Instructor: In this lesson, I'm going to show you how
to configure a small office home office,
also known as a SOHO type of network.
Now this small office home office type of network
is what you're normally going to have in your home,
or if you work for a really small business
of less than about 20 people or so.
Generally these are going to be very inexpensive
all-in-one devices and typically we call these
a wireless router, or a SOHO router,
because they have all the features you need
in one single device.
This includes your internal network or LAN,
your connection to the external network or WAN,
as well as a wireless access point
to create wireless networks
that you can use to connect other wireless devices
to your network and out to the internet.
Now in general, this could be an all-in-one unit
that includes your WAN connection,
such as a fiber or cable modem that's already included
in this device, or you may have a separate modem provided
by your ISP and then you're going to use your own SOHO router
to do all of these functions I'm going to show you
in this lesson.
Now, the first thing to point out before we get started
is that this is based on a TP-link Archer A7 SOHO router.
Yours, depending on what brand and manufacturer you use,
are going to have different layouts and graphics
and menu options, and some manufacturers use different names
for the same things to make it their own
and have their own brand identity.
So anything that might have a unique name
for this particular SOHO network,
I'm going to point that out to you
so you'll know what we're talking about
in terms of a generic item.
For example, they use the term virtual servers
when you're configuring their firewall.
That is something that is unique
to this brand and this interface,
and so I wanted to make sure you're aware of that
as we go through and do our configurations.
Now, the first thing we're going to do
is I'm going to go into the advanced mode
instead of using the basic mode.
This will give us access to a lot more settings,
and that way we can dive a little bit deeper than we could
if we stuck here in the basic setup.
To do that we'll simply click on the advanced tab.
From here you'll see the left menu options have now changed
and we have a lot more options here.
As we go in here, the first thing we're going to look at
is the network tab.
Now under the network tab the first one we want to click
is internet, which is what they call
the Wide Area Network connection.
Now, in reality, the internet is one type of WAN,
but you could really connect this device
to any kind of WAN you wanted.
But again, for most small office home office users
the internet is the WAN that they're going to be using.
And that's why they use the term 'internet' here
to make it easier for most users to understand.
The first thing we'll configure under the internet
is how we're going to get an IP address
for our WAN side of this router.
This will be coming from our cable or fiber modem,
or whatever type of connection you have with your ISP.
Now, with my ISP, we're assigned a dynamic IP
from that fiber optic modem.
You could see that here as 192.168.66.117.
It has a subnet mask of 255.255.255.0
and a default gateway of 192.168.66.25.
You'll also see we have our primary
and secondary DNS set at 192.168.66.25
and 192.168.66.1 which tells me those servers
are inside of my ISPs network,
because their default that's going to the ISP
is that 192.168.66.0/24 network,
with the default gateway being located at .25.
Now, if your ISP provides you with a static IP address,
one that doesn't change every time you connect to it,
you can configure that here
by going to the internet connection type
and then clicking on static IP.
From here, you can configure with the IP address
that you've been given by your ISP.
For example, at my office, we are assigned a static IP
and so if I was going to be using this device there
I might use it with my static IP of 108.66.77.88.
That's going to have a subnet mask of 255.255.255.0
and it's going to have a default gateway of 108.66.77.1.
Then I have to set my primary and secondary DNS.
Here they just have some filler numbers
of 3.3.3.3 and 4.4.4.4 filled in.
But I would like to use Google's DNS server
which is 8.8.8.8.
And I'm not going to have a secondary DNS,
so I'm only going to use Google's DNS for my DNS
for every device on this network.
Under that, you'll see I have the option
to set my MTU size, which stands
for my Maximum Transmissible Unit,
and this is how large each packet can be
when you're sending data across the network.
Now by default, this will normally be 1500,
and you'd only change this if you have a need to.
For example, if you're running this through a VPN connection
you might want to have a lower size MTU unit,
that way you have room to encapsulate it
and encrypt it before sending it out through another router
that has a maximum transmission unit size of 1500,
and that's why this is set currently at 1260.
Now another type of internet connection option
you might have is what's called PPPoE, L2TP or PPTP.
And these are generally going to be used with a VPN
or other specific type of connection.
For example, L2TP is really commonly used with a VPN server.
So if you have a branch office located somewhere,
you can use this device to create a VPN tunnel
between this device and whatever VPN server
you're trying to connect to.
For example, I used to live in Italy
and at that time I wanted to still be able
to access a lot of my American TV shows
and streaming video websites.
To do that though, I had to actually use a VPN tunnel
back to America and then go to those websites
from that American VPN connection.
Now to do that for my entire house,
what I did was I configured a device like this
with an L2TP connection, I inserted my username
and password, and then I would put the VPN servers IP
where you see 3.3.3.33, and that way I would connect
to my VPN server back in America and anybody in my house
could access everything just as if they were sitting
in Miami, which was where the location of my VPN server was,
even though we were sitting in the middle of Italy.
All right, but for my connection,
we do want the dynamic IP, so we're going to go back
to that and leave it there.
And from there we can then just hit save,
and we are now saved with our dynamic IP once again.
Now another setting you'll see here
in the bottom of the screen, is called MAC Cloning.
Now some of your ISPs will make it
so that whatever the first device is
that connects to the cable modem or fiber modem,
that's the MAC address it's going to recognize,
and it's going to lock your connection
to that particular device.
If your ISP does that, you might need to set a MAC address
for your SOHO router, so that it can pretend to be
that computer and say, "Hey, I'm really
that one computer, use me", and this device can then use
the MAC address from your computer
and identify itself as that.
Again, this is one of those use cases
that's going to be dependent on your ISP,
and in my case, my ISP doesn't use that,
so I can just use the default MAC address for my device.
The next area we're going to look at,
is the LAN area under network.
Now, under this LAN option, you're going to give an IP address
to your particular SOHO router.
In my case, the router is using
an IP address of 192.168.0.1.
Now, normally you're going to leave this as the default
that's set by your device, but if I had multiple devices
on my network, and if I'm already using
this particular IP address on this network
by another device, I can change that,
and maybe I want to have this device identify itself
as 10.1.1.1, and then I can change this
so this device will use that other IP.
In my case we're going to go ahead
and leave that IP address the way it is,
because it's already working fine
for this particular network.
The next thing we're going to look at is our DHCP server,
and if we go down, we can click on DHCP server
and you'll see that this is currently enabled.
This means that this SOHO router is acting
as the DHCP server, and here we can configure
what IP addresses we want to hand out
as part of our DHCP scope, as well as what default gateway,
primary DNS and secondary DNS we want to hand out
to our clients.
For example, you can see we're currently using the range
of 192.168.0.100, and we are going all the way up
to 192.168.0.122.
So we only have 22 devices that are going to be able
to be assigned as part of this DHCP scope.
If I wanted to have more devices than that,
for instance if I wanted 50 devices,
I can simply change this to .150,
and that will now give me the range
from 100 to 150 as I'm handing out those IP addresses.
In addition to that, if I didn't want the DHCP server
to be used, I could disable that
by unchecking enable DHCP server.
Another area that you will commonly change
will be the primary or secondary DNS.
In this case, it's using this device,
this small office home office router,
as the DNS server instead of going directly
to somebody else's DNS server.
If I didn't want that and I wanted
to use Google's DNS server instead,
I could simply change that under primary DNS
to 8.8.8.8, and then I will delete that secondary DNS
and when I save that, now it will use this DNS server
for all of my clients who are getting a DHCP address
from my DHCP server.
The next thing we want to look at, is dynamic DNS.
Now dynamic DNS is something that is used when you have
an ISP who is constantly changing your IP address.
Most ISPs in the world, don't give you a static address
but instead, they give you a dynamic address.
And if you're trying to run a web server
or a Minecraft server or something like that
from your home network, you need to be able to have
an IP address that isn't changing,
or at least a way to identify what that IP address is
every time it does change, by using some kind of a name
or unique identifier.
And this is where dynamic DNS comes into play.
You can use a service like NO-IP or DynDNS,
where you can sign up with them
and for a couple dollars a month
they will give you a username and password,
as well as the unique domain name
that you can assign using their service.
So I might have something like Jason Dion home.com
as my domain name and I can assign that inside of DynDNS
and I will associate that with this device.
Every time my ISP changes my IP address through DHCP
on this router, it will then update DynDNS
with the new location, and so if you're going
to Jason Dion home.com, it would still go to this device
regardless of what the IP address was at any given time.
That is the benefit of using something like dynamic DNS.
Now, not all small office home office routers support this
but it is a great thing to have
if you're trying to run some kind of a server
out of your home or small office network.
The next area we're going to look at is called operation mode.
Now this router can operate in two different modes.
The current mode is being used as a router,
and this means we're connecting this device
to the internet through a dynamic IP, a static IP,
or a PPoE, L2TP, or PPTP connection.
In our case, we're using a dynamic IP,
and so we are connecting from this device
to my modem through a dynamic IP,
and then out to the internet.
Now, on the other hand,
if my house was really large and I bought multiple
of this device to be able to have better wireless coverage
in my home, I would set it to access point.
Now, one of these devices would be the router
but all of the other ones will be access point.
And when you have it as an access point,
it's simply going to allow you to connect a cable
from the original router into that secondary device,
and that secondary device will not be a DHCP server,
it will not be a router, and instead,
it will just be a wireless access point,
being able to give wireless signal to other areas
of the house that we couldn't reach
from the original SOHO router using its wireless signal.
This is something you'll use
if you have a larger house or a larger office,
where you'll have to have multiple access points.
In my office, for example,
we actually have four wireless access points set
to access point only mode,
and they connect back to a central router
and then that router connects us out to the internet.
This allows us to have full coverage
throughout the entire office building,
both upstairs and downstairs without any lapse in coverage.
The next option is going to be focused on the wireless network.
Now I'm going to skip that here
because we've already done an entire video
on wireless networks and how to set those up
in a different lesson.
The next area we want to look at is USB settings.
Now on this particular device, we actually have
a couple of USB ports on the back of it.
And with those USB ports,
I can share files or I can create a print server,
and that's what this allows me to do.
If I go under sharing access,
you can see that we can create accounts
for different people that we want access
to those USB hard drives that are being plugged
into the back of this device and acting as a media server.
If I go down to print server,
you'll see this is currently enabled
and this printer has no printer installed yet.
If I wanted to install a printer,
I could hook it up using a USB cable from my printer
to the back of this small office home office router,
and then that can be shared across the entire network
with all of my users and allow a single printer
to be hooked up to this network that everyone can use.
Underneath that you'll see
we have some parental control options.
And then we have QoS, which stands for quality of service.
Now quality of service says, how much bandwidth
are we going to allow this device to use?
Now, in my case, we have QoS turned off
because this is the only router in my network,
and so I'm going to use all of the bandwidth.
But if I had multiple of these devices,
I can actually set them so I can have higher priority areas
and lower priority areas.
For example, in my office, upstairs is where our studio is
and I want to make sure they have a very high quality
of service, so I can enable QoS
and say that we're going to give them a bandwidth
of one gigabit per second, as shown here.
Now, on the other hand, in the offices below
where everybody's doing the work, we might decide
that they can afford to have a lower quality of service.
And so we might set them to 500 megabytes
for upload and download speeds,
and that way they're not going to take away
additional bandwidth from the studio upstairs
when we're trying to do recording
and trying to do live streams.
The next thing we have is our security tab.
Underneath the security tab,
we have a couple of different settings here.
First, we have the ability to turn on or off a firewall
and to enable denial of service protection
to prevent people from attacking us.
As you could see towards the bottom,
we have a couple of hosts there that were on the no-no list,
and so they are now being blocked
because they were doing bad things
and they were trying to cause a denial of service.
The next thing we have is access control.
Under access control this is going to be using MAC addresses
as a mechanism for filtering.
You can set this up in what they refer to as
a blacklist or a whitelist, but CompTIA refers
to this as a block list and an allow list.
Now, in our case, we're using a whitelist
also known as an allow list.
This means that any device you see listed here
is going to be allowed to connect to this network.
If you have a MAC address and it's not listed here,
it's not going to be able to connect to this particular device.
Now, this one is actually one of my demo units,
and you can see all the MAC addresses
are showing the exact same,
but that's just because this is a demo model
instead of being an actual model
that I'm using in a production network.
The next one we have is what's called IP and MAC binding.
Now this is a table that we can set up
so that if we want to make sure a device
always has the same IP address from our DHCP server,
we can do that by assigning it here.
You could see in this list, we have two MAC addresses
and both of those are being linked to certain IP addresses.
So anytime those devices join the network
they're going to get that same IP address again,
because they're being reserved by the system.
This is really useful if you're running a file server,
media server, or print server inside of your network,
and you always want to make sure
that device gets the same IP address
without having to rely on static IPs.
The next thing we're going to do
is scroll down a little bit more,
and you'll see that we have this NAT Forwarding area.
Now under NAT Forwarding, they call it virtual servers,
but most devices will call this the firewall.
In here you're going to be able to set up ports
that you need open in your firewall,
that are going to be routed to a particular server,
internal to your network.
For example, let's say I wanted to create a web server.
I can do that by clicking the ad button,
I would choose the service type as HTTP,
which would be an unencrypted web connection,
and then I can give it an external port,
or multiple external ports.
Now in general, when you're dealing with HTTP,
you're just dealing with port 80,
and then the internal IP would be the device
that my server's on, such as 192.168.0.10,
and then my internal port would be
the listening port on that server.
This could be port 80 or it could be any other port
I configured when I set up that server.
And then under protocol, you can set up
whether or not this is going to be all TCP or UDP,
and in my case, I'm going to leave it to all.
And then we can save that
and that entry will get added to our list.
Next we have DMZ.
Now DMZ is an older term
and it stands for demilitarized zone.
CompTIA likes to call this the screened subnet,
but essentially in either case
it's going to serve the same function.
What the DMZ is going to do, is it's going to provide
a small area of your network
where you're going to put all your public facing servers.
So if I was running that web server, or an FTP server,
or an email server, I would put those in the DMZ.
This would allow me to have different firewall protections
for those areas, than I do for the rest of my network
and it provides an additional semi-trusted zone
where I could put these public facing resources.
The final thing I want to show you, is the VPN server.
Now on this one, we have three different types
of VPN servers, open VPN, PPTP VPN, and VPN connections.
If I wanted to enable a VPN server on this device,
I could do that by setting it here
and giving it a service port,
and at that point I can now use this device
as my connection point from outside of the network,
back into the network.
Going back to my example earlier from Italy to the US,
that's exactly what I did.
I set up an open VPN server
at one of my friends' houses down in Miami,
and that allowed me to connect my device
to their open VPN server running
on a small office home office router like this,
and that way all of my traffic was going
through his network and then out to the internet.
So everyone thought I was coming from Miami,
even though I was coming from Italy.
That's the benefit of using a VPN server.
All right, let's go back to status.
And once again, we can see all of the status
of our network in one glance here.
We see the internet connections for our WAN,
our wireless network, our LAN, or local area network,
our guest network, our USB devices,
and our overall performance.
So I hope you enjoyed this quick walkthrough
of how to configure a small office home office network
and router, using a device like the TP-link Archer 7.
As I said, this video was based on this device,
and your device is going to look slightly different.
If you ever get lost,
you can always check your manufacturer's website
for instructions and tutorials to help you through it.
Remember, whenever you're trying to access
the small office home office router in your network,
you want to check what your default gateway is
and that default gateway will normally be
the IP address of your small office home office router.
In my case, my SOHO router is located at 192.168.0.1,
and so if I wanted to get to this web interface
I would simply open up a web browser
on my system that's connected to this network,
either wired or wirelessly, and then type in 192.168.0.1
and it will bring me to the login screen
so I can access this interface and make any changes I need.