Networking — How-To Guides

Step-by-step instructions for connecting your Abilis to the internet, configuring your local network, and keeping it secure. Every task is done through the Web Interface at Networking > Settings.

The Settings page has tabs across the top: Ports, Routings, NAT, ACL, IP Shaping, DHCP, DNS, FTP, HTTP. Each How-To below tells you exactly which tab to use.

Configure LAN settings (IP address, subnet, gateway)

Goal: Sets the IP address of the Abilis on your local network. This is the address every device on your LAN uses to reach the Abilis — and through it, the internet, phone system, and everything else. Getting this right is the foundation of your entire setup.

Why it matters: If two devices share the same IP, neither works. If the Abilis IP doesn't match what your devices expect, they can't reach it.

1. Go to Networking > Settings > Ports.



2. You see a table of all network ports. Each row shows: Status (green icon = active), Port (e.g. Ip-1), Subtype (LAN, WAN…), Over (physical interface like Eth-1), IP Address (e.g. 192.168.094.254/24), and Description.
3. Click on the LAN port row (typically Ip-1 with Subtype "LAN" over Eth-1).
4. A detail panel opens. Key fields:

   

   • Active — must be ticked for this port to work.
   • Description — a label for your reference (e.g. "LAN").
   • Alert — whether to notify you if this port goes down (NO by default).
   • Side (Type) — usually AUTO. Leave it unless instructed otherwise.
   • Lower Resource — the physical interface (e.g. Eth-1). Do not change this.
5. Expand IP Address Settings:
   • Tick Manual IP Address.
   • IP Address: the address you want (e.g. 192.168.1.1)
   • Mask: the subnet mask (e.g. 255.255.255.000 for a /24 network)
   • Gateway address: leave as 000.000.000.000 for the LAN port (the Abilis IS the gateway for LAN devices).
6. Check the Network Address Translation (NAT) dropdown at the bottom — for a LAN port this must be INSIDE.
7. Click Save.

Connect to the internet via LTE / SIM modem

Goal: Gets your Abilis online using a mobile data connection (4G/LTE) through an LTE-BOX or SIM dongle.

1. Insert the SIM card into the LTE-BOX and connect it to the Abilis.
2. Go to Networking > Settings > Ports.



3. Look for a port with Subtype "WAN" and Over "EthLte-1" or similar — this is your LTE modem.
4. Click on it. Check Active is ticked.
5. Set the APN to match your mobile operator. If you don't know it, call your operator or search "[operator name] APN settings." Common Italian examples: internet (generic), mobile.vodafone.it, ibox.tim.it.
6. Set the NAT zone to OUTSIDE.
7. Click Save.
8. Go to Networking > Info — check the LTE connection shows a green status icon.

Connect to the internet via an Ethernet DSL modem (PPPoE)

Goal: Your ISP provided an ADSL or VDSL modem that plugs into the Abilis over Ethernet, and the line requires a username and password. The Abilis establishes a PPPoE session over the Ethernet link and uses the resulting connection as the internet gateway.

What you need from your ISP: the PPPoE username and password; whether the public IP is dynamic (assigned during the PPP session — most common) or fixed; whether the DSL link itself requires a VLAN tag (some operators do, most do not); and the service name, if the ISP specifies one.

Prerequisite — modem in bridge mode: the DSL modem must be configured by the ISP or by you as a transparent bridge. A modem in routed mode will not allow the Abilis to initiate the PPPoE session. If the modem shipped pre-configured in routed mode, factory-reset it and set bridge mode before going further.

1. Connect the DSL modem's Ethernet output to a free Ethernet port on the Abilis (for example Eth-2). Connect the telephone line to the modem and wait until the modem's DSL-sync LED stops blinking.
2. If — and only if — your ISP requires a VLAN tag on the DSL link, prepare the Ethernet port first. See Run several networks through one Ethernet cable (VLANs) for the port-level VLAN setup; the PPPoE client you create below will then use the tagged sub-interface. If the line is untagged (the usual case), skip this step.
3. Go to Networking > Settings > Ports and click New +. Create a new IP resource bound to the Ethernet port the modem is plugged into — this is the resource that will carry the PPPoE session and hold the ISP-assigned address.
4. On the new resource panel, set:
   • Description: a clear label, e.g. WAN_DSL.
   • Lower Resource: the Ethernet port the modem is connected to (e.g. Eth-2).
   • Network Address Translation (NAT): OUTSIDE — this is a WAN-side port.
5. Fill in the PPPoE credentials: the ISP-supplied username and password, authentication mode (leave at the default — the ISP dictates CHAP or PAP), service name (blank unless specified by the ISP), and IP-assignment mode (dynamic for most lines; enter the reserved IP instead if the ISP has assigned a static public address).
6. Enable DNS learning so the Abilis picks up the ISP's resolvers through the PPP session, and enable TCP MSS clamping on the connection. MSS clamping prevents the well-known failure where some HTTPS sites will not load over a PPPoE WAN because the PPP and Ethernet headers leave less room for TCP than the endpoints assume.
7. Click Save. The Abilis starts PPPoE discovery on the Ethernet port; once the Access Concentrator responds and PPP authentication succeeds, the resource comes up with its assigned address.
8. Add a default route through the new WAN — see Configure the default IP route. Its gateway should be OUT-IP so the route follows whichever address the ISP assigns on each session.
9. Verify on Networking > Info. The new WAN resource should show a green status icon and the ISP-assigned address. Open a browser on the LAN and load a public site to confirm internet is reachable.

Connect to the internet with a fixed public IP (static WAN)

Goal: Your ISP has assigned you a fixed public IP address on an Ethernet DSL/fibre modem. There is no login — the Abilis just needs to sit on the WAN link with the address you were given.

What you need: the public IP address and subnet mask from your ISP, and the VLAN ID if the operator requires tagging on the line.

1. Connect the modem to a free Ethernet port on the Abilis.
2. Go to Networking > Settings > Ports.
3. Click New +.
   • Resource: a free IP slot (e.g. Ip-3).
   • Subtype: LAN (IP over LAN — used for any Ethernet-based connection, WAN or LAN).
   • Lower resource: the Ethernet port connected to the modem (e.g. Eth-2).
4. Click Save.
5. On the IP resource panel, configure:
   • Tick Manual IP Address.
   • IP Address: the public IP your ISP gave you (e.g. 80.80.80.80).
   • Mask: the subnet mask (often 255.255.255.255 for a /32 point-to-point, or whatever the ISP specified).
   • Description: something clear, e.g. WAN_fibre.
   • NAT: OUTSIDE.
   • (If required) VLAN ID: the tag number from the operator.
6. Click Save.
7. Add a default route through this line — see Configure the default IP route. If the ISP's equipment is a router rather than a bridged modem, also set the Gateway field to the router's LAN-side IP.
8. Verify at Networking > Info — the port should go green.

Run several networks through one Ethernet cable (VLANs)

Goal: Carry two or more separate IP networks over the same physical Ethernet cable — for example a management network and a guest network, or several tagged networks coming from an upstream switch. Each network will appear on the Abilis as its own IP resource with its own address, NAT side, firewall rules, and traffic statistics.

How the Abilis represents VLANs: there is no dedicated VLAN page. VLAN is a property of each IP resource, set inside the resource's configuration panel. To carry three VLANs on one cable you create three IP resources, all pointing at the same Ethernet port as their Lower Resource, each with a different VLAN ID.

Hardware requirement: the Ethernet port the cable plugs into must support VLAN tagging. Gigabit NICs typically do; some older 100 Mbit/s ports do not. If the port does not support tagging, the configuration will refuse to save — the error tells you to try a different port.

Step 1 — Open the Ethernet port and enable multiple VLANs on it

By default an Ethernet port is configured to carry a single untagged network. To carry tagged VLANs on top of that, the port's tag capacity has to be raised first.

1. Go to Networking > Settings > Ports.
2. Open the row for the Ethernet port you plan to share (e.g. Eth-2). Its configuration panel opens on the right.
3. Tick Advanced at the top of the panel to reveal the full set of fields, and raise the tag capacity to cover the number of tagged VLANs you intend to carry on this port — for four VLANs on top of the native one, four is enough.
4. Click Save. A system restart is required for the port to pick up the new capacity.

Step 2 — Add one IP resource per VLAN

1. Still on Networking > Settings > Ports, click New +.
2. In the add-resource dialog, pick a free IP slot (e.g. Ip-3) and choose the LAN subtype — the most common case, where the VLAN carries an ordinary routed LAN segment.
3. Click Save. The new resource's configuration panel opens.
4. Set the basics:
   • Description: a clear label, e.g. Lan_voip, Lan_guest, Lan_mgmt.
   • Lower Resource: the Ethernet port from Step 1 (e.g. Eth-2). This binds the VLAN to that physical cable.
5. Expand IP Address Settings, tick Manual IP Address, and fill in the address and mask the Abilis will hold on this VLAN. Leave the gateway at 0.0.0.0 on a LAN-side VLAN — the gateway is only set on a WAN resource that has an upstream next-hop.
6. Expand VLAN Settings and enter the VLAN tag (the 1–4094 number configured on the upstream switch). Leave the setting at its default only if this resource is meant to carry the untagged (native) VLAN on the port.
7. Set Network Address Translation (NAT):
   • INSIDE — LAN-side traffic; NAT will happen on the WAN resource it eventually egresses through.
   • OUTSIDE — WAN-side segment (rare for a VLAN on a LAN-side cable).
   • NO — no NAT (for routed segments between trusted sites).
8. Click Save.
9. Repeat steps 1–8 for each additional VLAN on the same Ethernet port. All the new resources share the same Lower Resource (Eth-2), each with its own VLAN ID.

Set up a guest network with limited internet access (worked example)

Goal: You want visitors — customers in a waiting room, contractors, someone's relatives at the villa — to get internet without being on your business LAN. Guests should reach the internet, nothing on your internal network, and not be able to saturate your line.

This is a worked example that ties several how-tos together. Each step points at the focused how-to for the detail.

1. Add a guest IP resource on a VLAN. Pick a VLAN tag not used elsewhere (e.g. 100) and a fresh subnet for the guests (e.g. 192.168.100.0/24). Follow Run several networks through one Ethernet cable (VLANs) to create the VLAN, and give the new resource a clear description like Lan_guest. Set NAT zone to INSIDE.
2. Give the guest VLAN its own DHCP pool. On the new resource, follow Set up the DHCP server. The pool comes from the guest subnet automatically. Use an external DNS (e.g. 8.8.8.8) if you don't want guests to use the Abilis DNS — that keeps your DNS filtering rules out of their way, or applies them only to staff.
3. Restrict what guests can reach. Go to Set up firewall rules (Access Control Lists) and add two rules at a high priority:
   • Deny source 192.168.100.0/24 → destination the business LAN (e.g. 192.168.1.0/24). This blocks guests from reaching any internal host.
   • Permit source 192.168.100.0/24 → destination any. This allows them out to the internet.
   The order matters: the deny rule must be evaluated first (lower priority number).
4. Cap the bandwidth. Follow Cap bandwidth per IP address or subnet (IP Shaping) to limit the whole guest subnet to, say, 30% of your WAN capacity. Guests stay usable for web and video calls; they can't starve the business traffic.
5. (Optional) Block business-hours access. If the guest network should only be live when the office is closed (or vice versa), add an ACL rule with a time condition. This is supported directly in the ACL rule editor.
6. Plug the guest VLAN into the switch — either a dedicated port tagged with VLAN 100, or a WiFi SSID that the access point maps to VLAN 100. From the guest's point of view, this is an ordinary internet connection; they have no visibility into your business network.

Configure the default IP route

Goal: Tells the Abilis where to send traffic that isn't destined for the local network. Without a default route, the Abilis can talk to LAN devices but nothing beyond: no websites, no email, no VPN.

Analogy: Routing is like road signs. The default route is the sign that says "for everything else, take this highway."

1. Go to Networking > Settings > Routings.



2. Look for a route with destination any and gateway OUT-IP — that is the default route. It tells the Abilis "for any traffic not going to a local network, send it out through this WAN port."
3. If it exists, verify the Output port column shows the correct WAN interface (e.g. Ip-5) and the status icon is green.
4. If it doesn't exist, click New +:
   • Destination: any (meaning "all traffic not matched by a more specific route")
   • Source: any
   • Gateway: OUT-IP (the Abilis resolves this to the public address of the selected WAN port)
   • Output port: select the IP resource that connects to the internet (e.g. Ip-5 for an FTTC line, or Ip-3 for a backup LTE modem)
5. Click Save.

Add a backup default route (two WAN lines, automatic failover)

Goal: You have two WAN lines — a primary (e.g. fibre) and a backup (e.g. a second DSL or LTE line) — and you want the Abilis to send all internet traffic through the primary, and only switch to the backup if the primary fails.

How it works: you add a second default route with a higher metric. The Abilis always prefers the route with the lowest metric. The backup route stays dormant until the primary goes down, then takes over automatically, then hands back when the primary recovers.

1. Make sure both WAN lines are configured and appear green in Networking > Info.
2. Go to Networking > Settings > Routings.



3. Confirm the existing default route (destination any) points to the primary WAN port and note its metric (usually 1).
4. Click New + and add the backup default route:
   • Destination: any
   • Source: any
   • Gateway: OUT-IP
   • Output port: the backup WAN port (e.g. your LTE port).
   • Metric: a value much higher than the primary (e.g. 180).
5. Click Save. Both routes now appear in the table — the primary active, the backup dormant.

Set up the DHCP server

Goal: Makes the Abilis automatically hand out IP addresses to every device that connects. Without DHCP you'd need to manually configure an IP on every computer, phone, and printer.

1. Go to Networking > Settings > DHCP.
2. On a fresh system you see "DHCP protocol table" with a Disabled checkbox. Click on it.



3. A dialog opens titled Ip-1 | Lan_for_Ip-1 with three tabs: Settings, Manually assigned addresses, Automatically assigned addresses.
4. On Settings:

   

   • DHCP Mode: Server.
   • Pool: AUTO — the Abilis automatically calculates the address range from the IP resource's subnet. For a LAN on 192.168.001.000/24, the pool covers all available addresses in that subnet. You can also enter a specific starting address if you need to limit the range.
   • Leave Advanced DHCP options unchecked unless you have specific needs.
5. Under Profile:
   • Primary Gateway: Ip-1 — tells devices "the Abilis is your gateway."
   • Primary DNS: Ip-1 — tells devices "use the Abilis for DNS" (enables caching and filtering).
   • Secondary DNS: # (none), or a fallback like 8.8.4.4.
6. Click Save.

Reserving a fixed address

for a device

Devices like printers or cameras should always have the same IP. Use manual assignment instead of configuring a static IP on the device itself.

1. In the DHCP dialog, go to the Manually assigned addresses tab.
2. Click Add manual DHCP record +.
3. Enter the device's MAC address and the IP address you want to reserve.
4. Click Save.

Forward DHCP requests to an existing DHCP server (relay mode)

Goal: You already have a DHCP server somewhere on your network (a Windows server, a central appliance, a different router) and you want the Abilis to pass DHCP requests from its LAN through to that server instead of answering them itself. The server keeps control of address assignments; the Abilis just passes messages back and forth.

Why use it: centralised control of addresses across many sites, or reservations configured on an existing corporate DHCP server that the Abilis shouldn't override.

1. Note the IP address of the existing DHCP server (for example 192.168.1.250) — you will enter it in step 5.
2. Go to Networking > Settings > DHCP.
3. If DHCP is disabled, click the Disabled checkbox to enable it. The DHCP configuration dialog opens.



4. On the Settings tab, set DHCP Mode to Relay.
5. In the DHCP Server field, enter the IP address of your existing DHCP server.
6. Click Save.
7. Test — connect a computer to the Abilis LAN. It should receive an address from the upstream DHCP server, not from the Abilis itself. In Networking > Info you can check the DHCP log to see the relayed requests.

Enable NAT to share one internet connection

Goal: Lets all devices on your LAN share a single internet connection. Without NAT, only the Abilis itself could access the internet.

How it works: When your PC requests a webpage, the Abilis rewrites the request so it appears to come from its own public IP. When the reply arrives, the Abilis forwards it back to your PC. The outside world only ever sees the Abilis's address.

The NAT table at Networking > Settings > NAT has these columns:

Typical setup: two rules

Adding a Source NAT rule

This example creates rule #1 from the default setup — the rule that gives all LAN devices internet access.

1. Go to Networking > Settings > NAT, click New +.
2. Fill in:
   • Priority: 1 (after the DNS redirect rule at priority 0)
   • Translation Type: Source
   • Inbound NAT Zone: INSIDE
   • Outbound NAT Zone: OUTSIDE
   • Pre-NAT Source Address: Ip-1 (your LAN resource — this means "any traffic coming from the LAN")
   • Pre-NAT Destination Address: * (any destination)
   • Post-NAT Address: OUT-IP (the Abilis's public address on the WAN side)
   • Post-NAT Address Port: AUTO
   • Source / Destination IP Resource: *
   • Translation Timeout: SYS (use system default)
3. Click Save.

Apply NAT (or a firewall rule) to a list of addresses

Goal: Instead of writing a separate NAT or ACL rule for each subnet or host, define the group of addresses once as a List, then have one rule reference the list. When the list changes, every rule that uses it updates automatically.

Typical use cases: "NAT only the corporate LAN, not the guest VLAN"; "block all traffic from this known-bad set of IPs"; "allow SSH only from the office subnets". In each case the rule stays tidy and the list can be edited on its own.

1. Create the list. Go to Tools > Lists.



2. Click Add a new list + and fill in:
   • Name: a short identifier (e.g. corp_hosts).
   • Type: TUPR — tuple, holds IP addresses and subnets.
   • Description: short reminder of what the list contains.
3. Click Save, then open the new list and add the entries — one line per IP, range, or subnet (e.g. 192.168.094.000/24).
4. Now reference the list in a NAT rule. Go to Networking > Settings > NAT and click New +.
5. In the source or destination address field, instead of typing a single IP, pick the list you just created (entry format list:corp_hosts).
6. Fill in the rest of the NAT rule as normal — translation type, post-NAT address, direction — and click Save.

Open a port to reach an internal device from outside (port forwarding)

Goal: Makes a device on your LAN accessible from the internet. Example: your camera at 192.168.1.50:80 becomes reachable at your-public-ip:8080.

1. Go to Networking > Settings > NAT, click New +.
2. Set Translation Type: Destination.
3. Tick Port Address Translation.
4. Set Pre-NAT Destination Address Port: the external port (e.g. 8080).
5. Set Post-NAT Address: the internal device IP (e.g. 192.168.001.050).
6. Set Post-NAT Address Port: the internal port (e.g. 80).
7. Click Save.

Configure DNS settings

Goal: Controls how the Abilis resolves domain names into IP addresses. The Abilis can act as a DNS server for your whole network, caching results and enabling filtering.

1. Go to Networking > Settings > DNS.
2. Make sure Enabled is ticked.
3. Under DNS Choice:

   

   • Tick "Use exclusively the Primary and Secondary servers" (recommended).
   • Primary DNS: e.g. 8.8.8.8 (Google) or your ISP's DNS, or a local server.
   • Secondary DNS: e.g. 8.8.4.4 as fallback.
4. Use DNS Cache — leave ticked. Default Size: 500 entries is fine. Click DNS Cache Table to see what's currently cached.
5. Use as Private DNS Solver (DNS Server) — tick only if you need local DNS records (e.g. printer.office).
6. Use as Public DNS Solver (DNS Relay) — tick this so the Abilis answers DNS queries from LAN devices. This is the standard setting.
7. Click Apply Changes.

Block unwanted websites with DNS filtering

Goal: Prevents devices from accessing specific websites by blocking them at the DNS level. When a device tries to visit a banned domain, the Abilis refuses to resolve the name.

How it actually works: This is not a simple category checkbox system. It's a blacklist/whitelist system that you manage through domain lists.

1. Go to Administration > DNS filtering.
2. Two tabs: DNS Blacklist and DNS Whitelist.
3. The DNS Blacklist page shows:

   

   • Two list references at the top:
     • DNSLogExclude — IPs in this list are filtered but their lookups are not logged.
     • DNSBlackBypass — IPs in this list are completely exempt from filtering.
   • A Resolved Domains log: live table of Requestor (IP), Resolved Domain, and Timestamp — showing what your network is accessing right now.
   • A Banned domain » button to add domains to the blacklist.
   • A ban icon next to each entry in the log — click to block that domain instantly.
   • Clear list of resolved domains button to wipe the log.
4. To block a domain: find it in the Resolved Domains log and click the ban icon, or click Banned domain » and type it manually.
5. To manage the bypass/exclude lists, go to Tools > Lists.

Redirect all DNS requests through the Abilis

Goal: Forces every DNS request on your network through the Abilis, even from devices with a different DNS configured (like 8.8.8.8). Without this rule, a device can bypass your DNS filtering simply by using Google DNS.

1. Go to Networking > Settings > NAT.
2. Check if a DNS redirect rule already exists (look for a Destination rule with port 53 and 'ToDNS').
3. If not, click New +:
   • Description: Redirect DNS through Abilis

   

   • Translation Type: Destination
   • Tick Port Address Translation
   • Pre-NAT Source Address Port: 53
   • Pre-NAT Destination Address Port: 53
   • Leave other fields as defaults.
4. Click Save.

Set up firewall rules (Access Control Lists)

Goal: Controls which traffic is allowed and which is blocked. Rules are checked top to bottom by Priority number — first match wins.

The ACL table at Networking > Settings > ACL:

Adding a rule

1. Go to Networking > Settings > ACL, click New +.
2. Fill in:
   • Priority: lower = checked first.
   • Description: e.g. "Deny Blacklisted".
   • Access List Type: Deny or Allow.
   • Source IP Addresses Range: an IP, range, or list name in quotes (e.g. 'blackip').
   • Destination IP Addresses Range: same format (e.g. 'drop').
   • Protocol: * for all, or TCP/UDP/ICMP.
   • Source or Destination Ports: a port list name (e.g. 'firewall').
   • IP Class of Service: Default.
   • Time Interval: * = always. Can schedule rules for specific hours.
3. Click Save.

Block traffic between two internal subnets

Goal: Two internal networks are both attached to the Abilis — for example, an office LAN and a separate CCTV-cameras subnet, or a production network and a management network. They should reach the internet, but they should not reach each other. A compromised camera must not be able to scan the office.

Unlike NAT or firewall-to-WAN rules, this is strictly internal — LAN-to-LAN isolation enforced by the Abilis's ACL as it routes between the two subnets.

1. Confirm both subnets are configured — each with its own IP resource and LAN setup. See Configure LAN settings for each side.
2. Go to Networking > Settings > ACL.
3. Click New + and add the deny rule:
   • Priority: low number (so the rule is evaluated before any general permit).
   • Action: deny.
   • Source: subnet A (e.g. 192.168.10.0/24 — the office).
   • Destination: subnet B (e.g. 192.168.20.0/24 — cameras).
   • Protocol: any.
   • Description: Block office → cameras.
4. If the block needs to be bidirectional (cameras also can't reach office), add a second rule mirroring source and destination.
5. Click Save. ACL rules take effect immediately.
6. Test — from a host on subnet A, try to ping a device on subnet B. It should fail. Internet access from both sides should still work (no NAT rules were changed).

Send specific traffic down a specific line (Policy-Based Routing)

Goal: You have two WAN lines and want certain traffic to always go out through a specific one — for example, all VoIP traffic through the fibre line (low latency), everything else through the LTE backup. Normal routing only looks at the destination; policy-based routing can decide based on source, protocol, and ports.

1. Identify the traffic you want to redirect — for example: LAN host 192.168.1.50, UDP, destination port 5060 (SIP).
2. Identify the WAN line you want that traffic to use — for example Ip-5 (fibre).
3. Go to Networking > Settings > ACL.



4. Click New +. Configure:
   • Action: permit (PBR rules permit and redirect — a deny rule just blocks).
   • Priority: a number that places this rule above any general permit-all rules.
   • Source: the LAN host, network, or list.
   • Destination: usually any, or a specific network.
   • Protocol / Ports: e.g. UDP 5060 for SIP, UDP 10000–20000 for RTP, TCP 443 for HTTPS.
   • Output resource: the WAN port the matching traffic should leave through (e.g. Ip-5).
5. Click Save. ACL rules take effect immediately — no restart needed.
6. Test — send traffic that matches the rule. You can confirm the path it takes at Networking > Info by watching the Line Load on the chosen output port. If you have it, Tools > IP Flow Tracer shows the exact route each packet follows.

Set up a VPN tunnel between two Abilis devices (AIPT2)

Goal: Creates a secure encrypted connection between two Abilis units. Devices at both sites can communicate directly across the internet — as if connected by a virtual cable.

A tunnel always has two sides: one Abilis acts as the server, the other as the client. Both sides must be configured with matching parameters. Below is the full walkthrough.

Step 1 — Create a new AIPT2 resource

1. Go to Networking > Settings > Ports.



2. Click New +. The "Add new resource" dialog opens.



3. Set:
   • Resource: select an available IP resource (e.g. Ip-8).
   • Subtype: AIPT2.
4. Click Save. The tunnel configuration panel opens.

Step 2 — Configure the tunnel

The configuration panel has these sections:

Tunnel identity

Field	What to set
Tunnel side	client or server. One Abilis must be the server, the other the client.
The tunnel uses IP port / name	Automatically filled from the resource you created (e.g. Ip-8).
This tunnel is served on UDP port	Default: 4008. Must match on both sides.
Remote end UDP port	# means same as local. Set a specific port if the remote side uses a different one.

Purpose

Connection treatment type tells the Abilis what kind of traffic will flow through the tunnel, so it can optimise accordingly:

Neighbour Router — the IP address and subnet mask of the remote Abilis's LAN. In the example diagram: the server has LAN 192.168.0.0/24, the client has LAN 192.168.1.0/24.

WAN Paths

A WAN path defines which internet connection the tunnel uses to reach the remote Abilis. You can add up to 6 paths for redundancy.

• auto port selection — the Abilis chooses the best available WAN port automatically.
• Or select a specific port (e.g. Ip-5 for fibre, Ip-7 for LTE).
• Connects to → Remote IP Address — the public IP of the remote Abilis. Enter # if using auto-discovery.
• Click Add Wan path to add a backup path.

Authentication methods

Choose how the two Abilis units verify each other's identity:

• Password based authentication — both sides share the same password.
• Appliance ID based authentication — uses the unique serial number of each Abilis unit. More secure, no password to manage.

Step 3 — Advanced parameters

Click Expand advanced parameters (top right) to access three sections:

Packet handling, redundancy, and fallback

Advanced routing

• Export route to routing table automatically (REDIS) — when ticked, the Abilis automatically adds a route to the remote LAN through this tunnel. Set to destination route so traffic to the remote subnet is sent through the tunnel without manual routing rules.
• Traffic shaping — output speed limitation — cap the tunnel's bandwidth (in Kbit/s). Useful if you want to reserve bandwidth for other services.

Monitoring and Logging

• State change handling — what happens when the tunnel goes up or down:
  • System Log — write to the control port log.
  • SNMP service (Traps) — send an SNMP trap to a monitoring system.
• Export events to alert channel — trigger an alert (SMS, email, call, digital output) when the tunnel changes state. Select the channel number from Tools > Alert Manager.
• TRFA Traffic Analysis — Network charts — enable traffic statistics for this tunnel, visible in Phone > Statistics.

Step 4 — Save and verify

1. Click Save to apply the configuration.
2. Repeat the same process on the remote Abilis, setting it as the opposite side (if this one is client, the remote must be server). The UDP port, authentication, and neighbour settings must match.
3. Go to Networking > Info, expand VPN Connections.
4. The VPN matrix shows colour-coded quality bars for each tunnel across time windows (5 sec, 1 min, 15 min, 1 hour).
5. Colours: green = healthy, yellow = fair, orange = degraded, red = almost unusable, black = down, grey = inactive.
6. Click a connection name to see Line Load (bandwidth graph) and Top 5 (who's using it).

Give a VPN tunnel a second path for redundancy

Goal: You have two WAN lines at each site, and you want your AIPT2 VPN tunnel to keep working even if one of the WAN lines fails. The tunnel uses both paths for resilience — if the primary drops, traffic carries on over the backup without the call or session breaking.

Prerequisite: the basic tunnel is already working between the two Abilis — if not, configure it first via Set up a VPN tunnel between two Abilis devices (AIPT2).

1. Open the tunnel on the first Abilis: go to Networking > Settings > Ports and click the AIPT2 IP resource (e.g. Ip-8).
2. Scroll to the WAN Paths section.



3. Click Add Wan path. A new row appears.
   • Port: select the second WAN interface (e.g. the LTE port, Ip-7). The first row should already point at the primary WAN.
   • Connects to → Remote IP Address: the public IP the remote Abilis uses on its second WAN line. If auto-discovery is in use, leave #.
4. Expand advanced parameters (top right). Under Packet handling, redundancy, and fallback:
   • Confirm Bandwidth on demand using backup paths is ticked — the tunnel will activate the second path automatically when the primary cannot carry all the traffic or goes down.
   • For lines of similar speed you can also tick Forward Error Correction (FEC) to reduce packet loss on unstable links. FEC sends a small amount of controlled redundant data with every transmission, so the receiver can reconstruct lost packets without waiting for a retransmission — the same principle RAID uses for disk redundancy, applied to network traffic. Worth the bandwidth cost for voice, remote-control signalling, and any flow where retransmission delays would break the experience.
5. Click Save.
6. Repeat on the second Abilis — add its own second WAN path with the matching remote IP from the first Abilis. The two configurations mirror each other.
7. Verify at Networking > Info > VPN Connections — both paths should show traffic under the tunnel entry.

Protect against brute-force attacks (IP Ban)

Goal: Automatically blocks IP addresses that repeatedly fail to log in. The IP Ban agent is always active — you don't enable it, you configure its sensitivity.

Viewing ban status

1. Go to Networking > Info, scroll to IP Ban.



2. The header shows: "Banned X attackers responsible for Y malicious trials".
3. Expand it to see banned IPs and two buttons:

   

   • Unban Addresses — manually remove a ban (if you locked yourself out).
   • IP Ban Settings — configure thresholds.

Configuring thresholds

1. Click IP Ban Settings. The Preferences dialog opens.



2. Configure:
   • Ban hosts after 10 unsuccessful trials
   • Within an interval of 60 minutes — 10 failed attempts from the same IP within 1 hour triggers a ban.
   • Ban hosts for 10080 minutes (= 7 days)
   • Send an alert if the table capacity reaches 80%

     

     — tick to get warned when the ban list is filling up. Choose alert channel:
     • 1 - Sends e-mail
     • 2 - Sends SMS
     • 3 - Sends call
     • 4 - Turns on DO (digital output)
   • Ban table capacity: 3000 — max simultaneous bans. Changing this requires a reboot.
3. Click Save and apply all changes.

Get notified when a new device appears on your network

Goal: The Abilis continuously scans your LAN for devices using ARP. You can see every connected device and set up alerts for unknown ones.

Viewing connected devices

1. Go to Networking > Info > LAN Connections > ARP Monitor.



2. Three sub-tabs:
   • Monitored — devices you are watching. Columns: Port, IP Address, MAC Address, Vendor, Description, State (green tick = up, red cross = down), Since, Max down (sec). Edit/delete buttons on each row.
   • All Hosts — every device ever seen on the network.
   • Unknown Hosts — devices not in your monitored list. Each row has + Add To Monitor.

Setting up alerts

1. Click New Host Alert (top right).



2. Choose alert channel: No, 1-Email, 2-SMS, 3-Call, 4-Digital Output.
3. Click Save.

Adding a device to monitoring

1. Either click + Add To Monitor on an Unknown Host, or click New + to enter details manually.
2. Set IP, MAC, description, and monitoring parameters.
3. Click Save.

Monitor network devices with SNMP

Goal: Lets you watch specific services on network devices (switches, printers, servers) and get alerted when they go down. The Abilis periodically asks "are you alive?" and raises an alarm if the answer stops coming.

1. Go to Networking > Info > LAN Connections > SNMP Monitor.
2. Click New +.
3. Fill in:

   

   • Name of the observed service: a label (e.g. PC2, PrinterOffice).
   • SNMP version: 1 is simplest. Use 2c or 3 if the device requires it.
   • SNMP community: the shared passphrase — usually public (read-only). Must match the device.
   • Max GetRequest retries: how many times to retry if no response (0 = no retries).
   • UDP port: 161 (standard SNMP port).
   • Client role: Passive (Host can only answer to GET requests) — the safe default.
   • Identifier: the SNMP OID to check. 1.3.6.1.2.1.1.3.0 = system uptime — a universal health check.
   • Send alert on channel: same options (email, SMS, call, digital output).
   • Max tolerated down time: seconds before alert fires (e.g. 60).
4. Click Submit.

Access your own public services from inside the network (NAT loopback)

Goal: Fixes a common problem — you've set up port forwarding so your camera is accessible at myoffice.ddns.net:8080 from the internet. It works from home. But from inside the office, the same address doesn't work.

Why: Your PC sends the request to the Abilis's public IP. The Abilis sees it came from inside the LAN but is addressed to the outside — it doesn't know to redirect it internally.

When you need it: Only if internal devices need to use the public IP or domain name. If everyone inside uses the device's internal IP directly (e.g. 192.168.1.50), you don't need this.

1. Go to Networking > Settings > NAT, click New +.
2. Fill in:
   • Description: NAT loopback
   • Translation Type: Source
   • Inbound NAT Zone: INSIDE
   • Outbound NAT Zone: INSIDE
   • Pre-NAT Source Address: 000.000.000.000/32 (any source)
   • Pre-NAT Destination Address: *
   • Post-NAT Address: the Abilis LAN IP with subnet (e.g. 192.168.1.1/24)
   • Post-NAT Address Port: AUTO
3. Click Save.

Activate traffic analysis (TRFA)

Goal: Enables bandwidth monitoring on a network port so you can see Line Load graphs and Top 5 usage charts for that connection.

TRFA is enabled per port — you choose which connections you want to monitor.

1. Go to Networking > Settings > Ports.
2. Click on the port you want to monitor (e.g. your WAN port).
3. Tick Advanced to see all options.
4. Scroll down to Traffic Analysis (TRFA) and tick the checkbox to enable it.
5. Set the Trfa Mode to choose the level of detail:

6. Click Save.
7. Repeat for any other ports you want to monitor.

View traffic analysis (Line Load and Top 5)

Goal: See how much bandwidth each connection is using right now and which devices on your network are consuming the most traffic.

1. Go to Networking → Info. Click on any connection (e.g. Lan_locale).
2. You'll see two tabs at the top: Line Load and Top 5.
3. Line Load — a real-time throughput graph showing how much data is flowing through the connection over time. Use the dropdowns to select the resource and timespan (Realtime, Day, Week).

   

4. Top 5 — four pie charts showing which devices and remote hosts are using the most bandwidth. The grey outer circle represents the full capacity; coloured slices show each device's share.

   

5. You can Export to CSV from the Line Load view for reporting or analysis in Excel.

Set up Dynamic DNS

Goal: Gives your Abilis a fixed name (like myoffice.ddns.net) that always points to your current public IP, even when it changes.

DDNS has two parts: the DDNS service (provider credentials) is configured via the Abilis control program (CLI) as a one-time setup, but the domain name binding is managed through the web interface.

Assign a DDNS hostname to a WAN port

1. Go to Networking > Settings > Ports.
2. Click on the WAN port that connects to the internet (e.g. your fibre or LTE port).
3. Scroll down to Dynamic Domain Name Service (DDNS).
4. Tick the DDNS checkbox to enable it.
5. In the DDNS domain name field, enter the hostname you registered with your DDNS provider (e.g. myoffice.no-ip.org).

6. Click Save.

Set up LTE as a backup internet connection (automatic failover)

Goal: If your main connection drops, the Abilis switches to LTE automatically.

How it works: Two default routes with different metrics in the Routings table. Lower metric = higher priority. The Abilis monitors both and switches automatically.

How it works: Two default routes with different metrics in the Routings table. Lower metric = higher priority. The Abilis monitors both and switches automatically.

1. Go to Networking > Settings > Routings.
2. You should see your primary default route (destination: any, pointing to your fibre/DSL port). Note its metric value.
3. Click New + to create a second default route:
   • Destination: any
   • Source: any
   • Gateway: OUT-IP
   • Output port: your LTE port (e.g. Ip-216)
   • Metric: a higher number than the primary route (higher metric = lower priority, so this route is only used when the primary fails)
4. Click Save.
5. Verify at Networking > Info — you should see both connections, with the primary showing a green status icon and the backup ready to take over.

Monitor a voice tunnel between two Abilis

Goal: A voice tunnel carries phone calls between two Abilis sites. Extensions at Site A can call Site B as internal calls.

1. Go to Networking > Info. Click on the voice connection (e.g. "VoIP_smartphones").
2. Line Load shows a throughput graph. Select the resource (e.g. VoIP_smartphones Ip-4) and timespan.
3. Green line = bandwidth usage. Flat near zero = no active calls; spikes = call traffic.
4. Click Export to CSV for reporting.

Check the state of network interfaces

Goal: You want a quick overview of all your network connections — which ones are working, which ones are down, and whether the Abilis is connected to the internet. This is the first thing to check when something isn't working.

1. Go to Networking → Overview. Click the Networking icon in the sidebar. The Overview page loads automatically.
2. Read the status indicators. Each connection is shown as a pill-shaped button with a coloured icon:

   Icon	What it means
   Green (happy face)	Connection is up and working normally.
   Dark/grey icon	Connection is configured but not currently active — it may be intentionally disabled, standing by as a backup, or misconfigured.

3. Click on any connection to see its detail page, including Line Load graphs (how much bandwidth is being used) and Top 5 traffic sources.

Limit bandwidth on a connection (traffic shaping)

Goal: Caps the bandwidth on a connection to prevent it from consuming all available capacity, reserving room for other services (e.g. phone calls, VPN).

1. Go to Networking > Settings > Ports.
2. Click on the port you want to limit (e.g. a WAN or tunnel port).
3. Tick Advanced to see all options.
4. Scroll to Traffic Shaping and expand it.
5. Set Output speed limitation to YES.
6. Set the Output speed limitation value in Kbit/s (e.g. 1000 for 1 Mbit/s).

7. Click Save.

Cap bandwidth per IP address or subnet (IP Shaping)

Goal: One device or one department is saturating the internet line — a backup job, a single heavy downloader, a guest VLAN hogging everything. Rather than limit the whole WAN port (see traffic shaping for that), you want to cap specific hosts or networks so everyone else keeps their share.

1. Identify who to limit — the offending IP, a list of IPs, or a subnet (e.g. the guest VLAN 192.168.100.0/24).
2. Go to Networking > Settings > IP Shaping.
3. Click New + and configure the rule:
   • Source: the IP, subnet, or a list of addresses to limit.
   • Destination: usually any (limit them for all traffic), or a specific destination if you only care about one direction.
   • Max rate: the cap in Kbit/s (e.g. 2000 for 2 Mbit/s).
   • Direction: download, upload, or both. For a heavy downloader, capping download is usually enough.
4. Click Save. The rule takes effect immediately — no restart.
5. Verify at Networking > Info — the affected IP's Line Load will flatten at the rate you set.

Worked example: machine-to-machine bottleneck

A concrete case Lino described, common in small industrial and office installations:

The situation. A 100 Mbit/s internet line serves a small office. One of the hosts on the LAN is an industrial PC that periodically uploads large telemetry or backup files to a supplier's server over the internet — unattended, machine-to-machine, no human noticing. When an upload runs, the line saturates: the VPN to the other site stutters, video calls freeze, the cameras' remote viewers lose frames. The upload itself doesn't need to be fast — it runs overnight by design — but nothing else works while it does.

The fix. Cap only that machine's outbound rate. Everyone else keeps full access to the line. The upload still completes (just over a longer window); the other services stay smooth throughout.

1. Identify the machine by its static IP — for example 192.168.1.50. If it doesn't have a fixed address yet, reserve one first via Set up the DHCP server so the shaping rule keeps targeting the right host.
2. Decide the cap. For the 100 Mbit/s line in this example, reserving 80 Mbit/s for everything else leaves 20 Mbit/s for the industrial PC — enough to upload several gigabytes overnight without noticeable impact on anyone else. Express the cap in Kbit/s: 20000 for 20 Mbit/s.
3. Go to Networking > Settings > IP Shaping and click New +.
4. Configure the rule:
   • Source: 192.168.1.50 — only this host.
   • Destination: any.
   • Direction: upload. The uploads are the problem; incoming traffic on this host is negligible.
   • Max rate: 20000 Kbit/s.
   • Description: industrial_PC upload cap.
5. Click Save.
6. Verify: when the next upload runs, open Networking > Info and select the WAN port. The Line Load graph should show a flat plateau at ~20 Mbit/s rather than the previous spike to line rate. Meanwhile the VPN tunnel and voice traffic stay smooth — the other 80 Mbit/s is there for them.

Restart a connection (WAN, VPN, tunnel)

Goal: One of your network connections is stuck — a WAN line, a VPN tunnel, or an LTE uplink — but the Abilis itself is still reachable. You want to recycle just that one resource without rebooting the whole appliance.

How it works: There is no dedicated Restart or Reconnect button. The Abilis restarts a connection by deactivating the resource, saving the change, then reactivating it — the resource is torn down and rebuilt cleanly.

1. Go to Networking > Settings > Ports and open the resource you want to restart (e.g. Ip-40, Ip-4 VoIP_smartphones, an LTE port).
2. At the top of the resource panel, untick Active.
3. Click Save. The resource goes down — its status icon changes and its traffic stops.
4. Wait a few seconds, then tick Active again and click Save. The resource comes back up and re-establishes its connection.
5. Check the result on Networking > Info — the status icon for the resource should return to green within 30–60 seconds for a normal WAN, or up to a couple of minutes for an LTE modem that has to re-register on the mobile network.

Internet is not working — what to check first

Goal: A user reports "the internet is down." Before calling support, you can quickly check a few things from the Abilis web interface to understand what's happening and possibly fix it yourself.

Step 1: Can you reach the Abilis?

Open your browser and go to the Abilis web address (usually https://192.168.0.1). If the Abilis login page appears, the Abilis itself is fine — the problem is between the Abilis and the internet. Continue to Step 2. If you can't reach the Abilis at all, the problem is on your local network (cable unplugged, WiFi down, wrong IP address on your computer).

Step 2: Check the connection status

Go to Networking → Overview. Look at the status icons:

Step 3: Check if it's just one computer

Ask another user on a different computer to try. If only one computer has the problem, the issue is with that specific computer (its network cable, WiFi connection, or local settings) — not with the Abilis.

Step 4: If nothing helps

If you've checked all of the above and the problem persists, gather the following information before contacting support:

Send this information to tem@antek.it or call +39 0376 16262,27. This saves time because the support engineer won't need to ask you for it.