App A. Access Control

PLANET Internet SOHO Router

XRT-101 / XRT-711

xDSL/Cable Access Router

Appendix A. Access Control

The Access Control feature allows administrators to restrict Internet Access by individual workstations. The process uses "Packet Filtering" to block or discard data packets. You can apply the pre-defined filters, and optionally define your own filters.
By default, filtering is disabled; no packets are blocked or discarded.

To use the Access Control feature:

Set the desired restrictions on the "Everyone" group. By default, all PCs are in the "Everyone" group unless explicitly moved to another group.
Set the desired restrictions on the other groups ("Group 1", "Group 2", etc) as needed.
For each Workstation you wish to move from the "Everyone" group, create them from the Workstations screen, and assign them to the desired group.
It is also possible to define your own packet filters (on the Administrator Defined Filters screen) and use these filters in addition to the pre-defined filters.
Defining your own filters is optional.

You can limit Internet access for ALL PCs without entering ANY workstation data. Simply apply the desired restrictions to the "Everyone" group.

A.1 Security Groups

Select Access Control from the navigation bar, then Security Groups to see a screen like the example below.

Security Groups

Figure 1: Security Groups

A.1.1 Operations

To Define a Security Group:

Select the group from the drop-down box, then enter the required data. Note that the Security groups are pre-named "Everyone", "Group 1", "Group 2", "Group 3", and "Group 4". These names cannot be changed.

If necessary, click the Click Form button to clear the existing data.

Click Save when finished.

To Change restrictions for a Security Group:

Select the group from the drop-down box, then click the Get Data button to view the data for the selected group.

Make any changes you wish, click Save when finished.

To Assign Workstations to a Security Group

All workstations are automatically in the "Everyone" group. Use the the Workstations screen to move them to another group if desired.

A.1.2 Data - Security Groups Screen

Internet Access for this group
No restrictions	No packets are blocked. Use this to create an "Unlimited Access" group, or to temporarily remove restrictions from a group.
Block all Access	Groups members cannot access the Internet at all. Use this to create the most restrictive group.
Use Packet Filter Table below	Use this to define intermediate levels of access. Using the Packet Filter table gives you fine control over Internet access.
Packet Filter Table
Applications to Block	Any items checked will be blocked. Users will not be able to use the application.
TCP Packets to Discard	This lists any TCP filters you have defined on the Administrator Defined Filters screen. If no filters have been defined, this list is empty. Multiple items can be selected (or deselected) by holding down the Ctrl key while selecting items. Selected items can NOT be accessed by members of this group.
UPD Packets to Discard	This lists any UDP filters you have defined on the Administrator Defined Filters screen. If no filters have been defined, this list is empty. Multiple items can be selected (or deselected) by holding down the Ctrl key while selecting items. Selected items can NOT be accessed by members of this group.

A.2 Workstations

The Workstations screen is reached from the Access Control link on the navigation bar. An example screen is shown below.

Figure 2: Workstations

Note that the drop-down box lists all Workstations previously entered. If none have been entered, this box will be empty.

A.2.1 Operations

To Add a New Workstation:
Ignore the drop-down box, click the Clear Form button, and enter the Workstation details in the fields provided.
Click Add when finished.
To Delete an Existing Workstation:
Select the Workstation from the drop-down box, click Get Data to view the information and confirm that this is the correct Workstation, then click the Delete button.
To Change an Existing Workstation's Details:
Select the Workstation from the drop-down box, click Get Data to view their information, then change any fields you wish.
Click Update when finished.
To Generate a List of all Workstations:
Just click on the List All button.

A.2.2 Data

Workstation Name	Enter a name to identify this workstation.
Network Adapter Address	Hardware address for this workstation. You can use the Windows "Winipcfg" program or your LAN management program to find this address.
Reserve entry in DHCP Table	Check this if you wish to reserve an IP address for this workstation. This is useful if you have to provide the IP Address for other programs or users. If this is left unchecked, the following entry can be ignored.
Reserved IP Address	This relates to the entry above. Enter the reserved address here. This MUST be within the range used by the DHCP server (set on the Device - Internal LAN Port screen).
Security Group	Select the security group for this workstation. If you only wish to reserve an IP Address, and are not using the security (access control) features, simply leave this at "Everyone".

A.3 Administrator Defined Filters

The Administrator Defined Filters screen is reached via the Access Control menu.

This screen allows you to define packet filters; that is, what packets should be blocked (discarded). After you define packet filters, they will appear on the Security Groups screen. You can then select them, as well as the pre-defined filters, when applying restrictions to a Security Group.

Figure 3: Administrator Defined Filters

A.3.1 Data

TCP Packets
Name	Enter a descriptive name for this entry.
Port No.	Enter an integer representing the Port Number for this type of packet. A Network Analyzer or Packet Sniffer can be used to determine the correct port number.
UDP Packets
Name	Enter a descriptive name for this entry.
Port No.	Enter an integer representing the Port Number for this type of packet. A Network Analyzer or Packet Sniffer can be used to determine the correct port number.

[Top of this Chaptert]				.
				Copyright (c) 2001, Planet Technology Corp.