E1500 User Guide

The System Status Overview displays system information regarding hardware including serial number, model, and software version as well as memory utilization and network connection information - IP/DHCP info for the active network, active DHCP leases, and Multi-Wide Area Network (MWAN) interfaces.

Figure 10. Status > Overview

A complete list of active Firewall rules is displayed in this menu, with real time data regarding network traffic handled by these rules.

IPV4 and IPV6 are separately displayed by selecting the Tab at the top of the main window.

Firewall rules are shown at the WAN and LAN level for Inputs, Outputs, Forwarding, Rejection, and Quality of Service (QoS). Rules are sorted into Tables by FILTER / NAT / MANGLE / RAW. Firewall NAT tables apply to IPv4 only.

Each rule entry describes the rule via the target, protocol, input interface, output interface, source IP address or IP address range, and destination IP address or IP address range. Each rule entry also displays options and comments, if any. Finally, each rule entry displays the number of packets and amount of traffic handled by the rule.

Buttons at the top right of the screen allow the user to

Figure 11. Firewall Menus

Displays information on the state of LTE modems and connections.

Submenus are accessible at the top of the LTE menu for displaying an overview of LTE WAN connections, LTE Bearers, LTE Signal indicators, and a scan tool for troubleshooting.

The Overview tab provides connection status for each modem present, including connection state, registration state, operator information, and signal quality as a percentage,as well as device information for each modem present, including Integrated Circuit Card Identifier (ICCID), International Mobile Subscriber Identity (IMSI), and International Mobile Equipment Identity (IMEI).

Connection States - LTE modem is:

Registration States - LTE modem is:

Figure 12. Status > LTE > Overview

Signal Quality is shown as a percentage in the range from 0-100%, where higher percentage indicates better signal quality. Signal quality is based on the LTE radio’s RSSI level. In general, signal quality above 40% is usable.

The Bearers tab provides information on each LTE bearer network established for each modem present, including interface status, IPv4 and/or IPv6 network information, and data transmission statistics.

Figure 13. Status > LTE > Bearers

Interface: wwan0 (wireless WAN 0): the network interface created by the modem

The Signal tab provides information for each modem present for the active band, channel, and cell, as well as quality information for the RF signal.

Signal quality level with respect to RSRQ thresholds (Referenced from TIA TSB-88.4 standards)

Figure 14. Status > LTE > Signal

Finally, the Scan tab provides a tool for the user to perform a network scan for time intervals from 30 to 90 seconds using any system modems, listing carriers detected by modem. Details are given for Operator Code, Operator Name, Access Technology, and Availability.

Figure 15. Status > LTE Scan: Cellular Network Scanning Tool

Information retrieved from the E1500's GPS connection is displayed. This includes the last known GPS location and time.

Figure 16. Status > GPS

Displays information on currently configured routing rules. The rules are divided into IPv4 and IPv6. An ARP table and an IPv6 neighbors table are also provided.

Figure 17. Status > Routes

The operating system log output is displayed.

Figure 18. Status > System Log

The operating system kernel log is displayed.

Figure 19. Status > Kernel Log

A list of currently running system processes is displayed, including process ID (PID), owner, command, and CPU / memory usage. To quit a process, action buttons are given for "Hang Up" and, to forcibly quit an unresponsive process, the more aggressive "Terminate" and "Kill".

Figure 20. Status > Processes

Displays live graphs of system performance.

The Load tab displays a live graph of the queue of processes handled by the CPU, as well as average and peak loads for the past 1, 5, and 15 minutes. Note that in a single core CPU, a load of 1.0 is considered fully loaded.

Figure 21. Status > Realtime Graphs > Load

The Traffic tab shows a live graph of inbound and outbound traffic as well as a table of average and peak inbound and outbound traffic. At the top of the graph is a selectable list of interfaces.

Figure 22. Status > Realtime Graphs > Traffic

The Connections tab provides a live graph of network connections, divided into TCP, UDP, and others, including averages and peaks. A table lists each active connection, its protocol, source, destination, and amount of data transferred.

Figure 23. Status > Realtime Graphs > Connections

Finally, the Rate tab shows the real time download and upload rates by IP address, as well as total bytes and total packets over which the rate is calculated.

Figure 24. Status > Realtime Graphs > Rate

Provides information on MWAN interfaces. The Interface tab lists all available MWAN interfaces and their status.

Figure 25. Status > Load Balancing > Interface

MWAN interfaces are the interfaces participating in a configured load balancing process. See LAN to WAN Traffic or Radio Module Failover use cases for details on how to configure these interfaces.

The Detail tab provides information from the operating system on interface status, IPv4 and IPv6 policies, and connected IPv4 and IPv6 networks.

Figure 26. Status > Load Balancing > Detail

The Diagnostics tab includes basic tools for testing MWAN interfaces (Gateway ping, Ping tracking IP, Check IP rules, Check routing table, Hotplug ifup, Hotplug ifdown).

Figure 27. Status > Load Balancing > Diagnostics

The Troubleshooting tab shows the operating system’s output after running diagnostic commands. Information on network interfaces, active routes, routing, and firewall rules can be inspected on the output display.

Figure 28. Status > Load Balancing > Troubleshooting

The System submenu provides access to overall unit settings. The General Settings tab lets the user set time, hostname, and time zone. The Logging tab has settings for the log buffer size, log output level, and log file save location. The Language and Style tab lets the user set the GUI theme and language.

Figure 29. System > System > General Settings

Figure 30. System > System > Logging

Figure 31. System > System > Time Synchronization

Figure 32. System > System > Language and Style

Usernames and passwords are configured in the Administration submenu.

The Router Password tab lets the user change the device’s root password. The root user is currently the only user who can access the GUI. Future firmware revisions will allow other users to access the GUI.

Figure 33. System > Administration > Router Password

The SSH Access tab lets the user enable or disable general users and/or the root user over SSH with password authentication. SSH can also be restricted via access to a specified interface & port.

When the “Password authentication” box is checked, all users except ‘root’ will have password authenticated access to the unit via SSH.

When the “Allow root login with password’ box is checked, only the ‘root’ user will have password authenticated access via SSH.

Figure 34. System > Administration > SSH Access

The SSH-Keys tab displays uploaded SSH public keys, and lets you upload an SSH public key to access SSH using public-private keypair authentication.

Figure 35. System > Administration > SSH-Keys

The Software menu displays free space on the device, and allows the installation, removal, and updating of software packages. The Available tab shows packages available through the configured package manager. The Installed tab shows currently installed packages and allows for their removal. The Updates tab shows installed packages with available updates and lets the user update to the latest version.

Figure 36. System > Software

To configure OPKG, click on the “Configure OPKG” option. The following screen will pop up.

Figure 37. OPKG Configuration

On the OPKG configuration screen, go to the last section “opkg/disfeed.conf” and change the default repository to the desired repository where you are hosting the packages you would like to install. Click SAVE after you are done.

Click the UPDATE LISTS button to show the available packages in the newly configured repository. After that point you can install new packages from the list by clicking the INSTALL... button and then clicking on INSTALL in the pop up window.

Figure 38. Install new packages

Figure 39. Detailed list of packages (example: block-mount)

Clicking ‘INSTALL’ will show software details as in the example ‘block-mount’ package shown above. Software details including Version, Size, and Dependencies are displayed. A description of the software package is shown at the bottom. The option to overwrite files from other package(s) is selectable with a check box. From this dialog, the user can select CANCEL to go back or INSTALL to install the software package.

The Startup submenu lets the user configure startup and initialization programs.

The Initscripts tab displays a list of available initialization scripts, their priorities, and whether they are enabled or disabled (for run on startup). You can also toggle scripts between enabled and disabled, and manually start, restart, or stop a script.

Figure 40. System > Startup > Initscripts

The Local Startup tab lets the user enter a custom shell script, to be executed after the enabled system initialization scripts listed on the Initscripts tab.

Figure 41. System > Startup > Local Startup

Here the user can set up “cron jobs” - recurring tasks which are configured to run on a set schedule.

Figure 42. System > Scheduled Tasks

The status LED is a red/green LED that can be customized to the user’s preferences.

The LED Configuration screen lists LED behaviors (actions) and lets the user edit, delete, and reorder them.

Since the status LED contains a green and a red LED, each color can be configured to its own action. For maximum clarity, a simple green ‘always on’ power indicator is typical. Multiple actions can be configured but for simplicity we recommend no more than a one-to-one mapping of a color to an action and amaximum of two actions in the list).

A new LED action can be added by clicking “Add LED Action “. To edit an existing action, click “EDIT.” Whether adding a new action or editing an existing action, the input fields are the same:

LED triggers are selected from the following options:

Figure 43. System > LED Configuration

The example configuration shown above is set up for a green ‘always on’ power indicator with a simultaneous red LAN1 send/receive indicator. Note that the red LED in this example will act the same as the existing ethernet port LED - and therefore is not a recommended LED action based on the rule of thumb of simplicity.

“Netdev” trigger settings for the red LED action are seen below.

Figure 44. System > LED configuration: netdev example

This menu gives access to the unit firmware.

The Action tab lets the user backup and restore firmware.

Figure 45. System > Backup/Flash Firmware: Actions

The Configuration tab gives the user the option to specify files and directories to be preserved when flashing new firmware.

Figure 46. System > Backup/Flash Firmware: Configuration

Allows for setup and execution of custom commands. These can be any applicable Linux command typically run from a command line interface. As such, these commands should only be performed by an advanced user.

The Dashboard tab displays currently configured custom commands and provides a button to run the command. Clicking RUN will display the command output at the bottom of the page when the command has completed.

Figure 47. System > Custom Commands > Dashboard

Figure 48. System > Custom Commands > Dashboard

Showing results of 'sudo ping google.com -c5' command

The Configure tab lets the user add new custom commands and edit and delete existing ones.

Figure 49. System > Custom Commands > Configure

Lets the user perform a soft reboot, which restarts the unit and all components without removing power.

Figure 50. System > Reboot

Under IPSec there are two main tabs. Status shows the status of all active IPSec configurations and Config lets the user configure IPSec Connections, Tunnels, and Ciphers.

Figure 56: VPN > IPSec: Status

Figure 57: VPN > IPSec: Config

NOTE: VPN > IPSec: Configure window is the same as the main IPSec window

IPSec is a secure network protocol for encrypting communications between two points, the client and server. To create a configuration there are three steps:

In the cipher proposal window, the suite of algorithms to use for authentication phases

parameters are defined: the encryption algorithm, the integrity algorithm and the Diffie Hellman group. Supported options are listed in the drop-down menus.

Figure 58: IPSec Cipher proposal

In the Tunnels configuration window, the next set of parameters define the local and remote networks along with a phase 2 proposal. These settings define the networks of the two ends of the tunnel, and the authentication method is selected (pre-shared key or X.509 certificates).

Figure 59: IPSec Tunnel configuration

The last step in setting up a VPN with IPSec encryption is defined in the Connections window. Here, peer network information (detailing the other end of the VPN tunnel) is entered, and the Cipher (Phase 1) Proposal and Tunnel are selected.

Figure 60: IPSec Connection configuration

OpenVPN is an open-source VPN protocol that executes virtual private network (VPN) techniques for producing safe site-to-site or point-to-point connections in remote access facilities and bridged or routed configurations.

The OpenVPN menu displays a list of configured VPNs and their current states and allows the user to enable, start/stop, add, edit, or delete VPNs.

Create a new configuration with the Template-based configuration dialog by giving the new configuration a name, selecting a template, and clicking ADD. The new configuration appears in the OpenVPN Instances list and can be edited by clicking EDIT.

OpenVPN Templates provided are:

Configuration files for these templates are shown below:

#
# Ethernet bridge client
#
config openvpn_recipe client_tun
	option _description	"Client configuration for an ethernet bridge VPN"
	option _role		"client"
	option client		"1"
	option dev 		"tap"
	option remote		"vpnserver.example.org 1194"
	option ca 		"ca.crt"
	option cert		"my_client.crt"
	option key 		"my_client.key"
	option dh 		"dh1024.pem"
	option ns_cert_type	"server"
	option keepalive	"10 120"
	option comp_lzo		"1"
	option nobind		"1"

#
# Routed client
#
config openvpn_recipe client_tun
	option _description	"Client configuration for a routed multi-client VPN"
	option _role		"client"
	option client		"1"
	option dev 		"tun"
	option remote		"vpnserver.example.org 1194"
	option ca 		"ca.crt"
	option cert		"my_client.crt"
	option key 		"my_client.key"
	option dh 		"dh1024.pem"
	option ns_cert_type	"server"
	option keepalive	"10 120"
	option comp_lzo		"1"
	option nobind		"1"

#
# Routed point-to-point client
#
config openvpn_recipe client_tun_ptp
	option _description	"Simple client configuration for a routed point-to-point VPN"
	option _role		"client"
	option dev		"tun"
	option remote 		"mypeer.dyndns.org"
	option port 		"1194"
	option ifconfig		"10.0.0.2 10.0.0.1"
	option secret		"shared-secret.key"
	option nobind		"1"

#
# Multi-client ethernet bridge server
#
config openvpn_recipe server_tun
	option _description		"Server configuration for an ethernet bridge VPN"
	option _role			"server"
	option dev			"tap"
	option port			"1194"
	option server_bridge 		"192.168.1.1 255.255.255.0 192.168.1.128 192.168.1.254"
	option ca			"ca.crt"
	option cert 			"server.crt"
	option key 			"server.key"
	option dh 			"dh1024.pem"
	option client_to_client		"1"
	option keepalive		"10 120"
	option comp_lzo			"1"

#
# Routed multi-client server
#
config openvpn_recipe server_tun
	option _description		"Server configuration for a routed multi-client VPN"
	option _role			"server"
	option dev			"tun"
	option port			"1194"
	option server			"10.0.100.0 255.255.255.0"
	option ca			"ca.crt"
	option cert 			"server.crt"
	option key 			"server.key"
	option dh 			"dh1024.pem"
	option client_to_client		"1"
	option keepalive		"10 120"
	option comp_lzo			"1"

#
# Routed point-to-point server
#
config openvpn_recipe server_tun_ptp
	option _description	"Simple server configuration for a routed point-to-point VPN"
	option _role		"server"
	option dev		"tun"
	option port		"1194"
	option ifconfig		"10.0.0.1 10.0.0.2"
	option secret		"shared-secret.key"

New VPNs can be uploaded from an OpenVPN configuration file, or by using one of the provided VPN templates. Note that when using template configuration, the user must edit the VPN after creation to provide the required information. However, this option is only for client configurations.

Use the OVPN configuration file upload dialog to name the new configuration and click UPLOAD. The new configuration appears in the table.

Figure 51. VPN > OpenVPN

Allows the user to set the serial communication protocol for the Serial A interface. The protocols supported by this interface are RS232, RS485 Half Duplex, and RS422/RS485 Full Duplex. The table below shows a basic comparison between these three protocols.

Figure 52. Serial Protocols Comparison

The Serial B interface only supports the RS232 protocol.

Figure 53. Services > Serial Configuration

This menu controls QoS at the packet level. It lets the user set Upload and Download Rate Limits to prioritize network traffic for each system interface. Rate Limits can be created to match traffic based on source IP address. Existing classification rules can be edited or deleted.

NFT-QoS Settings > Limit Rate contains settings for Download and Upload rate limits. Select the Limit Enable checkbox. By selecting Limit Type: Static, the user can set default DL/UL limit rates in bytes/s, Kbytes/s, or Mbytes/s. By selecting Limit Type: Dynamic, the user can set default DL/UL bandwidth limits in Mbps across a specified target Network using IPv4 or IPv6 addresses in CIDR notation. Individual IP address(es) can be added to a whitelist to bypass default limit rates when using either Limit Type by entering a whitelisted address and clicking the "+" button.

Figure 54. Services > QoS over Nftables > Limit Rate

NFT-QoS Settings > Traffic Priority contains the interface selector fro which QoS Traffic Priorities can be configured. Select the Enable Traffic Priority checkbox. Select the Default Network Interface from the dropdown.

If the Traffic Priority Settings section is not visible, click Save & Apply. Continue to Traffic Priority Settings.

Static QoS - Download Rate / Statis QoS - Upload Rate sections are configurable when the Limit Rate is enabled. These sections allow the user to set Download / Upload rates for specific IP address(es). Click the ADD button and enter each hostname, IP address, MAC (optional) and Limit Rates in bytes/sec, Kbytes/sec, or Mbytes/sec. These Static QoS Rates are configurable in either Limit Type: Static or Limit Type: Dynamic (described in the Limit Rate settings above).

Figure 55. Services > QoS over Nftables > Traffic Priority

Traffic Priority Settings section lets the user configure traffic priority by protocol and service. Click the ADD button and select a protocol (TCP, UDP, UDP-Lite, SCTP, or DCCP), priority (1 is highest), service (telnet, http, https, or a port number - multiple entries are possible, separated by a comma), and an optional comment. For multiple protocols, click the ADD button and repeat as needed. Click Save & Apply.

Note

When Limit Enable and/or Enable Traffic Priority are disabled, the corresponding Static Rates and/or Traffic Priority settings are not displayed until after clicking Save & Apply. Likewise, if Limit Enable and/or Enable Traffic Priority are enabled, their corresponding settings will not appear in the display until after clicking Save & Apply. If either option is disabled and later re-enabled, any settings the user has previously configured will be available as previously configured.

This menu provides Simple Network Management Protocol (SNMP) configuration via SNMP agents, SNMP traps, and SNMP informs, to manage the device over the network. SNMP is implemented via the Linux daemon net-snmpd. For more information on configuring SNMPD, see http://net-snmp.sourceforge.net/wiki/index.php/Snmpd.

Figure 56. Services > SNMPD

Displays information on and allows the configuration of the unit’s network interfaces. Each interface is listed with information including protocol, uptime, MAC address, transmitted and received data, and IPv4/IPV6 address and netmask (if applicable). The user can add / edit / delete interfaces and stop or restart active interfaces.

Figure 57. Network > Interfaces

To add interfaces, enter a name, select a protocol, and select the physical interface (multiple interfaces if bridging). Additional options can be accessed by editing the interface once created, such as the protocol to use and whether to bring up the interface automatically on boot.

Available Options on the Interface editing dialogue vary depending on the selected protocol.

Figure 58. Interfaces > Advanced Settings

Figure 59. Interfaces > LANx > General Settings

Figure 60. Interfaces > LANx > Advanced Settings

On the Physical Settings tab, the user can select whether to bridge physical interfaces, and select the physical interface (or interfaces, in the case of a bridge). If bridging is enabled, the user can enable/disable STP and IGMP snooping.

Bridging physical interfaces allows all ports in the bridge to act as a single network.

By enabling bridging, we can combine, for example, the WiFi (WLAN) interface(s) with the wired LAN ports to create a single logical network. We can also combine the two ethernet ports if desired.

Figure 61. Interfaces > LANx > Physical Settings

On the Firewall Settings tab, the user can create / assign the interface’s firewall zone.

The router Firewall collects interfaces into ‘firewall-zones’ to filter traffic. A firewall-zone can be configured to any set of interfaces but generally there are at least two zones:

A minimal router firewall configuration typically consists of one section, at least two firewall-zones (lan and wan), and one forwarding to allow traffic from LAN to WAN.

Figure 62. Interfaces > Firewall Settings

On the DHCP Server tab, the user can set up the interface as a DHCP (Dynamic Host Control Protocol) Server.

Figure 63. Interfaces > DHCP Server > General

General Settings - Here the user can set the following General Options:

Advanced Settings - Here the user can set up the following Advanced DHCP options:

Figure 64. Interfaces > DHCP Server > Advanced

IPv6 Settings - Here the user can set up the following IPv6 DHCP options:

From the OpenWRT manual:

OpenWrt features a versatile RA & DHCPv6 server and relay. Per default, SLAAC
(Stateless Address Autoconfiguration) and both stateless and statefule DHCPv6
are enabled on an interface. If there are any prefixes of size /64 or shorter
present, then addresses will be handed out from each prefix. If all addresses
on an interface have prefixes shorter than /64 then DHCPv6 Prefix Delegation is
enabled for downstream routers. If a default route is present the router advertises
itself as default router on the interface.

The system is also able to detect when there is no prefix available from an
upstream interface and can switch into relaying mode automatically to extend
the upstream interface configuration onto its downstream interfaces. This is
useful for putting the target router behind another IPv6 router which doesn’t
offer prefixes via DHCPv6-PD.

For more on IPv6 routing with OpenWRT, refer to: https://openwrt.org/docs/guide-user/network/ipv6/start#router_advertisement_dhcpv6

Figure 65. Interfaces > DHCP Server > IPv6 Settings

Displays active wireless networks and associated stations. Wireless network interfaces can be enabled / disabled / restarted / added / edited / removed.

Figure 66. Wireless > Overview

The Restart button can be used to restart the wireless interface.

The Scan button starts a network scan for detectable wireless networks, displaying signal strength, SSID (network name), encryption type, and other network information.

The Join Network button opens a dialogue to connect to a network. If the network is encrypted, authentication credentials are required to join.

When adding / editing a wireless network, the Edit wireless network dialogue is displayed. The General Setup tab (located on the top card of the Edit wireless network dialogue) lets the user enable or disable the network, select the frequency band and channel, and set maximum transmit power.

Figure 67. Wireless > Wireless Network > General [Top Card]

The Advanced Settings tab (located on the top card of the Edit wireless network dialogue) allows the user to set a non-default country code, toggle allowing legacy 802.11b rates, set up distance optimization, change fragmentation and RTS/CTS thresholds, and set the beacon interval. The user can force 40MHz channels, bearing in mind that this is non-compliant with IEEE 802.11n-2009.

Figure 68. Wireless > Wireless Network > Advanced [Top Card] and General Setup [Bottom Card]

Configuration options available on the bottom card of the Edit wireless network dialogue vary depending on the wireless mode configuration.

A common configuration, for example, is to configure the unit as a wireless access point. To set this up, under the General Setup tab (located on the bottom card of the Edit wireless network dialog) use the following options:

Under the Wireless Security tab (located on the bottom card of the Edit wireless network dialog), the user can configure network security settings. Configuration options vary based on encryption type selected. We recommend using a strong security WPA2 encryption.

The most common encryption type is WPA2-PSK password-based. After selecting “WPA2-PSK (strong security)” from the dropdown, the user can enter the Key (password), and optionally enable WPS push button authentication.

Figure 69. Wireless > Wireless Network > Wireless Security [Bottom Card]

Alternatively, if a RADIUS authentication server exists on the network, the user can select “WPA2-EAP (strong security)” from the dropdown list to set up RADIUS authentication. Follow these steps to set up RADIUS:

For both WPA2-PSK and WPA2-EAP encryption, the user has the option to select a cipher, and configure 802.11r fast translation, 802.11w management frame protection, and key reinstallation countermeasures.

Under the MAC-Filter tab (located on the bottom card of the Edit wireless network dialogue), the user can set up blacklist (do not allow) or whitelist (only allow) devices with specific MAC addresses.

Figure 70. Wireless > Wireless Network > MAC-Filter [Bottom Card]

Under the Advanced Settings tab (located on the bottom card of the Edit wireless network dialogue), the user can configure advanced settings for the wireless network such as preventing client to client communication and overriding the default wireless interface name.

Figure 71. Wireless > Wireless Network > Advanced Settings [Bottom Card]

Allows the user to configure groups of ports as ‘virtual LANs’

The Status tab displays the status of the bridge interfaces and VLANs.

Figure 72. Network > Bridge VLANs > Status

The Configure tab lets the user enable bridge VLAN filtering and specify a bridge interface to use, and to add, edit, and delete bridge VLAN assignments.

Figure 73. Network > Bridge VLANs > Configure

The DHCP and DNS menu lets the user configure Dynamic Host Configuration Protocol (DHCP) server and Domain Name System (DNS) forwarder options for local Network Address Translation (NAT) networks.

The General Settings tab allows the user to set the general behavior for the DHCP server and DNS forwarder.

Figure 74. Network > DHCP and DNS > General Settings

The Resolv and Hosts Files tab lets the user specify configuration files for the DHCP server, specify a DHCP lease file, specify a DNS resolve file, and specify additional hosts files (in addition to the default /etc/hosts).

Figure 75. Network > DHCP and DNS > Resolv and Hosts Files

The TFTP Settings tab is to enable and configure the root directory for a TFTP server.

Figure 76. Network > DHCP and DNS > TFTP Settings

The Advanced Settings tab allows the configuration of additional behavior settings for the DHCP server and DNS forwarder.

Figure 77. Network > DHCP and DNS > Advanced Settings

Finally, the Static Leases tab lets the user view, add, and edit static leases for DHCP clients as well as view active DHCP leases for IPv4 and IPv6 clients. Static DHCP leases can be configured with optional symbolic hostnames and custom lease times.

Figure 78. Network > DHCP and DNS > Static Leases

The SIMs menu lets the user display current SIM card info in the General Info section. In the APNs section, users can set identifying APN numbers on installed SIM card(s) by entering the APN number in the applicable interface text box and clicking Save & Apply.

Figure 79. Network > SIMs

The Hostnames menu lets the user set up custom hostnames for IP addresses. You can add a new host entry, edit, or delete an existing entry by clicking the ADD button and entering a hostname then selecting an IP address from the dropdown menu, or you can edit or delete existing entries, and reorder entries by dragging them to another location in the list with the icon.

Figure 80. Network > Hostnames

Figure 81. Network > Hostnames > Adding a hostname

Static routes provide one of the safest methods of Layer 3 connectivity. These are secure from route spoofing attacks because your router does not rely on routing information being sent and received from other routers. All the routing information is user controlled and locally configured.

Static routes are typically used where:

With static routes, the following is true:

Figure 82. Network > Static Routes

To add a route, click the ADD button. On new routes or when editing existing routes, the following settings are available:

Figure 83. Network > Static Routes > General

Figure 84. Network > Static Routes > Advanced

The Firewall menu is for setting up Firewall Zones, Rules, and Port Forwarding.

The General Settings tab contains default Firewall settings and provides add / edit / delete functions for the listed Firewall Zones.

Figure 85. Network > Firewall > General

When creating a new firewall zone or editing an existing one, the Firewall - Zone Settings dialogue appears with the following submenus:

Firewall - Zone Settings > General Settings contains settings for:

Firewall - Zone Settings > Advanced Settings contains the settings to:

Firewall - Zone Settings > Conntrack Settings contains settings for:

Conntrack is a userspace command line program targeted at system administrators. It enables them to view and manage the in-kernel connection tracking state table.

Firewall - Zone Settings > Extra Iptables Arguments allows the user to set up raw source and destination arguments to the iptables command allowing finer control of firewall rules.

The Port Forwards tab displays existing port forwarding rules, and lets the user add / edit / delete Port Forwarding Rules. This configures the unit to forward traffic directed to a port on the device to another IP address and port.

Figure 86. Network > Firewall > Port Forwards

When creating / editing a port forward, the Firewall - Port Forwards dialogue is displayed with the following submenus:

Firewall - Port Forwards > General Settings contains settings for:

Firewall - Port Forwards > Advanced Settings provides for further traffic restrictions by matching the forwarding rule to:

Advanced Settings are also provided for these cases (intended only for Advanced users):

The Traffic Rules tab displays existing traffic rules and provides add / edit / delete functionality.

Figure 87. Network > Firewall > Traffic Rules

When adding / editing an existing Rule, the Firewall - Traffic Rules dialogue is displayed.

Firewall - Traffic Rules > General Settings is provided to configure the Traffic Rule matching criteria:

And to set the action to take for packets matching the rule.

Available actions are summarized below:

Firewall - Traffic Rules > Advanced Settings provides further restrictions when the traffic rule matches:

And to pass raw arguments (Firewall Zone Extra IPTables Arguments) to the underlying iptables command.

Firewall - Traffic Rules > Time Restrictions lets the user specify a date and/or time range during which the Traffic Rule will be enforced.

The NAT Rules tab displays existing NAT rules. Here the user can add / delete / edit NAT rules, fine-tuning control over the source IP address(es) used for outbound and forwarded traffic.

Figure 88. Network > Firewall > NAT Rules

When adding a new NAT rule or editing an existing one, the Firewall - NAT Rules dialogue is displayed.

Firewall - NAT Rules > General Settings lets the user set

And the action to take for packets matching the rule. In the case of the SNAT action, you must specify a rewrite IP address.

Firewall - NAT Rules > Advanced Settings lets the user further restrict when the NAT rule is matched by

And to pass raw arguments to the underlying iptables command.

Firewall - NAT Rules > Time Restrictions lets the user specify a date and/or time range during which the Traffic Rule will be enforced.

The Custom Rules tab lets the user specify a custom shell script to be executed after the default ruleset has been loaded, allowing advanced users direct control to execute arbitrary iptables commands.

Figure 89. Network > Firewall > Custom Rules

The Diagnostics menu provides basic tools to verify network state and troubleshoot network issues. Ping, traceroute, or nslookup can be performed on any specified hostname or IP address.

Figure 90. Network > Diagnostics

See Use Case E: Radio Module Failover