Quick Start Guide WALL IE Version en as of FW. www.helmholz.de
Contents. Introduction. Connection. Initial access to the web interface. Adapting IP addresses. The bridge mode. Packet filter functionality. NAT operating mode 9 8. Basic NAT 9 9. NAPT. Port forwarding. Static routes. Resetting to factory settings. LED status information. Button functions. Technical data Note: Our products contain open source software, among others. This software is subject to the respectively relevant license conditions. We can send you the corresponding license conditions, including a copy of the complete license text together with the product. They are also provided in our download area of the respective products under www.helmholz.de. We also offer to send you or any third party the complete corresponding source text of the respective open source software for an at-cost fee of. Euro as a DVD upon request. This offer is valid for a period of three years, starting from the date of product delivery. Quick Start Guide WALL IE
. Introduction Please note: Please observe the safety instructions for the product, which can be found in the manual. The manual can be downloaded from the website www.helmholz.de in the download area. This document should explain the initial commissioning of the WALL IE on the basis of simple examples from network technology. P: WAN port : Function button P P: LAN ports : Reset button Voltage supply Operation LEDs (see page ) Quick Start Guide WALL IE
. Connection The WALL IE must be supplied with V DC at the wide range input 8 V DC via the provided connector plug. The terminal (FG) is for the functional ground. Connect this correctly with the reference potential. The RJ P WAN socket is for the connection of the external network. The RJ P LAN P LAN sockets are switched and are for the connection of the internal network.. Initial access to the web interface The WALL IE is set on the LAN-side at the factory with the IP address 9.8.. and the subnet mask... Access to the web interface is only possible via the LAN connections P P. The IP address of your network adapter must first be set in accordance with the IP subnet of the WALL IE: Start > Control panel > Network and sharing settings > Adapter settings > LAN connection properties > Internet protocol version Now connect a patch cable with the LAN connection of your PC and one of the LAN ports P P of the WALL IE. The web interface can be reached in the delivery condition by calling up https://9.8.. in the browser page. Note: For security reasons, the web interface can only be reached through a secured HTTPS connection. An exception needs to be confirmed once in order to reach the website. A certificate for the connection backup can be stored in the Device/HTTPS menu. Quick Start Guide WALL IE
You will be prompted to set a password with the initial registration. The password must have at least 8 characters and may have a maximum of 8 characters. It may contain special characters and numbers. With the Continue button, the password is stored in the device and you will be forwarded to the Overview page of the WALL IE. The main user is always admin. Another user administration hasn't been implemented yet. Note: Please note the password well! For security reasons there is no possibility to reset the password without resetting the device to the factory settings.. Adapting IP addresses Click on the Network menu and select the sub-menu Interface. The desired IP addresses (LAN/WAN IP) and subnet masks (LAN/WAN net mask) can be defined here. A default gateway and a DNS server can also be indicated as required. The entry is saved with the Save button. Quick Start Guide WALL IE
SN: Ext. V DC 8... V + FE IN IN RDY USR. The bridge mode In the bridge operating mode, WALL IE behaves like a layer switch between the automation cell (LAN) and the production network (WAN). The packet filter can be used to limit access between the two areas. This enables the separation of a part of the production network without using different network addresses....... Company network.../ P WAN P LAN P LAN P LAN External (WAN) Internal (LAN)............... Machine network.../ Switch the WALL IE to the bridge mode via Device > Operating mode > Bridge. In the bridge mode, the IP address of the WAN interface is identical to the IP address of the LAN interface. It is thus transparent. Important: All ports for WAN to LAN data transfer are initially blocked in the bridge mode! In order to enable access, packet filter rules must be created or the default action for the packet filters be set to Accept. The LAN to WAN data transfer is initially always released, but can also be limited by packet filters or the default action. Quick Start Guide WALL IE
. Packet filter functionality The packet filters enable the limitation of access between the production network (WAN) and the automation cell (LAN) in both directions. For example, it can be configured that only certain participants from the production network may exchange data with defined participants from the automation cell. The following filter criteria on layers and are available: IPv addresses, protocol (TCP/UDP), ports. The packet filters are available in both the WAN to LAN direction and in the direction LAN to WAN. MAC addresses can also be filtered with black and whitelisting.. Creation of rules in the packet filter In the Packet Filter menu, select WAN to LAN or LAN to WAN, depending upon which communication direction you wish to restrict. With the Default Option you can set whether all frames are generally allowed ( Accept ) and only special packets are filtered ( Blacklisting ) or whether all frames are generally prohibited ( Reject / Drop ) and only those frames are allowed to pass through that correspond with the filter rules ( Whitelisting ). With the option ICMP Traffic, you can allow the passage of ICMP packets e.g. a Ping. A PC with... (e.g. a visualization) should now be allowed access to the CPU... via port with the TCP protocol. To this purpose choose Packet Filter and WAN to LAN. Choose Reject as default action, and all other queries will be rejected. Now enter the following rule and save it with the. Quick Start Guide WALL IE
The PC with the IP address... (an observer) should continue to be allowed access to the web interface of the panel with the IP address... via port 8 with the TCP protocol. The completely entered rules should appear as follows: Source IP Destination IP Protocol Destination port IP address of the device in the external network (WAN) from which the query originates. IP address of the device in the internal network (LAN) on which access is allowed by this rule. Selection of the permitted protocol, TCP or UDP. The device port to be reached in the internal network. Port ranges can be specified with a : (e.g. :). Several ports can be listet by commas. Action Comment Packages from the external network (WAN) can be accepted ( Accept ) or rejected ( Reject / Drop ). Drop rejects a packet mutely and Reject provides an ICMP error message. A comment can be entered here. Status Rule active (a click on the lamp changes the status). Rule active (a click on the lamp changes the status). Deletes a rule. Adds a rule. 8 Quick Start Guide WALL IE
SN: Ext. V DC 8... V + FE IN IN RDY USR SN: Ext. V DC 8... V + FE IN IN RDY USR SN: Ext. V DC 8... V + FE IN IN RDY USR SN: Ext. V DC 8... V + FE IN IN RDY USR. NAT operating mode Company network.../ When several automation cells with the same address range are to be incorporated into a production network, this can result in collisions, as the addresses in the entire network are not unambiguous. Using Network Address Translation (NAT), WALL IE makes it possible to incorporate several automation cells of the same kind into the production network. In the NAT operating mode, WALL IE forwards the data transfer between various IPv networks (Layer ) and implements the IP addresses with the help of NAT. The packet filters can also be used. External P WAN P LAN P LAN External P WAN P LAN P LAN External P WAN P LAN P LAN P LAN P LAN P LAN Internal Internal Internal Machine Machine Machine X 9.8../ 9.8../ 9.8../ 8. Basic NAT Basic NAT, also known as : NAT or Static NAT, is the translation of individual IP addresses or of complete address ranges. The External IP must be a free or unused IP address in the WAN network. The Internal IP is the IP address of the device in the LAN, which assigns the External IP in the WAN. Translation takes place at the IP level and all ports can be addressed. Access can be limited to certain ports by entering packet filter rules. Important: When defining a Basic NAT rule, all ports for WAN to LAN data transfer are initially blocked for data transfer! In order to enable access, packet filter rules must be created or the default action for the packet filters be set to Accept. The LAN to WAN data transfer is initially always released, but can also be limited by packet filters or the default action....... P WAN P LAN P LAN P LAN Company network External (WAN) Internal (LAN) External IP............... 9.8...../ Internal IP 9.8.. 9.8.. 9.8.. 9.8.. 9.8.. 9.8.. 9.8.. 9.8.. 9.8.. Machine network 9.8../ Quick Start Guide WALL IE 9
8. Setting up Basic NAT rules In order that the entry of Basic NAT rules is possible, WALL IE must be in the operating mode NAT. Select the NAT menu and the sub-menu Basic NAT. Enter the first rule and save it with the button. Each entry is confirmed with the message Rule added successfully. Important: In the case of a Basic NAT rule, all ports for WAN to LAN data transfer are initially blocked for this rule! In order to enable access, packet filter rules must be created or the default action for the packet filters be set to Accept. External IP Internal IP Comment The virtual IP address accessible in the external network (WAN). The real IP address assigned in the internal network (LAN). A comment can be entered here. Status Rule active (Clicking on the lamp changes the status) Rule inactive (Clicking on the lamp changes the status) Action Deletes a rule. Adds a rule. Quick Start Guide WALL IE
SN: Ext. V DC 8... V + FE IN IN RDY USR 9. NAPT NAPT for LAN to WAN traffic replaces the sender addresses of queries from the automation cell (LAN) with the address of the WALL IE ( Source NAT ) in the WAN. If the option is deactivated, the query packets are forwarded to the WAN with their original sender IPs.. Port forwarding With the help of port forwarding ( Port forwarding for WAN to LAN traffic ), it can be configured that packets at a certain TCP/UDP port of the WALL IE (WAN) can be forwarded to a participant in the automation cell (LAN) (e.g....:8 to 9.8..:8). Important: If with the packet filters WAN to LAN the default action is set to Reject or Drop, the corresponding filter rules for access must also be created for each port forwarding entry....... P WAN P LAN P LAN P LAN... Company network External (WAN) Internal (LAN) 9.8.. External Port...:8...:...:8 9.8...../ Internal IP & Port 9.8..:8 9.8..: 9.8..:8 9.8.. 9.8.. 9.8.. 9.8.. Machine network 9.8../ Quick Start Guide WALL IE
Protocol TCP/UDP Comment Freely definable comment. External port Internal IP Internal port The WAN port at which the frames are received. The real IP address accessible in the internal network (LAN). The real port of the device accessible in the internal network (LAN). Status Rule active (Clicking on the lamp changes the status) Rule inactive (Clicking on the lamp changes the status) Action Deletes a rule. Adds a rule. Quick Start Guide WALL IE
SN: Ext. V DC 8... V + FE IN IN RDY USR SN: Ext. V DC 8... V + FE IN IN RDY USR. Static routes Static routes are used for communication with other automation cells. To this purpose, the network and the address of the router of the WALL IE responsible for this ( Next Hop or Gateway ) must be configured. WAN Production network.../ Static route: 9.8..x via......... Static route: 9.8..x via... P WAN P LAN P LAN External P WAN P LAN P LAN Internal P LAN Internal P LAN Machine Machine LAN Automation cell 9.8.. 9.8.. 9.8.. 9.8.. Static routes are only supported in the NAT operating mode. A static route can be set up via Network Static route. In the example above, the static route to the right WALL IE with the IP... is entered in the left WALL IE for queries to 9.8..x. The entry is confirmed with the message Rule added successfully. Quick Start Guide WALL IE
Network The IP network to be routed from the WALL IE. Comment Freely definable comment. Net mask Next Hop The affiliated subnet mask. The next responsible router or WALL IE for this network. Status Rule active (Clicking on the lamp changes the status) Rule inactive (Clicking on the lamp changes the status) Action Deletes a rule. Adds a rule. Note: In the case of devices in the internal network (LAN) that should reach other networks, the LAN IP address of the WALL IE is entered as a gateway. If the opposite side of the static route is also a WALL IE, a static route for the return path must also be entered there. The conducting of the response frame must also be cleared in the Packet filter/wan to LAN. Quick Start Guide WALL IE
. Resetting to factory settings In order to reset WALL IE to the delivery status, the button must be activated while the device is restarted. A restart can be carried out with Power OFF/ON, by activating the button or with the Device reboot function at the website. The successful resetting of the parameters and settings is acknowledged during the boot process by the lit USR LED.. LED status information Off On No power supply or device defective. Device is correctly supplied with voltage. RDY On Device is ready to operate. Flashing light or on Data transfer permitted between WAN and LAN. USR On Factory settings reset active. RJ LEDs Green (Link) Orange (Act) Connected. Data transfer at the port.. Button functions The WALL IE can be reset to factory settings with the button. To this purpose, the button must be kept pressed during the run-up phase of the WALL IE. The successful resetting of the parameters and settings is acknowledged during the boot process by the lit USR LED. The button can then be released. The button triggers an immediate restart of the WALL IE, in the course of which all saved settings are retained. Quick Start Guide WALL IE
. Technical data WALL IE, Industrial Ethernet Bridge und Firewall (-8-WAL) Dimensions (DxWxH) x 9 x mm Weight Approx. g Number of inputs V DC, as per DIN EN - Type WAN interface Type Base-T/ Base-T Connection RJ socket Transmission rate / Mbps LAN interface Type Base-T/ Base-T Connection RJ socket Transmission rate / Mbps Operating modes Bridge, NAT (Basic NAT, NAPT) IPv addresses, protocol (TCP/UDP), ports: Packet filter WAN to LAN and LAN to WAN separated, MAC addresses (black and whitelisting) Status indicator LEDs function status, 8 LEDs Ethernet status Voltage supply V DC, 8 V DC Current draw Max. ma with V DC Ambient conditions Ambient temperature - C... + C Transport and storage temperature - C +8 C Relative air humidity 9 % r H without condensation Pollution degree Protection rating IP Certifications CE, UL UL UL -/UL Voltage supply V DC (8... V DC, SELV and limited energy circuit) Pollution degree Altitude Up to m Temperature cable rating 8 C Note: The contents of this Quick Start Guide have been checked by us so as to ensure that they match the hardware and software described. However, we assume no liability for any existing differences, as these cannot be fully ruled out. The information in this Quick Start Guide is, however, updated on a regular basis. When using your purchased products, please make sure to use the latest version of this Quick Start Guide, which can be viewed and downloaded on the Internet at www.helmholz.de. Our customers are at the center of everything we do. We welcome all ideas and suggestions. Helmholz GmbH & Co. KG Hannberger Weg 99 Großenseebach Germany Phone +9 9 8- Fax +9 9 8- info@helmholz.de www.helmholz.de