options.

Next I need to look at filtering and reporting to see if the paid version might be useful for my use.

DFL-210 - Port Forwarding

In order to enable port forwarding you need to create two rules on the DFL-210. The first rule is for service to Static Address Translation (SAT) and the second rule is for Network Address Translation (NAT) to Static Address Translation.

The first rule is created using the following steps:

• Under Rules/IP Rules/wan_to_lan add a new rule
• Under the general tabName = enter desired nameAction = SAT
• Service = Select the desired service
• Schedule = Select the desired schedule or None
• Source interface = any
• Source Network = all-nets (you specify a specific inbound address or range)
• Destination Interface = core
• Destination Network = wan_ip3. Under SAT tab
• Under the SAT tab
• check destination IP address
• New IP Address = the address you want to forward to
• New Port = the port you want to forward to
• Create the rule by clicking OK.

The second rule is created using the following steps:

• Under Rules/IP Rules/wan_to_lan add a new rule
• Under the general tabName = enter desired nameAction = Allow
• Service = Select the desired service
• Schedule = Select the desired schedule or None
• Source interface = any
• Source Network = all-nets (you specify a specific inbound address or range)
• Destination Interface = core
• Destination Network = wan_ip

Create the rule by clicking OK.

Activate the configuration by using the Configuration/Save and Activate menu item.

DFL-210 - Bandwidth management and traffic shaping with pipes

One of the key reasons I purchased the D-Link DFL-210 SOHO router/firewall was the ability to control the bandwidth allocated between my SunRocket VOIP service and the rest of my network devices. The DFL-210 is a commercial grade router and provides great flexibility, however it is much more complicated to configure than consumer grade routers. I have setup a D-LINK DFL-210 category to capture all my posts related to the operation and configuration of the router.

The theory behind the router and firewall is the state full inspection of inbound and outbound data packets separately. To that end, the firewall requires inbound and outbound rule to enable bi-directional traffic.

I placed my SunRocket InnoMedia MTA-6328-2Re VOIP gateway behind the DFL-210 to provide it more protection and provide my network with capabilities like VPN. However the problem with this configuration is the inability of the VOIP gateway to control the amount of bandwidth it needs to provide high quality voice connections. It is essentially competing with every other device on my network for the available bandwidth and the result can be choppy voice conversations. To remedy the situation the DFL-210 needs to prioritize data packets coming out of and going into the VOIP gateway. D-Link's bandwidth management involves the definition of traffic shaping pipes. These pipes can allocate pre-defined bandwidth segments to specific Internet services and ports.

Here are the steps I followed:

1. Configure a static address on the InnoMedia MTA-6328-2Re
2. On the DFL-210

1. Backup your configuration (just in case)
2. Define an IP4 host/network under InterfaceAddresses Objects with the static address you used in the InnoMedia MTA-6328-2Re
3. Define a TCP/UDP service under services objects called SIP with a destination port of 5060. This is the standard VOIP control connection (caller id, etc).
4. Define a TCP/UDP service under services objects called RTP with a destination port range of 16384-16403. This is the range used by SunRocket for the audio G.711 connection.
5. Define a service group under services objects, include SIP and RTP.
6. Define an inbound pipe under traffic shaping with the highest precedence set to 120. This is the maximum you will ever need for a G.711 voice connection, 90 might be enough, but I wanted to error on the safe side.
7. Define an outbound pipe under traffic shaping with the highest precedence set to 120.
8. Define a pipe rule under traffic shaping. Select the service group you defined in 5. The source interface is lan, the source network is the object you defined in 2. The destination interface is any, the destination network is all-nets.
9. In the traffic shaping tab select the outbound pipe defined in 7 for the forward chain and the inbound pipe defined in 6 for the return chain. Set the precedence to highest. This provides bi-directional communication.
10. Save and Activate the configuration.

So far I am very pleased with the SunRocket service. The majority of my calls have been as good as my land line. This configuration should bring the number of quality calls close to a 100%. The only factor out of my control is Comcast (which has been very good lately) and the Internet...

DFL-210 - Quick Config

The D-Link DFL-210 is not a plug and play router. The router is not setup for DHCP, you must first assign a static IP address of 192.168.1.2 and a gateway of 192.168.1.1 on your PC's wired Ethernet adapter. To access the administration UI you connect via IE to 192.168.1.1. You should then check that you are running the latest firmware.

As of 9/8/06 version 2.05 was the newest available. You can download the latest from D-Link and use the tools/upgrade menu item. This is a straight forward process.

The default configuration comes with basic firewall rules that block all inbound traffic and allow outbound traffic via the 4 lan ports. The DMZ port is blocked. There are two elements to configure; the WAN interface, and DHCP.

The WAN interface under Interfaces/Ethernet/wan needed to be setup as a DHCP client for my Comcast connection by checking the Enable DHCP Client box. For every configuration change you then need to use the Configuration/Save and Activate menu item. I also found that the router should be up running before the Motorola cable modem is activated for the connection/address acquisition process to work.

If you have static DNS entries setup on your PC's Ethernet you should be able to access the Internet at this point. If you want to use DHCP to assign IP addresses and DNS entries on your network you need to setup a DHCP server. A default object called lannet is already setup for a pool of addresses (192.168.1.0 - 192.168.1.24) that you can use for DHCP. This object is also used in the lan to wan rule, with this rule the firewall only allows outbound traffic within this IP address range. I create a new object called DHCP_Pool since I have devices on my network with fixed IP addresses. Unfortunately the DHCP server does not have the ability to assign IP address based on MAC address, this is a major omission given that most sub $50 routers have this feature. I have an email out on the subject to D-Link support but no response yet.

The first configuration screen for DHCP.

The DHCP options tabs provides fields for specifying domain name, DNS and WINS entries. Since the router does not understand DNS, you must use an external DNS server (unless you run your own) such as the one gathered by the DHCP client on the wan interface. There are two default object, wan_dns1 and wan_dns2, that can be used to pass the external DNS servers to your clients.

This should get basic firewalled connectivity up and running. Next up; bandwidth management with pipes and pipe rules..

VOIP and the D-Link DFL-210 router

After 3 weeks of waiting, I received my D-Link DFL-210 SOHO router from costcentral.com. I paid $298 + shipping which I consider high for a home office router, however the list of features was impressive and I wanted bandwidth management to place my Innomedia VOIP router behind it. My two initial impressions are: WOW and this is not a consumer grade device.

First WOW: I never knew I could get this kind of speed out my Comcast broadband connection. I connected my IBM X41 tablet directly into the DFL-210 which is connected to my Motorola cable modem. Here are some results:

speakeasy.net's test 15340Kbps down and 349Kbps up.

dslreports.com test 13769Kpbs down and 349 up.

visualware.com VOIP test 16016Kbps down and 360Kbps up. It showed QOS test of 25% which is not good for VOIP, I am not sure this value is accurate since I am not having any problems with my SunRocket VOIP connection.

Second, this is clearly not a consumer grade device. It did not come with a configuration wizard. You must have some knowledge of firewalls and routers to be able to configure it. After a bit of initial struggle, upgrading the firmware and resetting to the factory defaults I was able to get a basic configuration with DHCP implemented. I will discuss this configuration tomorrow. There is a lot more I need to learn to fully utilize the DFL-210's capabilities...