I've been a fan of Multitech for a long time. They aren't
all things to all people; their product line is relatively small,
but they make good stuff and stand behind it solidly. I have
always received superb support when I have needed it - the
attitude is to help you solve the problem, not to get you off
the phone as quickly as possible.
As a small example, during
the configuration of this RF850, I ran into a small bit of
confusion. I called for support and was accidentally transferred
to the modem support group. When I described my problem, the
engineer who answered told me that I had been sent to the wrong
place but didn't just throw me back into the hold queue - he walked
over, interrupted one of the people in the right group, asked my
question and came back to me with an answer. Now yes, it was
a simple question - had it been complicated he couldn't have
done that, but it demonstrates the helpful attitude these guys always
I bought this for a customer who has been outgrowing the small
RF560 routers that he had originally. We wanted more power and
control of networks and VPN's and I definitely didn't want to
subject him to Cisco or Linksys. Cisco is too expensive and Linksys
is.. well, you know what I think about Linksys. I ordered an RF850
for the main office, an RF830 and an RF830AP (Wireless) for the branches.
It's a Linux box
I wasn't unfamiliar with these products because I had worked
with other clients who have them, but that was over the Internet -
I hadn't actually had any of these in my hand before. I was therefore
a little surprised to see a DIN keyboard and monitor connector plus
two USB ports on the back of the unit in addition to the expected serial ports and LAN/WAN/DMZ ports. Of course I wasn't about to
read the manual; I hooked up a monitor and a USB keyboard and
fired the puppy up. I chuckled as I watched Linux boot - I
hadn't had any clue that was what I'd be seeing. When it
gave me a login prompt, I logged in as admin with the default "admin"
password and found that I was sitting at a Linux box:
[admin@routefinder admin]$ df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/hda3 833388 273928 517124 35% /
/dev/hda1 13660 4449 8506 35% /boot
[admin@routefinder admin]$ cat /proc/meminfo
total: used: free: shared: buffers: cached:
Mem: 511389696 78184448 433205248 0 3051520 39157760
Swap: 143466496 0 143466496
MemTotal: 499404 kB
MemFree: 423052 kB
MemShared: 0 kB
Buffers: 2980 kB
Cached: 38240 kB
SwapCached: 0 kB
Active: 22824 kB
Inactive: 28372 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 499404 kB
LowFree: 423052 kB
SwapTotal: 140104 kB
SwapFree: 140104 kB
[admin@routefinder admin]$ uname -a
Linux routefinder.xyz.com 2.4.26 #1 SMP Mon Jul
23 19:04:58 IST 2007 i686 unknown
So basically this is a small computer running Linux. As you would
expect, it comes with a recovery CD.. that has a prominent warning on
its label: "Do not boot your system with this CD in your CDROM drive. It will reformat the hard drive". Ouch..
Nothing in the manual told me how this would work so I called
Multitech and was told that you'd open up the box, attach a
CD to the IDE controller and do an install using the Recovery CD.
I was hoping that it might have been able to do a network install
or that it could use a USB CDROM but then again this isn't
anything we are likely to be doing.
If you are accustomed to small routers like the RF560's we had used
here previously, there are a few things done differently that you
need to know about. First, you will need to define machines and
other routers in Networks and Services if you want to later
use them in a VPN setup or packet filtering rules. You can
define machines or networks. For example, for this setup
I defined these:
If you are going to forward ports to internal servers, you need
to define DNAT rules (Network Setup -> DNAT). For example,
I defined these (among others):
|Pre DNAT Network
||Pre DNAT Service
||Post DNAT IPAddress
||Post DNAT Service
Note the "MYSSH" - I defined a port for SSH to the internal
SSH server. You can ssh to the RF850 also but you need to
define users (Administration-> Local Users) with that authority.
Multitech provides a default "loginuser" for that purpose; you
should probably delete that or at least change its password.
The Routefinder RF850 does provide SNAT if you need it, but for simple
cases IP Masquerading is turned on by default so you normally wouldn't
need to touch this.
I did have a need for it here, though. We have webmail running
on an internal server but many of the laptop users want to access it
at the same "mail.company.com" address they use when outside. To
make that happen, I needed to add a rule so they could do that. What's
needed is this:
|Pre SNAT Source
||Post SNAT Source
"Laninterface" needs to be created in "Networks and Sevices"; it's
the internal address of the router (192.168.2.1/255.255.255.255) .
Don't forget to allow these in Packet Filters:
I've edited and simplified these rules for the purposes of
this article. For example, I have a rule that allows the internal
mailserver to use outgoing port 25 so that it can send email, but
the next rule restricts anything else from doing that. In
the even of a virus infection, this can help stop email
spamming. If the virus is smart enough to use the internal mailserver,
of course it can get the mail out, but at least it will be logged so
we'll know the source.
You'll also need to add rules to allow VPN access. If that's
PPTP, you will have defined a pptp-pool and that's the "From" that
you will allow.
Note that you need to shut off the default System Defined rule
when using your own definitions.
It took me a while to find the configuration backup - it's
under the Tracking menu.
The zip file it produces is actually a backup of most of
the Linux system: files from /var, /home, /opt and /usr are
included. The router configuration is found in /etc/multiconf.
For example, we'll find our packet filtering rules there:
$ cat packetrules
1 Any Kerio mail ACCEPT 1
2 Any SMTP mail ACCEPT 1
3 Any HTTPS mail ACCEPT 1
4 Any MYSSH sme ACCEPT 1
5 mail SMTP Any ACCEPT 1
6 LAN SMTP WAN REJECT 1
7 Any Any Any ACCEPT 1
I've edited and simplified these rules for the purposes of
Because there is a hard drive, the RF850 can also store periodic
backups there - you set the frequency and retention policies
at that same screen.
One thing I did have to change from defaults was "Drop Fragmented Packets". That was breaking our HP JetDirect printing - Multitech defaults to
droppoing these. That shouldn't be an issue today; it seems safe to turn it off.
RF820 and RF820AP
These are flash devices with very similar configuration to
to RF830. Some of the menus are slightly different because of
missing features on the smaller units, but it is basically
a consistent interface.
Tony Lawrence 2009-01-29 Rating: