Synology Router RT2600ac User Manual

							 11 Chapter 3: Set up Your Wi-Fi Connection
This chapter introduces how to create Wi-Fi networks hosted by your Syno\
logy Router. Two types of Wi-Fi 
networks can be created: 2.4GHz and 5GHz.
• 2.4GHz: A 2.4GHz Wi-Fi network is used by most wireless devices and tends to have\
 broader signal coverage 
than a 5GHz Wi-Fi network. However, signal interference is likely to occur because most wireless devices r\
ely 
on this wireless frequency.
• 5GHz: The 5GHz band allows for potentially faster connection speeds and reduce\
d interference compared with 
the 2.4GHz band. However, the signal coverage is not as broad.
Enable Smart Connect
Smart Connect allows you to connect your devices to the combined SSID with the shared\
 Wi-Fi settings for both 
2.4GHz and 5GHz bands. SRM will determine whether to switch between the \
two frequency bands (i.e. 2.4GHz 
and 5GHz) according to your specified policy and network conditions to ensure the best wireless connectivity 
for your devices. Smart Connect does not switch between channels (e.g. \
1 and 10) within each band for your 
devices.
1 Go to Network Center > Wireless > Wi-Fi.
2 Turn on 2.4GHz/5GHz auto selection.
3 Specify the settings for the Smart Connect Wi-Fi network. Click Advanced options to make more adjustments.
4 Use your wireless device to scan and join the Wi-Fi network hosted by yo\
ur Synology Router.
Create Wi-Fi Networks (2.4GHz & 5GHz)
You can create a 2.4GHz or 5GHz Wi-Fi network:
1 Make sure your Synology Router is powered on and well-connected to the I\
nternet.
2 Make sure the Wi-Fi button is "ON" on your Synology Router.
3 Go to Network Center > Wireless > Wi-Fi.
4 Select Enable wireless radio under 5GHz/2.4GHz, and continue the setup. Click Advanced options to make 
more adjustments.
5 Use your wireless device to scan and join the Wi-Fi network hosted by yo\
ur Synology Router.
Create Guest Wi-Fi Networks (2.4GHz & 5GHz)
A guest Wi-Fi network allows visitors or non-regular users to securely ac\
cess the Internet without having access 
to the rest of your network devices. Guest networks can be isolated and \
set to be valid for only a certain amount 
of time. 
To set up a guest Wi-Fi network, go to Network Center > Wireless > Guest Network for the setup.
Set up Your Wi-Fi Connection
3
 11 
Chapter  
						

							 12 Chapter 3: Set up Your Wi-Fi Connection
Create WPS Networks (2.4GHz & 5GHz)
WPS (Wi-Fi Protected Setup) is a standard promoted by the Wi-Fi Alliance to simplify Wi-Fi security settings for 
users. Though the setup is quick, the WPS network may not be secure. To keep the WPS network safe, you can 
use a push button or a PIN code.
Three ways are available to quickly set up a Wi-Fi network via WPS:
By push button:
1 Go to Network Center > Wireless > WPS, and select Enable WPS. Alternatively, press the WPS button on 
your Synology Router.
2 Enable the WPS function on your wireless device. Your wireless device and the Synology Router will be paired 
up.
By AP PIN code:
1 Go to Network Center > Wireless > WPS > Device PIN > By AP PIN code, and click Enable to generate an 
AP PIN code.
2 Enter the generated PIN code into your wireless device. Your wireless device and the Synology Router will be 
paired up.
By client PIN code:
1 Enter the PIN code of your wireless device at Network Center > Wireless > WPS > Device PIN > By client 
PIN code.
2 Click Register. Your wireless device and the Synology Router will be paired up.
Note: Client iOS devices cannot join a WPS network because iOS does not suppo\
rt WPS.  
						

							 13 Chapter 4: Manage Client Devices
This chapter introduces various features to manage client devices.
Monitor Device Status
To monitor the real-time status of all client devices under your Synology\
 Router, go to Network Center > Status 
> Device List.
Apply Parental Control 
Parental Control allows you to control client devices' usage time for In\
ternet access and their ranges of accessible 
websites/domains.
General
At  Network Center > Parental Control > General, you can regulate each device's Internet access in the ways 
below:
• Web-filter: Apply a web-filter to the device to block access to certain malicious, inappropriate, and custom 
websites.
• Safe Search: Block inappropriate websites from the device's Google search results.
• Internet Allowed Time: Schedule the device's allowed time for Internet access.
Web-filters
With web-filters, you can create access policies for specific client devices, and determine their ranges of 
accessible websites/domains. Undesirable websites can be kept away from specific devices’  access.
To regulate devices’ Internet access to certain websites/domains, go to Network Center > Parental Control > 
Web-filter.
Note: The specified content under Allow access to custom websites will be applied to all client devices and has higher priority over the block list.
Manage Client Devices
4
 13 
Chapter  
						

							 14 Chapter 4: Manage Client Devices
Apply Traffic Control
At Network Center > Traffic Control, you can regulate client devices' individual network bandwidth. Several 
control mechanisms are offered to suit your needs:
• Beamforming: Beamforming enhances the Wi-Fi signal for client devices with poor sig\
nal strength. 
• Banned: Banned devices can only access devices and resources in the local netw\
ork.
• Custom Speed: You can specify the upper and lower limits of upload/download traffic for client devices.
• High Priority: Devices set to High Priority will have prioritized network bandwidth a\
llocation.
• Low Priority: Devices set to Low Priority will be allocated network bandwidth after \
High Priority and priority-
unmodified devices' bandwidth requirements have been satisfied.
For finer management, you can also regulate network usage of specific applications (e.g. SSL  or YouTube) 
running on certain devices.
Note:
1. The beamforming option is available to the RT1900ac model only.
2. The RT2600ac model performs beamforming by default and thus does not provide \
relevant options.
3. Beamforming requires 802.11ac compliant client devices.
4. Beamforming can be applied to up to six client devices at once; High Pri\
ority and Low Priority each can be applied to maximum three devices.
You can monitor the network usage history by device, by application, and \
by application category. To access the 
usage log, go to Network Center > Traffic Control > Monitor. You can identify the source of usage anomalies, 
such as malicious software websites, or devices that misuse network reso\
urces.
You can generate a reader-friendly traffic report that records the Synology Router's network traffic statistics to a 
specified email address. To set up the report task, go to Network Center > Traffic Control > Report.
Apply Wake-On-LAN
With Wake-On-LAN (WOL), you can remotely wake up the wired devices from shut\
down. Devices can be woken 
up via their MAC addresses or from the connection list.
If you have a Synology NAS (e.g. DiskStation or RackStation) connected\
 to the Synology Router's local network, 
you can wake it with its QuickConnect ID.
To use the WOL-related service, go to Network Tools > Wake on LAN.
Note:
1. Please make sure the target device supports WOL and has it enabled.
2. Devices connected to a switch that is connected to your Synology Router \
can receive the WOL command. 
3. Devices connected to a router that is connected to your Synology Router \
cannot receive the WOL command. 
4. Wireless devices cannot receive the WOL command.  
						

							 15 Chapter 5: Enhance Connection Security
This chapter introduces various security features to protect your Synolo\
gy Router and connected client devices 
from potential cyber threats and unwanted information leakage.
Secure Your Connections
SRM can secure the Internet connection in the following ways.
HTTP and HTTPS
HTTP is the unsecured, common protocol for web browsers to communicate with \
web servers. As the secured 
version of HTTP, HTTPS protects your Synology Router and client devices' communication \
from being 
intercepted.
By default, SRM provides HTTP and HTTPS connections. You may change the HTTP/HTTPS ports to avoid 
malicious attacks.
To change the HTTP/HTTPS ports, go to Control Panel > System > SRM Settings.
• Default HTTP URL: http://Synology_Router_IP_Address:8000
Example: http://192.168.1.1:8000
• Default HTTPS URL: https://Synology_Router_IP_Address:8001
Example: https://192.168.1.1:8001
HTTPS-related Settings
Go to Control Panel > System > SRM Settings: 
• Automatically redirect HTTP connections to HTTPS: All the Internet connections via HTTP will be switched 
to HTTPS to access SRM.
• Enable HSTS: Only HTTPS connections to SRM are allowed.
DoS Protection
DoS (Denial of Service) attacks bombard a network with numerous requests, overloading the target’ s networking 
or computing resources. The targeted network suffers from degraded Internet connectivity and increased system 
resource usage during the attack.
To enable DoS protection, go to Network Center > Security > General.
VPN Pass-through
When a VPN server exists behind your Synology Router, you can allow specific types of VPN client traffic (PPTP, 
L2TP, and IPSec) for pass-through to reach the server.
To enable the pass-through function, go to Network Center > Security > General.
Enhance Connection Security
5
Chapter  
						

							 16 Chapter 5: Enhance Connection Security
Create Firewall Rules
Firewall rules filter external IPv4 and IPv6 access to your Synology Router based on the specified conditions (e.g. 
ports and source IP addresses). 
To create firewall rules on general traffic, go to Network Center > Security > Firewall.
To modify Internet access policies on SRM services/packages, go to Network Center > Security > Service.
Note: Firewall rules can apply to traffic from WAN to LAN or from WAN to SRM.
External Access Restriction
This function allows external access to SRM via the HTTP/HTTPS ports (e\
.g. 8000/8001). External access via 
other ports will be denied.
To enable this function, go to Control Panel > System > SRM Settings and select Allow external access to 
SRM.
Note: For security reasons, if you enable this option and disable it later, your Synology Router will deny all external access even via the HTTP/HTTPS ports.
Enforce Auto Block
Auto block automatically blocks certain IP addresses with multiple failed login attempts. These IP addresses will 
be flagged as a source of potential malicious attacks.
To enable auto block, go to Network Center > Security > Auto Block.
Create Certificates
Creating a certificate from your Synology Router is equal to issuing a certified ID. If you import the certificate (a 
.crt file) to another device (e.g. your mobile phone), your Synology Router can identify and communicate with the 
device via a secured connection (e.g. HTTPS or SSL).
You can also import a certificate from a certificate authority so that your Synology Router can access another 
server.
To create or manage the certificate, go to Control Panel > Services > Certificate.
Additional Security Measures
More security measures are available to fine-tune SRM security policies at Network Center > Security > 
General. There you can set up the logout timer, help your browser skip IP checking, and additional security 
hardening options.
You are recommended to use Security Advisor, the integrated security feature that scans your SRM settings 
and Synology Router for settings and recommend changes that help keep yo\
ur network secure.  
						

							 17 Chapter 6: Update and Restore Your Synology Router
This chapter introduces how to update SRM and its packages and how to ba\
ck up/restore SRM.
Update SRM and Packages
Synology periodically releases SRM and package updates to fix reported issues, enhance performance, and of fer 
new features.
SRM
To update SRM and modify update preferences, go to Control Panel > System > Update & Restore.
The system will display the current SRM version and check if a newer SRM\
 update is available. SRM allows 
manual update if you have obtained a .pat update file.
Note: The version being installed must be newer than the current installed ver\
sion.
Packages
At Package Center > Update, the system will display packages that have any updates for download. You can 
also manually update packages with a .spk file.
To update packages and customize the update settings, go to Package Center > Settings.
Note: The version being installed must be newer than the current installed ver\
sion.
Back up and Restore SRM
You may preserve the current settings by backing up the configuration of SRM. Once you have completed setting 
up SRM, we recommend saving the .dss file for future reference or recovery.
At Control Panel > System > Update & Restore, you can back up current SRM configurations or restore 
previous configurations by importing the .dss file here.
Note: 
1. Restore factory default settings will have all user and package data stored on the external storages era\
sed, and the entire system will be restored to default settings. Please refer to \
SRM Help for more information.
2. Cross-model restoration (e.g. restoring RT1900ac configurations on RT2600ac) is allowed. However, model-specific configurations (e.g. Wi-Fi settings) will be reset to default when restored.
Register Synology Account
Synology Account allows simplified access to your registered devices with QuickConnect and Synology DDNS 
services. You may also choose to subscribe to Synology eNews for the latest news on\
 software updates.
To register or access your Synology Account, go to Control Panel > System > Synology Account, or go to 
Synology's official website.
Update and Restore Your Synology Router
6
Chapter  
						

							 18 Chapter 7: Manage Internet Connection
This chapter introduces various features for easy and safe access to the\
 Internet.
Internet Connection Types
At Network Center > Internet > Connection > Primary Interface, you can choose how to connect your 
Synology Router to the Internet:
• Auto: Choose this option if you rely on an ISP modem for automatic IP assignment.
• PPPoE: Choose this option if you have obtained PPPoE credentials from the ISP\
.
• Manual: Choose this option if you have obtained an available IP address for use. 
You can enable the secondary interface to operate in the failover or load\
-balancing mode. Go to Network Center 
> Internet > Connection > Secondary Interface (LAN 1) to enable this interface.
ISP/VPN/IPv6 Settings
ISP Settings
This function allows you to send the MAC address of your Synology Router\
 to the ISP for successful registration. 
To do so, go to Network Center > Internet > Connection > Primary Interface > ISP settings.
VPN Settings
A VPN (Virtual Private Network) helps secure data transfer between your device \
and a remote location.
To use your Synology Router as a VPN client, go to Network Center > Internet > Connection > Primary 
Interface > VPN settings to modify the settings.
Note: Synology Router can only connect to OpenVPN servers which support tun-s\
tyle tunnels on Layer 3.
IPv6 Settings
To set up IPv6 on your Synology Router, please go to Network Center > Internet > Connection > Primary 
Interface > IPv6 setup.
Smart WAN
At Network Center > Internet > Smart WAN, you can configure two defined outward-facing internet interfaces 
(e.g. PPPoE and WAN). You can choose either mode to determine their roles in network connectivi\
ty: 
• Failover: When one of the interfaces is down, the other will be responsible for \
all the network connectivity to 
ensure stable connection at all times.
• Load Balancing + Failover: When both interfaces are well-functioning, this mode allows you to dis\
tribute 
network traffic to the interfaces for optimal network traffic flow; when one of the interfaces is down, the other 
will be responsible for all the network connectivity to ensure stable co\
nnection at all times.
Smart WAN also allows you to regulate network traffic by setting up policy routes for specific devices. Such 
devices will be able to access the Internet and receive Internet traffic only through the defined interface.
Manage Internet Connection
7
Chapter  
						

							 19 Chapter 7: Manage Internet Connection
QuickConnect & DDNS
At Network Center > Internet > QuickConnect & DDNS, you can enable the services below for easy connection 
to your Synology Router.
QuickConnect
QuickConnect is a connection technology developed by Synology that helps\
 you effortlessly access your 
Synology Router from anywhere with your personal QuickConnect ID.
Enter the URL as shown below in a web browser to access your Synology Router via Quic\
kConnect:
• quickconnect.to/QuickConnect_ID (Example: quickconnect.to/synologist)
For more information about QuickConnect, refer to the white paper.
DDNS
DDNS (Dynamic Domain Name Service) matches the hostname and the IP address of your Synology Router for 
quick access even if you do not have a static IP address from your ISP. If you do not have a hostname, register 
one from Synology or other DDNS providers.To find your Synology Router with its DDNS hostname (e.g. john.
synology.me), please enter the registered hostname in the web browser.
DMZ
A DMZ (as a “demilitarized zone”) is part of the network directly\
 exposed to the Internet or other external 
untrusted networks. All external access will be directed to the host device in the DMZ. The DMZ host can directly 
connect to the Internet and is free from firewall limitations and protection. It is useful to set up servers as the DMZ 
host.
To enable DMZ, go to Network Center > Port Forwarding > DMZ for the setup.
Note: To connect to a host in the DMZ from an external network, you need the host’s external IP address retrieved by your Synology Router.
Port Forwarding
Port forwarding redirects data flow between different ports and has the following advantages:
• It can improve performance for applications which might otherwise rely o\
n a relay service.
• It protects the ports for services/client devices from direct exposure t\
o cyber threats.
• It can offer open ports to resolve port conflicts between multiple services/client devices
To set up port forwarding rules, go to Network Center > Port Forwarding > Port Forwarding.
Port Triggering
Port triggering requires you to set up one static port (the outgoing/tr\
igger port) and one dynamic port (the 
incoming port) for a service/device in the local network for data trans\
mission. Once the data come out to an 
external host through the trigger port, the incoming port is then trigge\
red and opened to receive data from the 
host. If no data come out, the incoming port turns off, shutting down a possible opening for malicious attacks.
To set up port triggering rules, go to Network Center > Port Forwarding > Port Triggering.  
						

							 20 Chapter 7: Manage Internet Connection
IPv6 Tunneling
IPv4 and IPv6 are two protocols not mutually compatible. To help IPv6 devices communicate with each other over 
an IPv4 network, via IPv6 tunneling you can wrap up IPv6 data within IPv\
4 packets, so that IPv6 data can travel 
through an IPv4 network.
To enable IPv6 tunneling, go to Network Center > Internet > IPv6 Tunneling.
Note: Your external IPv6 address may be automatically updated by the service pr\
ovider. However, your Synology Router will not remove the old IPv6 address immediately.