Thank you for choosing our product. Before using the product, read this manual carefully. 

The contents of this manual cannot be copied or reproduced in any form without the written permission of InHand.

Due to continuous updating, InHand cannot promise that the contents are consistent with the actual product information, and does not assume any disputes caused by the inconsistency of technical parameters. The information in this document is subject to change without notice. InHand reserves the right of final change and interpretation.

© 2023 InHand Networks. All rights reserved.

Conventions

Symbol	Indication
< >	Content in angle brackets “<>” indicates a button name. For example, the <OK> button.
""	'''' indicates a window name or menu name. For example, the pop-up window "New User."
>	A multi-level menu is separated by the double brackets ">". For example, the multi-level menu File > New > Folder indicates the menu item [Folder] under the sub-menu [New], which is under the menu [File].
Cautions	Means reader be careful. Improper action may result in loss of data or device damage.
Note	Notes contain detailed descriptions and helpful suggestions.

Contact Us

Add: 43671 Trade Center Place, Suite 100, Dulles, VA 20166 USA

E-mail: support@inhandneworks.com

T: +1 (703) 348-2988

URL: www.inhand.com

I. INTRODUCTION 

1.1 Overview

The InRouter305 (IR305) is an IoT cellular router that integrates 4G LTE, Wi-Fi, and VPN technologies to provide an easy, reliable, and secure Internet connectivity. With technologies such as 4G wireless wide area network and Wi-Fi wireless local area network, it provides uninterrupted multiple network access capabilities, and with its comprehensive security and wireless services, it realizes up to 10 thousands equipment networking and provides high-speed data access for equipment networking.

1.2 Panel Introduction

IR305-S:

IR305:

1.3 LED Indicator & Signal

1.4 Reset to default settings

1. When the device is powered on, press the reset button immediately and keep it for 10 seconds until the SYS LED is steady on.

2. Loosen the Reset button and the SYS will off.

3. Immediately press and hold the Reset button, SYS will flash, then loosen the Reset button. Then device will reset to default settings.

II. INSTALLATION

2.1 PREPARATIPNS

Precautions:

Please be sure there is 3G/4G network coverage and there is no shield on site. 100-240V AC or 9~36VDC shall be provided on site. First installation shall be done under direction of the engineer recognized by InHand Networks. 

1. 1 PC
   
2. 1 or 2 SIM card: Ensure the card is enabled with data service and its service is not suspended because of an overdue charge. 
3. Power supply:  100-240V AC: can be used with DC power adaptor of the device

1. Fixation: Please place InRouter on flat level and have it installed in an environment with small vibrational frequency.
   

The device shall be installed and operated in powered-off status!

2.2 INSTALLATION

2.2.1 SIM/UIM Card

InRouter305 uses pop-up card holder. Stab the hollow at the left of the card holder and the card holder will pop up. Then, install the SIM/UIM card and press the card holder back to the card slot.

2.2.2 Antenna 

Slightly rotate the movable part of metal SMA-J interface until it cannot be rotated (at this time, external thread of antenna cable cannot be seen).  Do not forcibly screw the antenna by holding black rubber lining.

2.2.3 Power Supply

Upon installation of the antenna, connect the device to 9~36V DC power and see if the Power LED on the panel of the device is on. If not, please contact technical support of InHand Networks immediately. 

2.3 LOGIN ROUTER

Upon installation of hardware, be sure the Ethernet card has been mounted in the supervisory PC prior to logging in the page of Web settings of the router. 

I. Automatic Acquisition of IP Address (Recommended)

Please set the supervisory computer to "automatic acquisition of IP address" and "automatic acquisition of DNS server address" (default configuration of computer system) to let the device automatically assign IP address for supervisory computer.

II. Set a Static IP Address

Set the IP address of supervisory PC (such as 192. 168. 2. 2) and LAN interface of device in same network segment (initial IP address of LAN interface of device: 192. 168. 2. 1, subnet mask: 255. 255. 255. 0).

III. Cancel the Proxy Server

If the current supervisory PC uses a proxy server to access the Internet, it is required to cancel the proxy service. The operating steps are shown below: 1) In the browser window, select "tools>>Internet options"; 2) select "connection" page and click the button of LAN Settings to enter "LAN Settings" window interface. Please confirm if the option "Use a Proxy Server for LAN" is checked; if it is checked, please cancel and click the button <OK>.

IV. Log in/Exit Web Settings Page

Open IE or other browser and enter IP address of InRouter305, such as http://192.168.2.1 in address bar (default setting of InRouter305). Upon connection, log in from the login interface as Admin, i.e. enter username and password at the login interface (Please look at the nameplate at the bottom of the device for login credentials). 

For security, you are suggested to modify the default login password after the first login and safe keep the password information.

III. WEB CONFIGURATION

The device need to be effectively configured before using. This chapter will introduce how to configure your router via Web. 

3. 1 SYSTEM

Here, system and network state and system time of synchronizing device and PC can be checked and router WEB configuration interface language can be set as well as the name of mainframe of router can be customized.

3.1.1 Basic Setup

Here, WEB configuration interface language can be set; name of mainframe of router can be customized. 

From the navigation tree, select System >> Basic Setup, then enter the “Basic Setup” page.

Table 3-1-1 Basic Setup Parameters 

3.1.2 System Time

To ensure the coordination between this device and other devices, user is required to set the system time in an accurate way since this function is used to configure and check system time as well as system time zone. System time is used to configure and view system time and system time zone.  It aims to achieve time synchronization of all devices equipped with a clock on network so as to provide multiple applications based on synced time.

From the navigation tree, select System >> Time, then enter the “Time” webpage, as shown below. Click <Sync Time> to synchronize the time of the gateway with the system time of the host.

Table 3-1-2 Parameters of System Time

3.1.3 Admin Access

Admin services include HTTP, HTTPS, TELNET, SSHD, HTTP API and Console. 

HTTP

HTTP (Hypertext Transfer Protocol) is used for transferring web pages on Internet. After enabling HTTP service on device, users can log on via HTTP and access and control the device using a web browser.

HTTPS

HTTPS (Secure Hypertext Transfer Protocol) is the secure version of hypertext transfer protocol. As a HTTP protocol which supports SSL protocol, it is more secure. 

TELNET

Telnet protocol provides telnet and virtual terminal functions through a network. Depending on Server/Client, Telnet Client could send request to Telnet server which provides Telnet services. The device supports Telnet Client and Telnet Server.

SSHD

SSH protocol provides security for remote login sessions and other network services. The SSHD service uses the SSH protocol, which has higher security than Telnet.

HTTP_API

User can check router’s status and configure router without login the router remotely by sending HTTP request with HTTP API. Please ask to technical support for more information about HTTP API. 

Console (only in IR305-S)

User can access to IR305 CLI via RS232 and enable Console.

From the navigation tree, select System >> Admin Access, then enter “Admin Access” page.

Table3-1-3 Parameters of Admin Access

In “Username/Password” section, users can modify username and password rather than create new username, i.e. only this username can be used in logins.  In “Console Login User” section, we can create multiple usernames, i.e. multiple usernames can be used by serial port or TELNET console logins.

3.1.4 System Log

A remote log server can be set through “System Log Settings,” and all system logs will be uploaded to the remote log server through the gateway. This makes remote log software, such as Kiwi Syslog Daemon, a necessity on the host.

Kiwi Syslog Daemon is free log server software for Windows. It can receive, record and display logs from host (such as gateway, exchange board and Unix host). After downloading and installing Kiwi Syslog Daemon, it must be configured through the menus “File >> Setup >> Input >> UDP.

From the navigation tree, select System >> System Log, then enter “System Log” page.

Table 3-1-4    Parameters of System Log

3.1.5 Config Management

Here you can back up the configuration parameters, import the desired parameters backup and reset the router.

From the navigation tree, select “System >> Config Management”, then enter the “Config Management” page.

Table 3-1-5    Parameters of Config Management

Validity and order of imported configurations should be ensured. The good configs will later be serially executed in order after system reboot. If the configuration files didn’t be arranged according to effective order, the system won’t enter the desired state.

In order not to affect the operation of the current system, when performing an import configuration and restore default configuration, users need to restart the device to make the new configuration to take effect.

3.1.6 Schedule

After this function is enabled, the device will reboot as the scheduled time. Scheduler function will take effect after router sync time.

From the navigation tree, select “System >> Schedule”, then enter “Schedule” page.

Table 3-1-6    Parameters of Scheduler

3.1.7 Upgrade

The upgrading process can be divided into two steps. In the first step, firmware will be written in backup file zone, in the second step: firmware in backup file zone will be copied to main firmware zone, which should be carried out during system restart. During software upgrading, any operation on web page is not allowed, otherwise software upgrading may be interrupted.

From the navigation tree, select “System >> Upgrade”, then enter the “Upgrade” page.

To upgrade the system, firstly, click <Browse> choose the upgrade file, secondly, click <Upgrade> and then click <OK> to begin upgrade; thirdly, upgrade firmware succeed, and click <Reboot> to restart the device. 

3.1.8 Reboot

Please save the configurations before reboot, otherwise the configurations that are not saved will be lost after reboot.

To reboot the system, please click the “System>>Reboot”, then click <OK>. 

3.1.9 Logout

To logout, click “System >> Logout”, and then click <OK>. 

3.2 NETWORK

3.2.1 CELLULAR 

Insert SIM card and dial to achieve the wireless network connection function of router.

Click the “Network>>Dial Interface” menu in the navigation tree to enter the “Dial Interface”.

Table3-2-1-1 Parameters of Dialup/Cellular

*Not all models support this

Table 3-2-1-2 Parameters of Dialup/Cellular - Schedule

3.2.2 WAN

Click the “Network>>WAN” to set WAN port.

WAN supports three types of wired access including static IP, dynamic address (DHCP) and ADSL (PPPoE) dialing.

DHCP adopts Client/Server communication mode. Client sends configuration request to Server which feeds back corresponding configuration information, including distributed IP address to the Client to achieve the dynamic configuration of IP address and other information.

PPPoE is a point-to-point protocol over Ethernet. User has to install a PPPoE Client on the basis of original connection way. Through PPPoE, remote access devices could achieve the control and charging of each accessed user.

WAN of the device is disabled by default. 

Click the “Network>>WAN” menu in the navigation tree to enter the “WAN" Interface.

Table 3-2-2-1 Static IP Parameters of WAN

3.2.3 VLAN

A virtual LAN (VLAN) comprises a group of logical devices and users. These devices and users are not limited by physical locations, but can be organized base on functions, departments, applications, and other factors. They communicate with each other as if they are in the same network segment, which contributes to the name of VLAN.

After set VLAN, click “modify” to configure LAN settings of each VLAN.

Click “Network >> VLAN” to configure VLAN in router.

Table 3-2-3 VLAN Parameters

LAN Parameters

3.2.4 Switch WLAN Mode

IR305 supports two types of WLAN mode: AP and STA.

Click the “Network>>Switch WLAN Mode” menu in the navigation tree to set WLAN mode of the router. After change and save the configuration, please reboot the device to make the configuration take effort.

3.2.5 WLAN Client (AP Mode)

When working in AP mode, the device WLAN will provide network access point for other wireless network devices so that they will have normal network communication. 

Click the “Network>>WLAN” menu in the navigation tree to enter the “WLAN" interface.

Table 3-2-5 Parameters of WLAN Access Port

3.2.6 WLAN Client (STA Mode)

When working in STA mode, the router can access the Internet by connecting to access point. The 

Router need to reboot after this operation.

Click the “Network>>WLAN Client” menu in the navigation tree to enter the “WLAN” interface.  Select “Client” for the interface type and configure relevant parameters. (At this moment, the dialing interface in the "Network>>Dialing Interface" should be closed.)

The SSID scan function is enabled only when Client is selected as WLAN interface. Click “Scan” button to get all available AP and status, select AP and configure corresponding parameter to connect. After configure WLAN Client, please configure access type in “Network>>WAN(STA)”.

Table 3-2-6 Parameters of WLAN Client 

3.2.7 Link Backup

Click the “Network>>Link Backup” in the navigation tree to configuration interface.

Table 3-2-7-1 Parameters of Link Backup

Table 3-2-7-2 Parameters of Link Backup - Backup Mode

3.2.8 VRRP

VRRP (Virtual Router Redundancy Protocol) adds a set of routers that can undertake gateway function into a backup group to form a virtual router. The election mechanism of VRRP will decide which router to undertake the forwarding task and the host in LAN is only required to configure the default gateway for the virtual router.

VRRP will bring together a set of routers in LAN. It consists of multiple routers and is similar to a virtual router in respect of function. According to the VLAN interface IP of different network segments, it can be virtualized into multiple virtual routers. Each virtual router has an ID number and up to 255 can be virtualized.

VRRP has the following characteristics:

1. Virtual router has an IP address, known as the Virtual IP address.  For the host in LAN, it is only required to know the IP address of virtual router, and set it as the address of the next hop of the default route.
   
2. Host in local communicates with the external network through this virtual router.
   
3. A router will be selected from the set of routers based on priority to undertake the gateway function. Other routers will be used as backup routers to perform the duties of gateway for the gateway router in case of fault of gateway router, thus to guarantee uninterrupted communication between the host and external network.
   

Monitor interface function of VRRP better expands backup function: the backup function can be offered when interface of a certain router has fault or other interfaces of the router are unavailable.

When uplink interface is Down or Removed, the router actively reduces its priority so that the priority of other routers in the backup group is higher and thus the router with highest priority becomes the gateway for the transmission task.

From navigation tree, select "Network >>VRRP" menu, then enter “VRRP” page. 

Table 3-2-8 VRRP Parameters

3.2.9 IP Passthrough

IP penetration function distributes the address obtained by WAN port to the device at the lower end of LAN port. When external access to the router downstream devices the router transmits data to the downstream device. Click "Network >>IP Passthrough" menu, then enter “IP Passthrough” page.

Table 3-2-9 IP Passthrough Parameters

3.2.10 Static Route

Static route needs to be set manually, after which packets will be transferred to appointed routes.

To set static route, click the "Network >> Static Route" menu in the navigation tree, then enter “Static Route” interface.

Table 3-2-10 Static Route Parameters

3.2.11 OSPF

The Open Shortest Path First (OSPF) protocol is a link-status-based internal gateway protocol mainly used on large-scale networks.

Example: Build OSPF route between two routers, and allow their LAN can be accessed by each other. 

a. Configure IR305_A. Click “Network >> OSPF” to access to OSPF configure page. “Router ID” should be in the same segment to IR305_B. Configure IR305_A in “Network” bar to announce the routing entry of the device.

b. Configure IR305_B

c. OSPF has been built successfully if PC1 and PC2 can access to each other.

3.3 SERVICE

3.3.1 DHCP service

DHCP adopts Client/Server communication mode. Client sends configuration request to Server which feeds back corresponding configuration information, including distributed IP address to the Client to achieve the dynamic configuration of IP address and other information.

1. The duty of DHCP Server is to distribute IP address when Workstation logs on and ensure each workstation is supplied with different IP address. DHCP Server has simplified some network management tasks requiring manual operations before to the largest extent.
   
2. As DHCP Client, the device receives the IP address distributed by DHCP server after logging in the DHCP server, so the Ethernet interface of the device needs to be configured into an automatic mode.
   

Table 3-3-1 Parameters of DHCP Service

3.3.2 DNS

DNA (Domain Name System) is a DDB used in TCP/IP application programs, providing switch between domain name and IP address. Through DNS, user could directly use some meaningful domain name which could be memorized easily and DNS Server in network could resolve the domain name into correct IP address. The device makes analysis on dynamic domain name via DNS.

Manually set the DNS, use DNS via dialing if it is empty. Generally, it needs to set only when static IP is used on the WAN port.

Click the “Service>>Domain Name Service” menu in the navigation tree to enter the “Domain Name Service” interface. 

Table 3-3-2 DNS Parameters

3.3.3 DNS Relay

IR305 works as a DNS Agent and relays DNS request and response message between DNS Client and DNS Server to carry out domain name resolution in lieu of DNS Client.

From navigation tree, select "Service>>DNS Relay" menu, then enter “DNS Relay” page.

Table 3-3-3 DNS Transfer Parameters

When enabling DHCP, the DHCP relay is also enabled automatically. Relay cannot be disabled without disabling DHCP.

3.3.4 DDNS

DDNS maps user's dynamic IP address to a fixed DNS service. When the user connects to the network, the client program will pass the host’s dynamic IP address to the server program on the service provider’s host through information passing. The server program is responsible for providing DNS service and realizing dynamic DNS. It means that DDNS captures user's each change of IP address and matches it with the domain name, so that other Internet users can communicate through the domain name. What end customers have to remember is the domain name assigned by the dynamic domain name registrar, regardless of how it is achieved.

DDNS serves as a client tool of DDNS and is required to coordinate with DDNS Server.   Before the application of this function, a domain name shall be applied for and registered on a proper website such as www. 3322. org. 

InRouter305 DDNS service types include QDNS (3322)-Dynamic, QDNS(3322)-Static, DynDNS-Dynamic, DynDNS-Static, DynDNS-Custom and No-IP.com. 

To set DDNS, click the "Service >> Dynamic Domain Name" menu in the navigation tree, then enter “Dynamic Domain Name” interface.

Table 3-3-4-1 Parameters of Dynamic Domain Name

Table 3-2-4-2 Main Parameters of Dynamic Domain Name

3.3.5 Device Manager

Inhand provides a software platform to manage devices. The device can be managed and operated via software platform. For instance, the operating status of device can be checked, device software can be upgraded, device can be restarted, configuration parameters can be sent down to device, and transmitting control or message query can be realized on device via Device Manager.

Click the "Service>>Device Manager" menu in the navigation tree to enter the "Device Manager" interface. It only supports three modes, i.e. “Device manager, InConnect Service, Custom”

DM: North American users should select Servicer address-----iot.inhandnetworks.com

    Table 3-3-5 Device remote management platform

3.3.6 SNMP

Network devices are usually sparsely-located on a network. It is time-consuming for the administrator to configure and manage these network devices on site. In addition, if these devices are from different vendors, each of which provides a suite of independent management interfaces (for example, different command line interfaces), the workload of configuring the devices in batches is huge. In this situation, traditional manual configuration method has the deficiencies of high cost and low efficiency. The network administrator can use the Simple Network Management Protocol (SNMP) to remotely configure and manage the devices and perform real-time monitoring on them. 

Figure 33-6 SNMP Topology

To run the SNMP protocol on a network, configure the NMS program on the management side and SNMP agent on the managed devices.

By using SNMP:

1. The NMS can collect status information of the managed devices anytime and anywhere through agents and remotely control these devices.
   
2. The agents can promptly report the current status and faults of managed devices to the NMS.
   

Currently, the SNMP agents support SNMPv1, SNMPv2c and SNMPv3. SNMPv1 and SNMPv2c use community names for authentication; SNMPv3 uses user names and passwords for authentication. Click "Service>>SNMP" menu to configure.

Table 3-3-6-1 SNMPv1 and SNMPv2c Parameters

Table 3-3-6-2 SNMPv3 Parameters

3.3.7 SNMP Trap

SNMP trap is a type of entrance. When this entrance is reached, the SNMP managed devices actively notify the NMS, instead of waiting for the polling of NMS. On an SNMP-enabled network, the agents on managed devices can report errors to the NMS anytime, without the need of waiting for the polling of NMS. The errors are reported to the NMS through traps. Click "Service>>SNMP Trap" menu to configure.

Table 3-3-7 SNMP Trap Configuration Parameters

3.3.8 I/O

Click “Service >> I/O” in the navigation menu to check and configure I/O and relay of the device.

Voltage range: 

DI: 0~30V, 0~3V means low, 10~30V means high, and the max input voltage is 30V.

DO: Wet contact, low means 0V, high means 13V (pull up, cannot be used as power supply for other device directly).

Only IR305-<WMNN>-<WLAN/NA> supports this feature.

Table 3-3-8 I/O Parameters 

3.3.9 DTU RS232/RS485

Configure DTU function, device can transmit serial data to customer’s server. 

Only IR305-<WMNN>-<WLAN/NA>-S supports this feature.

Table 3-3-9 DTU RS232/RS485 Parameters

3.3.10 SMS

SMS permits message-based reboot and manual dialing. Configure Permit to Phone Number and click <Apply and Save>. After that you can send “reboot” command to restart the device or send custom connection or disconnection command to redial or disconnect the device. 

From navigation tree, select "Service>>SMS" menu, then enter “SMS” page. 

Table 3-3-10 SMS Parameters 

3.3.11 Traffic Manager 

This function is mainly used to count data traffic in cellular interface. If the threshold is 0, router will only count and the rules will not take effort. This function requires enabling NTP function.

Choose Services >> Traffic Manager to go to the "Traffic Manager" page.

Table 3-3-11 Traffic Manager - Basic Configuration Parameters

3.3.12 Alarm Settings

When an abnormality occurs, router will report alarm according to the settings. Currently router supports sending alarm in following situations: System Service Fault, Memory Low, WAN/LAN1 Link-Up/Down, LAN2 Link-Up/Down, Cellular Up/Down, Traffic Alarm, Traffic Disconnect Alarm, SIM/UIM Card Switch, Active Link Switch, SIM/UIM Card Fault, Signal Quality Fault.

In the Alarm Manager interface, you can perform the following operations:

2. Select alarm types in the "Alarm Input" area.
3. Set the alarm notification method of the console in the "Alarm Output" area. 

Choose Services >> Alarm Manager to go to the "Alarm Manager" page.

3.3.13 User Experience Plan

InHand Networks’ User Experience Program is designed to improve the product user experience and customer service quality. 

User can disable or enable User Experience Plan in “Services >> User Experience Plan”

3.4 FIREWALL

The firewall function of the router implements corresponding control to data flow at entry direction (from Internet to LAN) and exit direction (from LAN to Internet) according to the content features of message (such as: protocol style, source/destination IP address, etc. ) and ensures safe operation of router and host in local area network.

3.4.1 Basic 

From the navigation tree, select Firewall >> Basic Setup, then enter the “Basic Setup” page.

Table 3-4-1 Firewall - Basic Setup Parameters

3.4.2 Filtering 

Filter the network data by customize rules to allow or prohibit the specified data flow forwarded by router. 

To enable Access Control from the navigation tree, select Firewall >> Filtering, then enter “Filtering” page.

3.4.3 Device Access Filtering 

Set customize rules to allow or prohibit data and access to the router.

From the navigation tree, select Firewall >> Device Access Filtering, then enter “Device Access Filtering” page. 

Table 3-4-3 Device Access Filtering Parameters

3.4.4 Content Filtering

Set rules to disable access to specific URLs. 

From navigation tree, select "Firewall>>Content Filtering" menu, then enter “Content Filtering” page. 

Table 3-4-4 Content - Filtering Parameters

3.4.5 Port Mapping

Port mapping is also called virtual server. Setting of port mapping can enable the host of extranet to access to specific port of host corresponding to IP address of intranet. 

To configure port mapping, go into the navigation tree, select "Firewall >> Port Mapping", then enter “Port Mapping” page.

Table 3-4-5 Firewall - Port Mapping Parameters 

3.4.6 Virtual IP Mapping

Both router and the IP address of the host of intranet can correspond with one virtual IP. Without changing IP allocation of intranet, the extranet can access to the host of intranet via virtual IP.  This function is always used with VPN.

To configure virtual IP mapping, go into the navigation tree, select "Firewall >> Virtual IP Mapping". 

Table 3-4-6 Firewall - Virtual IP Mapping Parameters 

3.4.7 DMZ 

After mapping all ports, extranet PC can access to all ports of internal device by DMZ settings. 

From the navigation tree, select Firewall >> DMZ, then enter the “DMZ” page.

Table 3-4-7 Firewall - DMZ Parameters

3.4.8 MAC-IP Binding

If the default filter policy in the basic setting of firewall is disabled, only hosts specified in MAC-IP Binding can have an access to outer net.

From the navigation tree, select Firewall >> MAC-IP Binding, then enter the “MAC-IP Binding” page.

Table 3-4-8 Firewall - MAC-IP Binding Parameters

3.4.9 NAT

NAT is the network address translation function, including source address translation (SNAT) and destination address translation (DNAT).

SNAT refers to the communication between the internal network and the external network when the destination address remains unchanged. DNAT refers to the translation of the destination address of the internal network into the external network without changing the source address when accessing the internal network. 

Table 3-4-9 NAT Parameters

3.5 QoS

To ensure all LAN users can normally get access to network resources, IP traffic control function can limit the flow of specified host in LAN. QoS provides dedicated bandwidth and different service quality for different applications, greatly improving the network service capabilities. 

3.5.1 IP BW Limit

Bandwidth control sets a limit on the upload and download speeds when accessing external networks. 

From the navigation tree, select QoS >> Bandwidth Control, then enter the “IP BW Limit” page.

Table 3-5-1    Parameters of IP BW Limit

3.6 VPN

VPN is for building a private dedicated network on a public network via the Internet. "Virtuality" is a logical network.

Two Basic Features of VPN:

Build a credible and secure link by connecting remote users, company branches, partners to the network of the headquarters via VPN so as to realize secure transmission of data. 

It is shown in the figure below:

Fundamental Principle of VPN

The fundamental principle of VPN indicates to enclose VPN message into tunnel with tunneling technology and to establish a private data transmission channel utilizing VPN Backbone so as to realize the transparent message transmission.

Tunneling technology encloses the other protocol message with one protocol. Also, encapsulation protocol itself can be enclosed or carried by other encapsulation protocols. To the users, tunnel is logical extension of PSTN/link of ISDN, which is similar to the operation of actual physical link.

3.6.1 IPSec Settings

A majority of data contents are Plaintext Transmission on the Internet, which has many potential dangers such as password and bank account information stolen and tampered, user identity imitated, suffering from malicious network attack, etc. After disposal of IPSec on the network, it can protect data transmission and reduce risk of information disclosure.

IPSec is a group of open network security protocol made by IETF, which can ensure the security of data transmission between two parties on the Internet via data origin authentication, data encryption, data integrity and anti-replay function on the IP level. It is able to reduce the risk of disclosure and guarantee data integrity and confidentiality and well as maintain security of service transmission of users.

IPSec, including AH, ESP and IKE, can protect one and more date flows between hosts, between host and gateway, and between gateways. The security protocols of AH and ESP can ensure security and IKE is used for cipher code exchange.

IPSec can establish bidirectional Security Alliance on the IPSec peer pairs to form a secure and interworking IPSec tunnel and to realize the secure transmission of data on the Internet.

From navigation tree, select VPN>>IPSec Settings, then enter “IPSec Settings” page.

Table 3-6-1 Parameters of IPSec Settings 

3.6.2 IPSec Tunnels

From navigation tree, select VPN>>IPSec Tunnels, enter "IPSec Tunnels" and click <add>.

Table 3-6-2 Parameters of IPSec Tunnels 

The security level of three encryption algorithms ranks successively: AES, 3DES, DES. The implementation mechanism of encryption algorithm with stricter security is complex and slow arithmetic speed. DES algorithm can satisfy the ordinary safety requirements.

3.6.3 GRE Tunnels

Generic Route Encapsulation (GRE) defines the encapsulation of any other network layer protocol on a network layer protocol. GRE could be used as the L3TP of VPN to provide a transparent transmission channel for VPN data. In simple terms, GRE is a tunneling technology which provides a channel through which encapsulated data message could be transmitted and encapsulation and decapsulation could be realized at both ends. GRE tunnel application networking shown as the following figure:

Along with the extensive application of IPv4, to have messages from some network layer protocol transmitted on IPv4 network, those messages could by encapsulated by GRE to solve the transmission problems between different networks.

In following circumstances GRE tunnel transmission is applied:

1. GRE tunnel could transmit multicast data packets as if it were a true network interface.  Single use of IPSec cannot achieve the encryption of multicast.
   
2. A certain protocol adopted cannot be routed.
   
3. A network of different IP address shall be required to connect other two similar networks.
   

GRE application example: combined with IPSec to protect multicast data

GRE can encapsulate and transmit multicast data in GRE tunnel, but IPSec, currently, could only carry out encryption protection against unicast data. In case of multicast data requiring to be transmitted in IPSec tunnel, a GRE tunnel could be established first for GRE encapsulation of multicast data and then IPSec encryption of encapsulated message so as to achieve the encryption transmission of multicast data in IPSec tunnel. As shown below:

From navigation tree, select VPN>>GRE Tunnels and enter "GRE Tunnels".

Table 3-6-3 Parameters of GRE Tunnels

3.6.4 L2TP Client

L2TP, one of VPDN TPs, has expanded the applications of PPP, known as a very important VPN technology for remote dial-in user to access the network of enterprise headquarters.

L2TP, through dial-up network (PSTN/ISDN), based on negotiation of PPP, and could establish a tunnel between enterprise branches and enterprise headquarters so that remote user has access to the network of enterprise headquarters. PPPoE is applicable in L2TP. Through the connection of Ethernet and Internet, a L2TP tunnel between remote mobile officers and enterprise headquarters could be established.

L2TP-Layer 2 Tunnel Protocol encapsulates private data from user network at the head of L2 PPP. No encryption mechanism is available, thus IPSes is required to ensure safety.

Main Purpose: branches in other places and employees on a business trip could access to the network of enterprise headquarter through a virtual tunnel by public network remotely.

Typical L2TP network diagram is shown below:

From navigation tree, select VPN>>L2TP Client, enter "L2TP Client" and click <add>.

Table 3-6-4 Parameters of L2TP Client

3.6.5 PPTP Client

From navigation tree, select VPN>>PPTP Client, enter "PPTP Client" and click <add>.

Table 3-6-5 Parameters of PPTP Client

3.6.6 OpenVPN

Single point participating in the establishment of VPN is allowed to carry out ID verification by preset private key, third-party certificate or username/password. OpenSSL encryption library and SSLv3/TLSv1 protocol are massively used.

In OpenVPN, if a user needs to access to a remote virtual address (address family matching virtual network card), then OS will send the data packet (TUN mode) or data frame (TAP mode) to the visual network card through routing mechanism.  Upon the reception, service program will receive and process those data and send them out through outer net by SOCKET, owing to which, the remote service program will receive those data and carry out processing, then send them to the virtual network card, then application software receive and accomplish a complete unidirectional transmission, vice versa.

From navigation tree, select "VPN>>OpenVPN", then enter “OpenVPN” page, and click <Add>.

Table 3-6-6 IPSec Configuration Parameters

3.6.7 OpenVPN Advanced

From navigation tree, select "VPN>>OpenVPN Advanced" and enter "OpenVPN Advanced" interface.

Table 3-6-7 Configuration Parameters of OpenVPN Advanced 

3.6.8 WireGuard Tunnels

WireGuard is a new generation VPN which aims at providing more efficient and more security VPN service with advanced encryption algorithm. 

Click Add button to configure and create WireGuard tunnel, and check the VPN status in this page.

From navigation tree, select VPN >> WireGuard Tunnels, then enter WireGuard VPN configure page.

Table 3-6-8 WireGuard Configure Parameters

3.6.9 ZeroTier VPN

ZeroTier VPN supports user to build a network that allow all client devices to access to each other. There are two network types in ZeroTier VPN, planet and moon. In planet network, user needs to login and create VPN network in https://www.zerotier.com/ at first. Moon network is private VPN network created by user.

From navigation tree, select VPN >> ZeroTier VPN, then enter “ZeroTier VPN” configure page.

Table 3-6-9 ZeroTier VPN Parameters

3.6.10 Certificate Management

From navigation tree, select VPN >> Certificate Management, then enter “Certificate Management” page.

Table 3-6-10 Parameters of Certificate Management

Note: When using certificate, please make sure the time of the router is sync with real time. 

3.7 TOOLS

3.7.1 PING

To do a ping, enter the navigation tree, select Tools>>Ping Detection, then enter the “Ping Detection” page. 

Table 3-7-1    PING Detection Parameters 

3.7.2 Traceroute

To perform traceroute, select "Tools>>Traceroute" menu in the navigation tree, then enter the “Traceroute” page.

Table 3-7-2    Traceroute Parameters

3.7.3 Link Speed Test

Enter the navigation tree, select “Tools>>Link Speed Test”, then enter the “Link Speed Test” page.

Select a file locally and click upload/download, then check the network speed in log.

3.7.4 TCPDUMP

Enter the navigation tree, select “Tools>>TCPDUMP”, then enter the TCP dump page.

Table 3-7-4    TCPDUMP Parameters

3.8 APPLICATION

3.8.1 Smart ATM

Select Application >> Smart ATM, then enter the “Smart ATM” page. You can set the configuration about ATM platform.

Table 3-8-1    Smart Parameters

3.8.2 Status Report

Select Application >> Status Report, then enter the “Status Report” page. You can set the configuration about Status Report.

Table 3-8-2 Smart Report Parameters

3.8.3 Smart-EMS

Select Application >> Smart-EMS, then enter the “Smart-EMS” page. You can set the configuration about Smart-EMS.

Table 3-8-3 Smart-EMS Parameters

3.9 STATUS

3.9.1 System

From navigation tree, select Status >> System, then enter the “System” page.

This page displays system statistics, including name, model, serial number, description, current version, current Bootloader version, router time, PC time, UP time, CPU load and memory consumption. Technicians may click the <Sync Time> button to synchronize the router with the system time of the host, as covered in the set-up chapter.

3.9.2 Modem

From navigation tree, select Status >> Modem, then enter the “Modem” page. 

This page displays the basic information of dialup, including status, signal level, register status, IMEI (ESN) code, IMSI code, LAC and cell ID. 

Click Status >> Modem, then enter the “Modem” page to configure parameters. 

3.9.3 Traffic Statistics

Choose Status >> Traffic Statistics to go to the "Traffic Statistics" page to query traffic statistics.

This page displays the traffic statistics on the dialing interface, including the statistics on the traffic received in the latest month, traffic transmitted in the latest month, traffic received on the last day, traffic transmitted on the last day, traffic received in the last hour, and traffic transmitted in the last hour.

3.9.5 DTU

Only IR305 serial type supports this page.

Choose Status >> DTU to go to the "DTU" page to check serial connection status.

3.9.5 Alarm

Choose Status >> Alarm to go to the "Alarm" page to view all alarms generated in the system since power-on. You can clear or confirm the alarms.

The alarms have the following states:

The alarms are classified into the following levels:

3.9.6 WLAN

Choose Status >> WLAN to go to the "WLAN" page to query the WLAN connection status.

This page displays the WLAN connection information, including channel, SSID, BSSID, security, signal (%), mode, and status.

3.9.7 Network Connections

From navigation tree, select Status >> Network Connections, then enter “Network Connections” page to see the connections status.

This page shows the basis information of dialup and LAN.

WAN includes MAC address, connection type, IP address, netmask, gateway, DNS, MTU, Status and etc. 

Dialup includes connection type, IP address, netmask, gateway, DNS, MTU, status and connection time. 

LAN includes connection type, MAC address, IP address, netmask, gateway, MTU and DNS.

3.9.8 Device Manager

From navigation tree, select Status >> Device Manager, then enter “Device Manager” page to check the connections status between router and Device Manager.

3.9.9 Route Table

From navigation tree, select Status >> Route Table, then enter “Route Table” page to see router status.

This page displays the active route table, including destination, netmask, gateway, metric and interface. 

3.9.10 Device List

From navigation tree, select Status >> Device List, then enter “Device List” page to inquire the device list.

This page displays the device list, including interface, MAC address, IP address, host and lease (click MAC address to link to IEEE to inquire validity of the address). 

3.9.11 Log

From navigation tree, select Status >> Log, then enter “Log” page.

This page displays the logs, including select to see the number of log lines (20/50/....../all), log level (information, debug and warning), time, module and content.  Clear log, download log file, download system diagnosis record (refresh rate of this page is 5/10/…... 1min by default)

3.9.11 Third Party Software Notices

From navigation tree, select Status >> Third Party Software Notices, then enter “Third Party Software Notices” page to check the third party software used in router system.

Appendix A FAQ

1. InRouter is powered on, but can't access Internet through it?

Please first check: 

2. InRouter is powered on, have a ping to detect InRouter from your PC and find packet loss?

3. Forget the setting after revising IP address and can't configure InRouter?

4. After InRouter is powered on, it frequently auto restarts. Why does this happen?

5. Why does upgrading the firmware of my InRouter always fail?

Examination: 

6. After InRouter establishes VPN with the VPN server, your PC under InRouter can connect to the server, but the center can't connect to your PC under InRouter? 

7. After InRouter establishes VPN with the VPN server, your PC under InRouter can't connect to the server ping?  

Please make sure “Shared Connection” on “Network=>WAN” or “Network=>Dialup” is enabled in the configuration of InRouter. 

8. InRouter is powered on, but the Power LED is not on?

9. InRouter is powered on, but the Network LED is not on when connected to PC?

10. InRouter is powered on, when connected with PC, the Network LED is normal but can't have a ping detection to the InRouter?

11. InRouter is powered on, but can't configure through the web interface?

12. The InRouter dialup always fails, I can't find out why?

13. How to restore InRouter to factory default settings?

The method to restore InRouter to factory default settings: 

1.   Press and hold the Restore button, power on InRouter;

Appendix B Instruction of Command Line

1 Help Command

Help command can be obtained after entering help or “?” into console, “?” can be entered at any time during the process of command input to obtain the current command or help from command parameters, and command or parameters can be automatically complemented in case of only command or command parameter.

1.1 Help

[Command] Help [<cmd>]

[Function] Get help from command.

[View] All views

[Parameter]

<cmd>    command name

[Example]

1. Enter: 

    help

Get the list of all current available command.

2. enter:

help show

Display all the parameters of show command and using instructions thereof.

2 View Switchover Command

2.1 Enable

[Command] Enable [15 [<password>]]

[Function] Switchover to privileged user level.

[View] Ordinary user view.

[Parameter]15            User right limit level, only supports right limit 15 (super users) at current.

<password>    Password corresponded to privileged user limit level, hint of password inputting will be given in case of no entering.

[Example]

Enter exit in ordinary user view: 

enable 123456

Switchover to super users and the password 123456.

2.2 Disable

[Command] Disable

[Function] Exit the privileged user level.

[View] Super user view, configure view

[Parameter] No

[Example]

Enter in super user view:

disable

Return to ordinary user view.

2. 3 End and !

[Command] End or !

[Function] Exit the current view and return to the last view.

[View] Configure view.

[Parameter] No

[Example]

Enter in configured view: 

end

Return to super user view.

2. 4 Exit

[Command] Exit

[Function] Exit the current view and return to the last view (exit console in case that it is ordinary user)

[View] All views

[Parameter] No

[Example]

1. Enter in configured view:

exit

Return to super user view.

2. enter exit in ordinary user view:

exit

Exit console.

3 Check system state command

3. 1 Show version

[Command] Show version

[Function] Display the type and version of software of router

[View] All views

[Parameter] No

[Example]

Enter:

show version

Display the following information:

Type                 : display the current factory type of equipment

Serial number          : display the current factory serial number of equipment

Description            : www.inhand.com.cn

Current version         : display the current version of equipment

Current version of Bootloader: display the current version of equipment

3. 2 Show system

[Command] Show system

[Function] Display the information of router system

[View] All views

[Parameter] No

[Example]

Enter:

show system

Display the following information:

Example: 00:00:38 up 0 min, load average:   0.00, 0.00, 0.00

3. 3 show clock

[Command] Show clock

[Function] Display the system time of router

[View] All views

[Parameter] No

[Example]

Enter:

show clock

Display the following information:

For example Sat Jan 1 00:01:28 UTC 2000

3. 4 Show modem

[Command] Show modem

[Function] Display the MODEM state of router

[View] All views

[Parameter] No

[Example]

Enter:

show modem

Display the following information:

Modem type

state

manufacturer

Product name

signal level

register state

IMSI number

Network Type

3. 5 Show log

[Command] Show log [lines <n>]

[Function] Display the log of router system and display the latest 100 logs in default.

[View] All views

[Parameter]        

Lines <n> limits the log numbers displayed, wherein, n indicates the latest n logs in case that it is positive integer and indicates the earliest n logs in case that it is negative integer and indicates all the logs in case that it is 0.

[Example]

Enter:

show log

Display the latest 100 log records.

3. 6 Show users

[Command] Show users

[Function] Display the user list of router.

[View] All views

[Parameter] No

[Example]

Enter:

show users

Displayed user list of system is as follows:

 User:

-------------------------------------------------

* adm     

------

Wherein, user marked with * is super user.

3. 7 Show startup-config

[Command] Show startup-config

[Function] Display the starting device of router.

[View] Super user view and configuration view

[Parameter] No

[Example]

Enter:

show startup-config

Display the starting configuration of system.

3. 8 Show running-config

[Command] Show running-config

[Function] Display the operational configuration of router

[View] Super user view and configuration view

[Parameter] No

[Example]

Enter:

show startup-config

Display the operational configuration of system.

4 Check Network Status Command 

4. 1 Show interface

[Command] Show interface

[Function] Display the information of port state of router

[View] All views

[Parameter] No

[Example]

Enter:

show interface

Display the state of all ports.

4. 2 Show ip

[Command] Show ip

[Function] Display the information of port state of router

[View] All views

[Parameter] No

[Example]

Enter:

Show ip

Display system ip status

4. 3 Show route

[Command] Show route

[Function] Display the routing list of router

[View] All views

[Parameter] No

[Example]

enter:

show route

Display the routing list of system

4. 4 Show arp

[Command] Show arp

[Function] Display the ARP list of router

[View] All views

[Parameter] No

[Example]

Enter:

show arp

Display the ARP list of system

5 Internet Testing Command

Router has provided ping , telnet and traceroute for Internet testing.

5. 1 Ping

[Command] Ping <hostname> [count <n>] [size <n>] [source <ip>]

[Function] Apply ICMP testing for appointed mainframe.

[View] All views

[Parameter]

<hostname> tests the address or domain name of mainframe.

count <n> testing times

size <n> tests the size of data package (byte)

source <ip> IP address of appointed testing

[Example]

Enter:

ping www.g.cn

Test www. g. cn and display the testing results

5. 2 Telnet

[Command] Telnet <hostname> [<port>] [source <ip>]

[Function] Telnet logs in the appointed mainframe

[View] All views

[Parameter]

<hostname> in need of the address or domain name of mainframe logged in.

<port>telnet port

source <ip> appoints the IP address of telnet logged in.

[Example]

Enter:

telnet 192.168.2.2

telnet logs in 192. 168. 2. 2

5. 3 Traceroute

[Command] Traceroute <hostname> [maxhops <n>] [timeout <n>]

[Function] Test the acting routing of appointed mainframe.

[View] All views

[Parameter]

<hostname> tests the address or domain name of mainframe.

maxhops <n> tests the maximum routing jumps

timeout <n> timeout of each jumping testing (sec)

[Example]

Enter:

traceroute www.g.cn

Apply the routing of www. g. cn and display the testing results.

6 Configuration Command

In super user view, router can use configure command to switch it over configure view for management.

Some setting command can support no and default, wherein, no indicates the setting of canceling some parameter and default indicates the recovery of default setting of some parameter.

6. 1 Configure

[Command] Configure terminal

[Function] Switchover to configuration view and input the equipment at the terminal end.

[View] Super user view

[Parameter] No

[Example]

Enter in super user view:

configure terminal

Switchover to configuration view.

6. 2 Hostname

[Command] Hostname [<hostname>]

default hostname

[Function] Display or set the mainframe name of router.

[View] Configure view.

[Parameter]

<hostname> new mainframe name

[Example]

3. Enter in configured view:

hostname

Display the mainframe name of router.

4. Enter in configured view:

hostname MyRouter

Set the mainframe name of router MyRouter.

5. Enter in configured view:

defaulthostname

Recover the mainframe name of router to the factory setting.

6. 3 Clock timezone

[Command] Clock timezone <timezone><n>

default clock timezone

[Function] Set the time zone information of the router.

[View] Configure view.

[Parameter]

<timezone> timezone name, 3 capitalized English letters

<n> time zone deviation value, -12~+12

[Example]

6. Enter in configured view:

clock timezone CST -8

The time zone of IG601is east eighth area and the name is CST (China's standard time).

7. Enter in configured view:

default clock timezone

Recover the timezone of router to the factory setting.

6. 4 Ntp server

[Command]

ntp server <hostname>

no ntp server

default ntp server

[Function] Set the customer end of Internet time server

[View] Configure view.

[Parameter]

<hostname> address or domain name of mainframe of time server

[Example]

8. Enter in configured view:

ntp server pool.ntp.org

Set the address of Internet time server pool. ntp. org.

9. Enter in configured view:

no ntp server

Disable the router to get system time via network. 

10. Enter in configured view:

default ntp server

Recover the network time server of router to the factory setting.

6.5 Config export

[Command] Config export

[Function] Export config

[View] Configure view.

[Parameter] No

[Example]

Enter in configured view:

config export

The current config. is exported.

6.6 Config import

[Command] Config import

[Function] Import config

[View] Configure view.

[Parameter] No

[Example]

Enter in configured view:

config import

The config. is imported.

7 System Management Command

7. 1 Reboot

[Command] Reboot

[Function] System restarts.

[View] Super user view and configuration view

[Parameter] No

[Example]

Enter in super user view:

reboot

System restarts.

7. 2 Enable username

[Command] Enable password [<name>]

[Function] Modify the username of super user.

[View] Configure view.

[Parameter]

<name> new super user username

[Example]

Enter in configured view:

enable username admin

The username of super user is changed to admin.

7.3 Enable password

[Command] Enable password [<password>]

[Function] Modify the password of super user.

[View] Configure view.

[Parameter]

<password> new super user password

[Example]

11. Enter in configured view:

enable password

Enter password according to the hint.

7.4 Username

[Command] Username <name> [password [<password>]]

no username <name>

default username

[Function] Set user name, password

[View] Configure view.

[Parameter] No

[Example]

12. Enter in configured view:

username abc password 123

Add an ordinary user, the name is abc and the password is 123.

13. Enter in configured view:

no username abc

Delete the ordinary user with the name of abc.

14. Enter in configured view:

default username

Delete all the ordinary users.