CacheGuard Help

Happy to hear that your ISP can provide you with a static public IP address, which will allow you to connect your CacheGuard gateway directly to your pass-through modem.

In this case, you will need the following information, which should normally be provided by your ISP:

• Your fixed public IP address
• The network mask to use
• The default gateway

For example, if we suppose that your fixed public IP address and network mask are 192.168.1.8 / 255.255.255.254, with the default gateway 192.168.1.9, you can configure CacheGuard as follows:

• Internal IP address: 10.11.12.254
• Internal IP mask: 255.255.255.0
• External IP address: 192.168.1.8
• External IP mask: 255.255.255.254
• Default gateway IP address: 192.168.1.9

Run the setup command from the CacheGuard console and follow the instructions shown in the screenshot below.
You can navigate between fields using the up and down keys on your keyboard. Confirm the values and answer "Yes" to the question "Do you confirm the apply operation?"

Wait until you receive the following message:
At this stage, you can connect your CacheGuard appliance to your modem. The remaining question is which physical Ethernet port on the Beelink corresponds to eth0, which is the default external interface on CacheGuard-OS.

The Beelink EQ14 N150 has two Ethernet ports, but there does not appear to be reliable official labelling from Beelink indicating which physical port corresponds to eth0 or eth1 (and nothing is mentioned on the box). On CacheGuard, the external interface is bound to eth0 (LAN1) and the internal interface to eth1 (LAN2).

To identify the correct physical port, proceed as follows:

• Connect the Ethernet port on the left to your modem.
• From the CacheGuard CLI, test Internet connectivity using, for example:

If you receive replies from yahoo.com, the Ethernet port on the left is eth0, so it is the correct port to use as the external interface.

If you receive , disconnect the cable from the left port and connect it to the other Ethernet port. Then run the same test again.

If the test succeeds with the other port, that port is eth0 and should be connected to your modem.

If neither port provides connectivity, the issue is probably not related to the physical port selection. In that case, please double-check the IP configuration entered during setup, particularly the external IP address, network mask, and default gateway, and make sure that these values match the information provided by your ISP.

Once you have identified the physical port corresponding to eth0, connect that port to your modem. The other Ethernet port, which corresponds to eth1 (the internal interface), should then be connected to your switch.

Configure an endpoint device on your internal network as follows:

• IP address: 10.11.12.1
• Netmask: 255.255.255.0
• Default gateway: 10.11.12.254
• DNS server: 10.11.12.254

Then test Internet connectivity from that endpoint device by pinging yahoo.com again.

If everything works as expected up to this point, you are done! Your CacheGuard gateway is operational.

At this stage, you can connect your other devices to your LAN and review their IP configurations. They should use addresses within the 10.11.12.0/255.255.255.0 network, with 10.11.12.254 as their default gateway and DNS server.

Important: upgrade CacheGuard-OS before proceeding with the remaining configuration. The operation is straightforward from the Web GUI: use a web browser and navigate to the URL https://10.11.12.254:8090, log in, and then go to the [GENERAL] > [System Operations] > [Load OS Patch] page. Tick the "I agree to the terms of the [Latest CacheGuard-OS License]" checkbox, and press Submit.
The OS patch is downloaded first.

As with most CacheGuard settings, you need to apply the configuration by using the apply command from the CLI or via the Web GUI at [GENERAL] > [Whole Configuration]. When the configuration has been modified and needs to be applied, a shortcut is indicated by a blinking blue down arrow in the mini icon bar. Click on it and then confirm the apply operation. Wait until it has terminated, and you are done.

Security note: by default, remote administration of the CacheGuard appliance is allowed from everywhere. For security reasons, we strongly recommend restricting administrative access according to your network requirements. You can configure the allowed remote administrators via the [SECURITY] > [Appliance Access] > [Remote Administrators] page.

CacheGuard-OS includes a DHCP server that you can enable if required. You can find the relevant instructions in the User's Guide here:

https://cacheguard.net/doc/guide/Network_Configuration.html#dhcp

Of course, everything is also configurable via the Web GUI. The DHCP server can be configured via the following pages:

Activate it first at [NETWORK] > [NETWORK MODES] and then configure it via the following pages:

[NETWORK] > [DHCP Configuration] > [DHCP IP Ranges]

[NETWORK] > [DHCP Configuration] > [DHCP Fixed IP]

You can now safely disconnect and reconnect all your endpoints to the switch to get their new IP addresses provided by your CacheGuard Gateway.

Regarding DNS, CacheGuard includes a cache-only DNS server that is activated by default. It is an autonomous and reliable DNS server that queries the root DNS servers. However, it is not a configurable DNS server, so it cannot be configured to resolve your own DNS names.

Do not hesitate to post new topics regarding the features you need to activate. We will be happy to help.

Best regards,

Thank you, David, for your valuable help as usual.

Please find below an updated diagram reflecting the CacheGuard implementation according to the IP address configuration proposed by David, along with a proposed addressing scheme for your endpoints.
I would use static IP addresses for your NAS, printer and server (if any), and let the other endpoints obtain dynamic IP addresses. It is good to know that you can connect to your CacheGuard via SSH and use the CLI (Command Line Interface). For instance, instead of using the Web GUI to configure DHCP and restrict administrative access to the internal network only, you can connect to your CacheGuard from your PC and use the following commands (available in the UF-2.6.1 release):
Regarding your public IP address, I would recommend confirming that it is a real public IP address if you plan to access your private network from the Internet via CacheGuard's VPN or expose services hosted on your LAN, such as a web server, to the Internet. With CGNAT (Carrier-Grade Network Address Translation), inbound connections from the Internet are generally not possible. RFC 6598 defines `100.64.0.0/10` as Shared Address Space, specifically intended for use between ISP equipment and customer equipment in CGN deployments. I hope that the IP address currently assigned to your modem is not within the `100.64.0.0/10` range (100.64.0.1 - 100.127.255.254).

Cheers