I've been a fan of Multitech for a long time. They aren't all things to all people; their product line is relatively small, but they make good stuff and stand behind it solidly. I have always received superb support when I have needed it - the attitude is to help you solve the problem, not to get you off the phone as quickly as possible.
As a small example, during the configuration of this RF850, I ran into a small bit of confusion. I called for support and was accidentally transferred to the modem support group. When I described my problem, the engineer who answered told me that I had been sent to the wrong place but didn't just throw me back into the hold queue - he walked over, interrupted one of the people in the right group, asked my question and came back to me with an answer. Now yes, it was a simple question - had it been complicated he couldn't have done that, but it demonstrates the helpful attitude these guys always have.
I bought this for a customer who has been outgrowing the small RF560 routers that he had originally. We wanted more power and control of networks and VPN's and I definitely didn't want to subject him to Cisco or Linksys. Cisco is too expensive and Linksys is.. well, you know what I think about Linksys. I ordered an RF850 for the main office, an RF830 and an RF830AP (Wireless) for the branches.
I wasn't unfamiliar with these products because I had worked with other clients who have them, but that was over the Internet - I hadn't actually had any of these in my hand before. I was therefore a little surprised to see a DIN keyboard and monitor connector plus two USB ports on the back of the unit in addition to the expected serial ports and LAN/WAN/DMZ ports. Of course I wasn't about to read the manual; I hooked up a monitor and a USB keyboard and fired the puppy up. I chuckled as I watched Linux boot - I hadn't had any clue that was what I'd be seeing. When it gave me a login prompt, I logged in as admin with the default "admin" password and found that I was sitting at a Linux box:
[admin@routefinder admin]$ df Filesystem 1k-blocks Used Available Use% Mounted on /dev/hda3 833388 273928 517124 35% / /dev/hda1 13660 4449 8506 35% /boot [admin@routefinder admin]$ cat /proc/meminfo total: used: free: shared: buffers: cached: Mem: 511389696 78184448 433205248 0 3051520 39157760 Swap: 143466496 0 143466496 MemTotal: 499404 kB MemFree: 423052 kB MemShared: 0 kB Buffers: 2980 kB Cached: 38240 kB SwapCached: 0 kB Active: 22824 kB Inactive: 28372 kB HighTotal: 0 kB HighFree: 0 kB LowTotal: 499404 kB LowFree: 423052 kB SwapTotal: 140104 kB SwapFree: 140104 kB [admin@routefinder admin]$ uname -a Linux routefinder.xyz.com 2.4.26 #1 SMP Mon Jul 23 19:04:58 IST 2007 i686 unknown
So basically this is a small computer running Linux. As you would expect, it comes with a recovery CD.. that has a prominent warning on its label: "Do not boot your system with this CD in your CDROM drive. It will reformat the hard drive". Ouch..
Nothing in the manual told me how this would work so I called Multitech and was told that you'd open up the box, attach a CD to the IDE controller and do an install using the Recovery CD. I was hoping that it might have been able to do a network install or that it could use a USB CDROM but then again this isn't anything we are likely to be doing.
If you are accustomed to small routers like the RF560's we had used here previously, there are a few things done differently that you need to know about. First, you will need to define machines and other routers in Networks and Services if you want to later use them in a VPN setup or packet filtering rules. You can define machines or networks. For example, for this setup I defined these:
|Name||IP Address||Subnet Mask|
If you are going to forward ports to internal servers, you need to define DNAT rules (Network Setup -> DNAT). For example, I defined these (among others):
|Pre DNAT Network||Pre DNAT Service||Post DNAT IPAddress||Post DNAT Service|
Note the "MYSSH" - I defined a port for SSH to the internal SSH server. You can ssh to the RF850 also but you need to define users (Administration-> Local Users) with that authority. Multitech provides a default "loginuser" for that purpose; you should probably delete that or at least change its password.
The Routefinder RF850 does provide SNAT if you need it, but for simple cases IP Masquerading is turned on by default so you normally wouldn't need to touch this.
I did have a need for it here, though. We have webmail running on an internal server but many of the laptop users want to access it at the same "mail.company.com" address they use when outside. To make that happen, I needed to add a rule so they could do that. What's needed is this:
|Pre SNAT Source||Service||Destination||Post SNAT Source|
"Laninterface" needs to be created in "Networks and Sevices"; it's the internal address of the router (192.168.2.1/255.255.255.255) .
Don't forget to allow these in Packet Filters:
|From (Host/Netwoks)||Service/Service Group||To (Host/Netwoks)||Action|
I've edited and simplified these rules for the purposes of this article. For example, I have a rule that allows the internal mailserver to use outgoing port 25 so that it can send email, but the next rule restricts anything else from doing that. In the even of a virus infection, this can help stop email spamming. If the virus is smart enough to use the internal mailserver, of course it can get the mail out, but at least it will be logged so we'll know the source.
You'll also need to add rules to allow VPN access. If that's PPTP, you will have defined a pptp-pool and that's the "From" that you will allow.
Note that you need to shut off the default System Defined rule when using your own definitions.
It took me a while to find the configuration backup - it's under the Tracking menu.
The zip file it produces is actually a backup of most of the Linux system: files from /var, /home, /opt and /usr are included. The router configuration is found in /etc/multiconf. For example, we'll find our packet filtering rules there:
$ cat packetrules 1 Any Kerio mail ACCEPT 1 2 Any SMTP mail ACCEPT 1 3 Any HTTPS mail ACCEPT 1 4 Any MYSSH sme ACCEPT 1 5 mail SMTP Any ACCEPT 1 6 LAN SMTP WAN REJECT 1 7 Any Any Any ACCEPT 1
I've edited and simplified these rules for the purposes of this article.
Because there is a hard drive, the RF850 can also store periodic backups there - you set the frequency and retention policies at that same screen.
One thing I did have to change from defaults was "Drop Fragmented Packets". That was breaking our HP JetDirect printing - Multitech defaults to droppoing these. That shouldn't be an issue today; it seems safe to turn it off.
These are flash devices with very similar configuration to to RF830. Some of the menus are slightly different because of missing features on the smaller units, but it is basically a consistent interface.
Tony Lawrence 2009-01-29 Rating:
Got something to add? Send me email.
More Articles by Anthony Lawrence © 2009-11-07 Anthony Lawrence