Multitech RF850 Linux Router

I've been a fan of Multitech for a long time. They aren't all things to all people; their product line is relatively small, but they make good stuff and stand behind it solidly. I have always received superb support when I have needed it - the attitude is to help you solve the problem, not to get you off the phone as quickly as possible.

As a small example, during the configuration of this RF850, I ran into a small bit of confusion. I called for support and was accidentally transferred to the modem support group. When I described my problem, the engineer who answered told me that I had been sent to the wrong place but didn't just throw me back into the hold queue - he walked over, interrupted one of the people in the right group, asked my question and came back to me with an answer. Now yes, it was a simple question - had it been complicated he couldn't have done that, but it demonstrates the helpful attitude these guys always have.

I bought this for a customer who has been outgrowing the small RF560 routers that he had originally. We wanted more power and control of networks and VPN's and I definitely didn't want to subject him to Cisco or Linksys. Cisco is too expensive and Linksys is.. well, you know what I think about Linksys. I ordered an RF850 for the main office, an RF830 and an RF830AP (Wireless) for the branches.

It's a Linux box

I wasn't unfamiliar with these products because I had worked with other clients who have them, but that was over the Internet - I hadn't actually had any of these in my hand before. I was therefore a little surprised to see a DIN keyboard and monitor connector plus two USB ports on the back of the unit in addition to the expected serial ports and LAN/WAN/DMZ ports. Of course I wasn't about to read the manual; I hooked up a monitor and a USB keyboard and fired the puppy up. I chuckled as I watched Linux boot - I hadn't had any clue that was what I'd be seeing. When it gave me a login prompt, I logged in as admin with the default "admin" password and found that I was sitting at a Linux box:

[admin@routefinder admin]$ df 
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/hda3               833388    273928    517124  35% /
/dev/hda1                13660      4449      8506  35% /boot
[admin@routefinder admin]$ cat /proc/meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  511389696 78184448 433205248        0  3051520 39157760
Swap: 143466496        0 143466496
MemTotal:       499404 kB
MemFree:        423052 kB
MemShared:           0 kB
Buffers:          2980 kB
Cached:          38240 kB
SwapCached:          0 kB
Active:          22824 kB
Inactive:        28372 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:       499404 kB
LowFree:        423052 kB
SwapTotal:      140104 kB
SwapFree:       140104 kB
[admin@routefinder admin]$ uname -a
Linux routefinder.xyz.com 2.4.26 #1 SMP Mon Jul
23 19:04:58 IST 2007 i686 unknown
 

So basically this is a small computer running Linux. As you would expect, it comes with a recovery CD.. that has a prominent warning on its label: "Do not boot your system with this CD in your CDROM drive. It will reformat the hard drive". Ouch..

Nothing in the manual told me how this would work so I called Multitech and was told that you'd open up the box, attach a CD to the IDE controller and do an install using the Recovery CD. I was hoping that it might have been able to do a network install or that it could use a USB CDROM but then again this isn't anything we are likely to be doing.

Network Definitions

If you are accustomed to small routers like the RF560's we had used here previously, there are a few things done differently that you need to know about. First, you will need to define machines and other routers in Networks and Services if you want to later use them in a VPN setup or packet filtering rules. You can define machines or networks. For example, for this setup I defined these:

(Article continues after the break)

If you are going to forward ports to internal servers, you need to define DNAT rules (Network Setup -> DNAT). For example, I defined these (among others):

Note the "MYSSH" - I defined a port for SSH to the internal SSH server. You can ssh to the RF850 also but you need to define users (Administration-> Local Users) with that authority. Multitech provides a default "loginuser" for that purpose; you should probably delete that or at least change its password.

The Routefinder RF850 does provide SNAT if you need it, but for simple cases IP Masquerading is turned on by default so you normally wouldn't need to touch this.

I did have a need for it here, though. We have webmail running on an internal server but many of the laptop users want to access it at the same "mail.company.com" address they use when outside. To make that happen, I needed to add a rule so they could do that. What's needed is this:

"Laninterface" needs to be created in "Networks and Sevices"; it's the internal address of the router (192.168.2.1/255.255.255.255) .

Don't forget to allow these in Packet Filters:

Packet Filters

I've edited and simplified these rules for the purposes of this article. For example, I have a rule that allows the internal mailserver to use outgoing port 25 so that it can send email, but the next rule restricts anything else from doing that. In the even of a virus infection, this can help stop email spamming. If the virus is smart enough to use the internal mailserver, of course it can get the mail out, but at least it will be logged so we'll know the source.

You'll also need to add rules to allow VPN access. If that's PPTP, you will have defined a pptp-pool and that's the "From" that you will allow.

Note that you need to shut off the default System Defined rule when using your own definitions.

Backup

It took me a while to find the configuration backup - it's under the Tracking menu.

The zip file it produces is actually a backup of most of the Linux system: files from /var, /home, /opt and /usr are included. The router configuration is found in /etc/multiconf. For example, we'll find our packet filtering rules there:

$ cat packetrules
1 Any Kerio® mail ACCEPT 1
2 Any SMTP mail ACCEPT 1
3 Any HTTPS mail ACCEPT 1
4 Any MYSSH sme ACCEPT 1
5 mail SMTP Any ACCEPT 1
6 LAN SMTP WAN REJECT 1
7 Any Any Any ACCEPT 1
 

I've edited and simplified these rules for the purposes of this article.

Because there is a hard drive, the RF850 can also store periodic backups there - you set the frequency and retention policies at that same screen.

One thing I did have to change from defaults was "Drop Fragmented Packets". That was breaking our HP JetDirect printing - Multitech defaults to droppoing these. That shouldn't be an issue today; it seems safe to turn it off.

RF820 and RF820AP

These are flash devices with very similar configuration to to RF830. Some of the menus are slightly different because of missing features on the smaller units, but it is basically a consistent interface.

Tony Lawrence 2009-01-29 Rating: 4.0