ZTE ZXHN F670L is an AC1200 dual-band triple-play GPON gateway that provides four GE LAN ports and one phone port. It provides a dual-band concurrent Wi-Fi speed up to 1200 Mbps, allowing users to surf the internet, watch videos and play online games.
By doing certain custom setting, user can achieve a stable connectivity.
1. ALG Settings
ALG means Application Layer Gateway. The router does NAT: it rewrites private LAN addresses (such as 192.168.1.x) into the public WAN address. Most apps only put addresses in the IP header, which NAT already fixes. A few protocols also put IP addresses or port numbers inside the payload. An ALG inspects and rewrites that payload so the session still works. Each switch only affects that one protocol. It is not a general firewall and it does not open ports by itself.
The switches
| Protocol | Typical port | What the helper does | Turn it On only if |
|---|---|---|---|
| FTP ALG: File Transfer Protocol, active mode | TCP 21, plus a negotiated data port | Reads the PORT/PASV commands and opens the matching data connection through NAT | An FTP client in active mode, or an FTP server on the LAN, fails to transfer files. Passive FTP usually works with this Off |
| H323 ALG: Older video-call signaling (H.323) | TCP 1720, plus dynamic media ports | Rewrites call-setup messages so audio and video ports are reachable | You use a legacy H.323 video endpoint. Modern Zoom, Teams, and Meet do not need this |
| PPTP ALG: Point-to-Point Tunneling Protocol VPN | TCP 1723 and GRE (protocol 47) | Lets the GRE tunnel that carries the VPN data pass NAT, and tracks the related control session | A PPTP VPN client on the LAN cannot connect. PPTP is obsolete and weak; prefer WireGuard, OpenVPN, or IPsec |
| RTSP ALG: Real Time Streaming Protocol | TCP 554, plus RTP/RTCP media ports | Rewrites the SETUP/PLAY messages so the media ports are opened | An old IP camera, VLC stream, or IPTV app that uses RTSP fails only when this is Off |
| SIP ALG: Session Initiation Protocol, used by IP phones | UDP/TCP 5060, plus RTP media ports | Rewrites SIP headers (Via, Contact, SDP) so call signaling and audio survive NAT | The phone is registered to an external PBX and calls fail with one-way audio or no inbound ring. Many providers tell you to leave this Off because the helper corrupts their SIP |
| TFTP ALG: Trivial File Transfer Protocol | UDP 69, then a negotiated port | Tracks the second UDP port the server picks after the first request | A device on the LAN is pulling firmware or a config by TFTP from the internet, or a LAN TFTP server must be reached from outside |
Why Off is often better
These helpers are stateful packet rewriters. If the router’s rewrite does not match what the app or the provider expects, the session breaks in ways that are hard to see: FTP lists the directory but will not download, a SIP phone registers but audio is one way, a VPN connects then drops. Modern clients avoid the problem by using passive FTP, outbound-only connections, STUN/ICE, or UDP hole punching, so they work with ALG off.
- Open Internet → Security → ALG setting.
- FTP ALG: Off
- H323 ALG: Off
- PPTP ALG: Off
- RTSP ALG: Off
- SIP ALG: Off
- TFTP ALGn: Off
Leave a switch Off unless that exact service fails. If you turn one On to test, change only that one, Apply, retest, and turn it Off again if it does not help. SIP ALG is the one most often left Off on purpose, including on ISP-supplied ZTE gateways, because it conflicts with hosted phone systems.
2. SNTP Server Setting
This page sets the router’s clock. It does not set the time on your phone or PC. Those devices sync on their own. The router uses this clock for logs, schedules, parental-control time windows, and certificate checks.
SNTP is the simple form of NTP: the router asks a time server for the current UTC time, then applies the time zone you choose.
Fields
| Setting | What it does |
|---|---|
| Current Date And Time | Read-only clock the router is using now. It updates after a successful sync. It is not a box you type into. |
| Time Zone | Offset and name applied to UTC. This only changes how the time is displayed and how schedules are interpreted. It does not change the servers. |
| Primary NTP Server | First server asked for the time. A hostname is resolved by DNS, so WAN and DNS must already work. |
| Secondary NTP Server | Used if the primary does not answer. It is not asked on every poll while the primary is healthy. |
| Poll Interval | How often the router asks again, in seconds. 86400 is 24 hours. The trailing “s” on the page is the unit label, not part of the number. |
| DSCP | Optional quality-of-service mark on the time-sync packets. Empty means unmarked (best effort, DSCP 0). A value is 0–63, or sometimes entered as a decimal code point. |
| Apply | Saves the fields above and starts a sync. |
- Open Internet → SNTP setting.
- Set Primary NTP Server: 0.in.pool.ntp.org
- Set Secondary NTP Server: 1.in.pool.ntp.org
- Click Apply button.
3. Port Binding Settings
Port binding is the rule that decides which WAN connection a LAN port or a Wi-Fi name is allowed to use. It does not enable the port, set the Wi-Fi password, or create the WAN. It only attaches an already existing local interface to an already existing WAN profile.
On the F670L this sits at Internet → Port Binding. The page is a set of checkboxes: one group per WAN, and inside each group the four Ethernet sockets plus the eight SSIDs.
The two sides being joined
| Side | What it is | On your router |
|---|---|---|
| WAN | A service toward the ISP, created under Internet → WAN | WAN-VOIP (phone), Static (unused template), WAN-TR069_INTERNET (home PPPoE), Bridge (unused) |
| Port | A local interface a device plugs into or joins | LAN1–LAN4, SSID1–SSID4 on 2.4 GHz, SSID5–SSID8 on 5 GHz |
A tick means traffic from that port or SSID is sent out through that WAN. No tick means that interface is not a member of that WAN.
What a tick changes
- A device on a ticked port gets the treatment of that WAN. On a routing WAN it receives this router’s private address and is NATed. On a bridge WAN it is passed through and must get its own address from the ISP, or dial PPPoE itself.
- Unticking a port does not disable the socket. The cable still links. The port simply has no path to that service.
- An SSID can be ticked even if that Wi-Fi name is switched off. Binding does not start the radio.
- Each WAN block has its own Apply. A change is not stored until Apply is clicked in that block.
A port should be ticked under only one WAN. Ticking LAN4 under both the internet profile and Bridge makes the outcome undefined: the set-top box or PC can lose the network, or land on the wrong service.
Why ISPs use it
One fiber carries several services, separated by VLAN. Binding is how a single ONT splits them inside the house without a second box.
- Internet on VLAN 100, routed PPPoE: LAN1–LAN3 and the SSIDs ticked under WAN-TR069_INTERNET.
- IPTV on a bridge VLAN: only LAN4 ticked under Bridge, and LAN4 cleared under the internet profile. The set-top box is then on the ISP video network, outside this router’s NAT.
- Voice needs no tick. WAN-VOIP is used by the router’s own phone port, not by a LAN socket.
It is recommended to bind each port to the WAN connection that provides the internet.
Leaving every interface on WAN-TR069_INTERNET, as the page shows, is the correct setup when there is only one home internet service and no IPTV port to split off.
The three profiles on this page
| Profile | What it is | Checked now | Effect |
|---|---|---|---|
| WAN-TR069_INTERNET | The routed WAN that carries internet and usually the ISP’s TR-069 remote-management path. Devices bound here are NATed and get private addresses from this router. | LAN1–LAN4 and SSID1–SSID8 | Every local interface uses this connection |
| Static | A separate WAN of type Static, if one was created under Internet → WAN. Often a fixed public address for a server or a second service. | None | Inactive. Nothing is forced onto it |
| Bridge | A WAN in bridge mode. The router does not NAT this traffic; the device on the bound port gets an address from the ISP, or from a set-top box network, as if it were plugged in directly. Common for IPTV. | None | Inactive |
The checkboxes
| Checkbox | Interface | Usual meaning on the F670L |
|---|---|---|
| LAN1–LAN4 | The four Ethernet sockets on the back | A device cabled into that socket. On some ISP images, LAN4 is reserved for IPTV and is bound only to Bridge until you check it here under the internet profile |
| SSID1–SSID4 | 2.4 GHz Wi-Fi names | Main 2.4 GHz network is usually SSID1. SSID2–SSID4 are extra 2.4 GHz names, often guest or unused |
| SSID5–SSID8 | 5 GHz Wi-Fi names | Main 5 GHz network is usually SSID5. SSID6–SSID8 are extra 5 GHz names |
4. WLAN Settings
A. Local network WLAN Global Configuration 2.4 GHz
2.4 GHz WLAN Global Config_1
- Setting the Channel to Auto, allows the Wi-Fi router to automatically select a wireless channel in 2.4 GHz band that has low interference.
- In the Mode setting user can set the wireless standard that will used to host the wireless network in 2.4 GHz band. Setting the Mode to IEEE 802.11n Only disables the old wireless standards and uses only 802.11n network standard to host the wireless network.
- Setting the Band Width to 20 MHz provides stability especially in congested environment and is compatible with most devices.
- Turning OFF the Short Guard interval(SGI) helps minimizing interference(ISI).
- Open Local Network → WLAN → WLAN Basic → WLAN Global Configuration → 2.4 GHz setting.
- Channel : Auto
- Mode : IEEE 802.11n Only
- Band Width: 20 MHz
- SGI: Off
- Beacon Interval: 200
- Transmitting Power: 100%
- Click Apply button.
2.4 GHz WLAN Global Config_2
- Open Local Network → WLAN → WLAN Basic → WLAN Global Configuration → 2.4 GHz setting.
- Country/Region: Australia
- Channel: 13
- Click Apply button.
B. Local Network WLAN Global Configuration 5 GHz
- Setting Channel to Auto, allows the Wi-Fi router to automatically select a wireless channel in 5 GHz band that has low interference.
- In the Mode setting user can set the wireless standard that will used to host the wireless network in 5 GHz band. Setting the Mode to IEEE 802.11ac Only disables the old wireless standards and uses only 802.11ac network standard to host the wireless network.
- Most modern devices support 80 MHz band width. Setting the Band Width to 80 MHz ensures that 5 GHz WLAN is hosted using 80 MHz band width.
- Turning OFF the Short Guard interval(SGI) helps minimizing interference(ISI).
5 GHz WLAN Global Config_1
- Open Local Network → WLAN → WLAN Basic → WLAN Global Configuration → 5 GHz setting.
- Channel: Auto
- Mode: IEEE 802.11ac Only
- Country/Region: India
- Band Width: 80 MHz
- SGI: Off
- Beacon Interval: 200ms
- Transmitting Power : 100%
- Click Apply button.
5 GHz WLAN Global Config_2
- Open Local Network → WLAN → WLAN Basic → WLAN Global Configuration → 5 GHz setting.
- Channel: Auto
- Mode: IEEE 802.11ac Only
- Country/Region: India
- Band Width: 40 MHz
- SGI: Off
- Beacon Interval: 200ms
- Transmitting Power : 100%
5. WLAN SSID Configuration Settings
A. WLAN SSID Encryption Type
- Open Local Network → WLAN → WLAN Basic → WLAN SSID Configuration setting.
- Set Encryption Type to WPA2-PSK-AES as for each SSID.
- Click Apply button.
B. WLAN SSID Encryption Type
6. IPv6 RA Service setting
An IPv6 Router Advertisement is a periodic ICMPv6 message from the router that tells devices on the home LAN how to configure IPv6. It is not a web page and not a DHCP lease.
IPv4 devices find a gateway because DHCP says so. IPv6 devices are designed to hear an advertisement first. That is why turning RA off stops IPv6 for most phones and PCs even if the DHCPv6 server is still On.
What an advertisement contains
The router sends it to the all-nodes multicast address ff02::1, so every device on that link hears it. A device can also ask immediately with a Router Solicitation when it connects, which is why a new phone does not wait for the 200–600 second timer.
| Field | What the device learns |
|---|---|
| Source address | The router’s link-local address, used as the gateway |
| Prefix | The network portion used to build a global address |
| Prefix lifetime | How long that prefix may be used |
| M flag | If set, also ask DHCPv6 for an address |
| O flag | If set, ask DHCPv6 for other options, mainly DNS |
| MTU | Do not send IPv6 packets larger than this |
| Preference | How strongly to prefer this router if several advertise |
| Router lifetime | How long this gateway may be used without a refresh |
The controls present in the RA Service
| Setting | Meaning |
|---|---|
| RA Service | On sends ICMPv6 router advertisements. Off stops them. Devices then get no gateway and no prefix from this router, so IPv6 on the LAN fails even if the WAN has a prefix |
| Specify MTU | On puts an MTU option inside each advertisement. Off lets devices assume the normal link MTU, usually 1500 |
| MTU | Value advertised to LAN devices, in bytes. IPv6 cannot go below 1280. Devices will not send larger IPv6 packets than this |
| Preference | How strongly this router claims to be the default gateway if more than one router advertises. Low, Middle, High. One home router does not compete, so Middle is neutral |
| Minimum Retry Interval | Shortest gap between unsolicited advertisements, in seconds. The “s” is the unit |
| Maximum Retry Interval | Longest gap. The router picks a time between the minimum and the maximum for each advertisement |
| M | Managed flag. On tells devices to take their IPv6 address from DHCPv6, not only from SLAAC |
| O | Other-config flag. On tells devices to take DNS and other options from DHCPv6 |
| Prefix Delegate Type | Auto uses the prefix delegated on WAN-TR069_INTERNET. Manual would use the Static Prefix section |
- Specify MTU: On
- MTU : 1300
- M: On
- O: On
7. Local Network DNS Settings
A custom DNS server on Local Network → DNS → DNS replaces the resolvers this router hands to LAN devices. Instead of passing on the ISP servers learned during PPPoE, the router advertises the addresses you type. Devices still ask the router’s DHCP (and DHCPv6) for DNS; only the answer changes.
What the change actually does
- You enter one or more server addresses and Apply.
- The router starts giving those addresses in DHCP, and in DHCPv6 if the IPv6 boxes are filled and delegation is not forced back to Auto.
- A phone or PC keeps the old servers until its lease renews, or until it reconnects.
- After that, a lookup such as a site name goes to your chosen server. The PPPoE login and the WAN IP are unchanged.
Typical pairs are 1.1.1.1 and 1.0.0.1, 8.8.8.8 and 8.8.4.4, or 9.9.9.9 and 149.112.112.112. The first address is the one used; the second is the fallback.
Benefits
- A bad or slow ISP resolver can be skipped. Pages that fail only because the name does not resolve start working, without a new WAN profile.
- Every device that honors DHCP gets the same policy. A filtering resolver blocks adult or malware names for the whole house, which is harder to do device by device.
- Public resolvers often answer faster and support DNSSEC validation, so a forged answer is less likely to be accepted.
- The choice survives a WAN redial. ISP DNS can change when PPPoE reconnects; a typed address does not.
- Split testing is easy: one Apply points the house at a known resolver, and clearing the fields returns the ISP servers.
Drawbacks
- The DNS operator sees every name the house looks up, from the router’s WAN address. That is a privacy trade against the ISP, not a removal of logging. Use a provider whose policy you accept.
- A wrong or dead address breaks name lookup for the whole LAN. Sites will not open, while a ping to 1.1.1.1 still works. That contrast is the usual symptom.
- Some ISP services answer only on the ISP resolver(DNS): billing portals, IPTV names, and local cache servers. Those can fail on a public resolver.
- Extra latency is possible if the chosen server is far away. For an Asia connection, an anycast address is usually fine; an overseas unicast address is not.
- Devices that use their own DNS, or DNS over HTTPS, ignore this page. A browser with secure DNS set to a provider still bypasses the router. So does a phone with Private DNS set to a hostname.
- User may face issues with location based services because custom DNS will return the IP address that is close to itself, that may located far from the location of the user device. Since the resolved server that is providing the service is located far away, the data traffic between the server and the user device may face congestion. This reduces the service quality.
A. DNS Server Setting 1
- Open Local Network → DNS setting.
- IPv4 DNS Server1: 94. 40.14.15
- IPv4 DNS Server2: 94. 40.15.16
- IPv6 DNS Server1: 2a10:50c0::bad1:ff
- IPv6 DNS Server2: 2a10:50c0::bad2:ff
- Click Apply button.
B. DNS Server Setting 2
- IPv4 Adguard DNS server: 94. 40.14.15
- IPv4 Cloudflare DNS: 1.1.1.3
- IPv6 Adguard DNS server: 2a10:50c0::bad1:ff
- IPv6 Cloudflare DNS: 2606:4700:4700::1113
- Open Local Network → DNS setting.
- IPv4 DNS Server1: 94. 40.14.15
- IPv4 DNS Server2: 1.1.1.3
- IPv6 DNS Server1: 2a10:50c0::bad1:ff
- IPv6 DNS Server2: 2606:4700:4700::1113
- Click Apply button.
No comments:
Post a Comment