Monthly Archives: June 2017

How to setup ip-mac binding in your switch?

For security purpose, you might want to bind ip address with MAC address for client devices. There are several IP-mac binding solutions, including ARP binding, port-based binding…

In this post, I will introduce the steps to setup port-based IP-MAC binding in your switch.

1. Cisco 2950

Syntax of cisco 2950 port-based IP-MAC binding.
Switch#config terminal
Switch(config)#Interface fastethernet 0/1
Switch(config-if)#switchport port-security mac-address xxxx.xxxx.xxxx ip-address 192.168.x.x

2. Huawei S5700

Syntax of Huawei S5700 port-based IP-MAC binding.
#interface GigabitEthernet 1/0/1
#user-bind mac-addr xxxx-xxxx-xxxx ip-addr 10.100.11.2

Other models have similar syntax. Port-based binding in switch is powerful, but it’s rather complicated to setup and maintaince, especially when you have a lot clients.

However, IP-MAC binding in gateway is easier to setup, also with powerful features, please check below screenshots in WFilter NG firewall.

3. WFilter NGF

When configured, DHCP clients will be assigned with static ip addresses; clients not matching the ip-mac binding relationship will be blocked.

A site to site ipsec vpn example.

With the “IPSec VPN” module in WFilter NGF, you can build a secure site-to-site VPN by a few clicks. In this post, I will demonstrate a typical usage of site to site ipsec vpn. Please check the diagram at first.

When successfully configure, A,B,C will have full access of each other. Please check below steps:

Suppose you have 3 networks:

Headquarter A, static public ip address, LAN subnet is 192.168.10.0/24.
Branch B, PPPoE internet access, LAN subnet is 192.168.30.0/24.
Branch C, PPPoE internet access, LAN subnet is 172.16.1.0/24.

Now let me guide you to build a virtual private network(VPN) for these three locations.

1 Settings for Headquarter A

Setup the IPSec tunnel

Enable forwarding of branches

Without this setting, branches can access headquarter, but no access between branches.

2 Branch B

Setup the IPSec tunnel

3 Branch C

Setup the IPSec tunnel

By above steps, AB and AC are now connected. If you also want B and C to communicate with each other, you need to add B&C subnets in headquartor’s local subnet.

Turn your old PC into a firewall appliance.

You may have an old desktop PC sitting in a closet or somewhere. Did you know that you still can make it useful? In this guide, I will demonstrate the steps to turn your old pc into a network firewall appliance.

1. First, please check what you need to prepare.

1.1) an old desktop pc.
1.2) a gigabit ethernet adapter.
1.3) a usb stick.

2. Mount the ethernet adapter and connect the cables.

There is only one onboard ethernet adapter, so I need to add another PCI adapter.

The green chip on left is the new added ethernet adapter.

Now let’s connect the cables.

3. Install WFilter NGF system.

Now you can install WFilter NGF with your usb stick. Please check a more detailed guide at here: WFilter NG Firewall Installation Guide

You shall be able to the console upon successful installation.

Set your laptop to “dynamic ip address” and open http://192.168.10.1 in browser, you can access webUI to set the system up.

4. See what I get.

The CPU is “Intel Pentium Dual CPU E2160 1.8G”, 2GB DDR2 RAM, 160G harddisk.

Let’s check the performance. Wow, it can handle 200+ clients with 20K concurrent connections. Isn’t it amazing?

For more features of WFilter NGF, please check: WFilter NG firewall

DIY a firewall appliance for your network.

As WFilter NG firewall released a free 50-user license, there is an opportunity for small business and home users to DIY powerful firewall appliances. ou may read this post first to take a sight of the free license: Free license of WFilter NG firewall is now available

all

In this post, I will guide you certain steps to build a firewall appliance.

1. First, you need to buy an appliance box and a harddisk.

1). A 4/6 interfaces atom D525 networking appliance. (Less than $200)

2). A Seagate 1TB disk.

3). One usb stick.

2. Mount the disk.

3. Get a display monitor, and burn WFilter ISO into the usb stick.

Here is a guide for installation: http://wiki.wfilterngf.com/Installation_of_WFilter_ROS

Console terminal after installation:

4. Now connect your laptop to LAN interface and setup basic networking parameters.

Set laptop to “obtain ip address automatically”, then open http://192.168.10.1 in your browser.

Choose the free license:

5. Connect all the cables.

6. Done, now you can setup more policies to speed up your internet access.

freelicense07

Isn’t it exciting? You won’t be able to find any better solution for small networks.

Download WFilter NG firewall now!

Free license of WFilter NG firewall is now available.

Free license of WFilter NG firewall is now available in the last build of WFilter NGF(1.1.2017.06.05). Except remote support, free license has all features of WFilter for 50 users. You can use this license in any networks, including business.

Now let’s see what we can do with this free license.

1. Choose “free license” on first time login.

2. Powerful reports and statistics.

3. Archive web browsing and email history.

Web activity recording

Email activity recording

SSL inspector

4. Deploy internet content filtering policies

With the free license, you also can get “website black&white list”, “website category filtering”, “application control”, “IP-mac binding”, “Web content pushing”…

5. Bandwidth optimization and rate limit

Free solutions for bandwidth priority optimization, bandwidth rate limiter and multiple WAN load-balancing and WAN fail-over.

6. Various user authentication.

Local accounts, active directory integration, PPPoE, web authentication(facebook WiFi).

And the “ISP management” module, a total solution for users/bandwidth management.

7. VPN tunnels

8. Extensions

9. License

Now let’s check the license: life-time free for 50 users.