GWG Gateway
USER MANUAL
GWG
Document version: 1.0.1
Date: July 2016
WWW.GENEKO.RS
2
User Manual
GWG Gateway
Document History
Date Description Author Comments
24.12.2015 User Manual Tanja Savić Firmware version: 1.0.10
28.07.2016 User Manual Tanja Savić Firmware version: 1.1.0
Document Approval
The following report has been accepted and approved by the following:
Signature Printed Name Title Date
Dragan Marković Executive Director 24.12.2015
Dragan Marković Executive Director 28.07.2016
3
User Manual
GWG Gateway
Content
DOCUMENT APPROVAL...................................................................................................................................... 2
LIST OF FIGURES....................................................................................................................................................5
LIST OF TABLES ......................................................................................................................................................8
DESCRIPTION OF THE GWG-30/40 GATEWAY.............................................................................................. 9
TYPICAL APPLICATION........................................................................................................................................... 10
TECHNICAL PARAMETERS .....................................................................................................................................11
PROTOCOLS AND FEATURES ..................................................................................................................................17
PRODUCT OVERVIEW............................................................................................................................................. 22
Front panel....................................................................................................................................................... 22
Back panel........................................................................................................................................................22
Top Panel .........................................................................................................................................................23
Bottom Panel ...................................................................................................................................................24
PUTTING INTO OPERATION ...................................................................................................................................24
DEVICE CONFIGURATION ...............................................................................................................................25
QUICK START.......................................................................................................................................................... 25
INSERTING SIM CARDS ..............................................................................................................................25
CONNECTING GATEWAY .........................................................................................................................26
ADMINISTRATION WEB PAGE.................................................................................................................27
QUICK SETUP ................................................................................................................................................27
TURN LOGGING ON....................................................................................................................................27
DEVICE CONFIGURATION USING WEB APPLICATION......................................................................... 28
ADD/REMOVE/UPDATE MANIPULATION IN TABLES ........................................................................................... 29
SAVE/RELOAD CHANGES ...................................................................................................................................... 29
STATUS INFORMATION ..........................................................................................................................................30
Status – General ..............................................................................................................................................30
Status – LAN Port Information.....................................................................................................................30
Status – DHCP................................................................................................................................................. 31
Status – Mobile Information.......................................................................................................................... 31
Status – Firewall.............................................................................................................................................. 32
Status –Router Monitoring ............................................................................................................................33
Status –GPS...................................................................................................................................................... 33
SETTINGS – LAN PORTS ........................................................................................................................................34
SETTINGS – DHCP SERVER....................................................................................................................................35
SETTINGS – MOBILE SETTINGS...............................................................................................................................36
SETTINGS – ROUTING............................................................................................................................................. 38
Port forwarding...............................................................................................................................................40
Settings – Demilitarized Zone (DMZ)..........................................................................................................42
Routing Information Protocol (RIP).............................................................................................................42
RIP routing engine for the GWG Gateway.................................................................................................................... 44
Routing – VRRP ..............................................................................................................................................45
SETTINGS – VPN SETTINGS ...................................................................................................................................46
Generic Routing Encapsulation (GRE) ........................................................................................................46
GRE Keep alive............................................................................................................................................................... 48
Internet Protocol Security (IPSec).................................................................................................................49
OpenVPN......................................................................................................................................................... 55
SETTINGS – PPTP................................................................................................................................................... 59
SETTINGS – L2TP ...................................................................................................................................................60
File management – CA Certificate................................................................................................................62
4
User Manual
GWG Gateway
File management – Private Certificate.........................................................................................................62
File management – Private Key.................................................................................................................... 63
File management – CRL Certificates............................................................................................................65
File management – Preshared Key Files...................................................................................................... 65
SETTINGS – FIREWALL – MAC FILTERING ............................................................................................................68
SETTINGS – DYNAMIC DNS...................................................................................................................................69
SETTINGS – SERIAL PORT 1 ....................................................................................................................................70
SETTINGS – SERIAL PORT 2 ....................................................................................................................................71
Serial port over TCP/UDP settings.............................................................................................................. 71
Modbus Gateway settings .............................................................................................................................73
GWG RS-422/RS-485 Port Wiring................................................................................................................ 75
USB Port........................................................................................................................................................... 75
SMS – SMS REMOTE CONTROL ............................................................................................................................77
SMS – SEND SMS ..................................................................................................................................................78
Maintenance ....................................................................................................................................................79
Maintenance – System Control .....................................................................................................................79
Maintenance – LED ........................................................................................................................................79
Maintenance – GPIO ......................................................................................................................................79
Maintenance – Device Identity Settings ......................................................................................................81
Maintenance – Authentication...................................................................................................................... 81
Maintenance – Date/Time Settings.............................................................................................................. 83
Maintenance – Diagnostics............................................................................................................................84
Maintenance – Update Firmware................................................................................................................. 84
Maintenance – Import/Export Settings.......................................................................................................85
Import Configuration File .............................................................................................................................................. 85
Export Configuration File .............................................................................................................................................. 85
Maintenance – Default Settings ....................................................................................................................85
Maintenance – System Reboot ......................................................................................................................86
MANAGEMENT – TIMED ACTIONS ........................................................................................................................86
MANAGEMENT – COMMAND LINE INTERFACE .................................................................................................... 87
MANAGEMENT – REMOTE MANAGEMENT ...........................................................................................................88
MANAGEMENT – CONNECTION MANAGER ......................................................................................................... 89
MANAGEMENT – SIMPLE MANAGEMENT PROTOCOL (SNMP) ........................................................................... 93
MANAGEMENT – LOGS .......................................................................................................................................... 94
LOGOUT ................................................................................................................................................................. 95
CHROOT ..............................................................................................................................................................95
CONFIGURATION EXAMPLES .........................................................................................................................97
GWG GATEWAY AS INTERNET GATEWAY............................................................................................................ 97
GRE TUNNEL CONFIGURATION BETWEEN TWO GWG GATEWAYS ..................................................................... 98
GRE TUNNEL CONFIGURATION BETWEEN GWG GATEWAY AND THIRD PARTY ROUTER ................................103
IPSEC TUNNEL CONFIGURATION BETWEEN TWO GWG GATEWAYS .................................................................106
Scenario #1..................................................................................................................................................... 108
Scenario #2..................................................................................................................................................... 115
IPSEC TUNNEL CONFIGURATION BETWEEN GWG GATEWAY AND CISCO ROUTER .........................................122
IPSEC TUNNEL CONFIGURATION BETWEEN GWG GATEWAY AND JUNIPER SSG FIREWALL ........................... 127
OPENVPN TUNNEL BETWEEN GWG GATEWAY AND OPENVNP SERVER ........................................................ 137
Port forwarding example.............................................................................................................................141
Serial port – example.................................................................................................................................... 143
FIREWALL – EXAMPLE .......................................................................................................................................... 147
SMS MANAGEMENT – EXAMPLE.......................................................................................................................... 154
DEFINING KEEPALIVE FUNCTIONALITY............................................................................................................... 155
APENDIX................................................................................................................................................................ 157
5
User Manual
GWG Gateway
Antenna placement.......................................................................................................................................157
Antenna Options........................................................................................................................................... 157
List of Figures
Figure 1 – GWG Gateway...............................................................................................................................................9
Figure 2 – GWG Gateway front panel ........................................................................................................................22
Figure 3 – GWG Gateway rear panel..........................................................................................................................23
Figure 4 – GWG Gateway top panel side...................................................................................................................23
Figure 5 – GWG Gateway bottom panel ...................................................................................................................24
Figure 6 – Insert SIM card ............................................................................................................................................26
Figure 7 – Wires for power, ground, GPIO output, ignition...................................................................................26
Figure 8 – User authentication.....................................................................................................................................28
Figure 9 – General gateway information....................................................................................................................30
Figure 10 – LAN Port Information..............................................................................................................................31
Figure 11 – DHCP Information....................................................................................................................................31
Figure 12 – Mobile Information...................................................................................................................................32
Figure 13 – Firewall Information.................................................................................................................................32
Figure 14 – Router monitoring #1...............................................................................................................................33
Figure 15 – Router monitoring #2...............................................................................................................................33
Figure 16 – LAN Port configuration page..................................................................................................................34
Figure 17 – DHCP Server configuration page...........................................................................................................36
Figure 18 – Mobile Settings configuration page........................................................................................................37
Figure 19 – Routing configuration page.....................................................................................................................39
Figure 20 – Port forwarding.........................................................................................................................................40
Figure 21 – DMZ configuration page..........................................................................................................................42
Figure 22 – RIP configuration page.............................................................................................................................43
Figure 23 – VRRP...........................................................................................................................................................46
Figure 24 – GRE tunnel parameters configuration page..........................................................................................47
Figure 25 – IPSec Summary screen .............................................................................................................................49
Figure 26 – IPSec Settings.............................................................................................................................................51
Figure 27 – OpenVPN example ...................................................................................................................................55
Figure 28 – Open VPN Summary screen....................................................................................................................55
Figure 29 – OpenVPN configuration page.................................................................................................................58
Figure 30 – PPTP configuration page .........................................................................................................................59
Figure 31 – PPTP Summary screen .............................................................................................................................60
Figure 32 – L2TP configuration page..........................................................................................................................60
Figure 33 – L2TP Summary screen..............................................................................................................................61
Figure 34 – CA Certificate screen ................................................................................................................................62
Figure 35 – Local Certificate screen.............................................................................................................................63
Figure 36 – Private Key screen.....................................................................................................................................65
Figure 37 – CRL Certificates.........................................................................................................................................65
Figure 38 – Preshared Key screen ...............................................................................................................................66
Figure 39 – Firewall configuration page.....................................................................................................................67
Figure 40 – MAC filtering configuration page ..........................................................................................................69
Figure 41 – DynDNS settings.......................................................................................................................................69
Figure 42 – Serial Port Settings initial menu..............................................................................................................71
Figure 43 – Serial Port configuration page.................................................................................................................73
Figure 44 – Modbus gateway configuration page.....................................................................................................74
6
User Manual
GWG Gateway
Figure 45 – GWR RS-422/RS-485 Port Wiring...........................................................................................................75
Figure 46 – USB Flash LOG example..........................................................................................................................76
Figure 47 – USB multi partition mounted..................................................................................................................76
Figure 48 – SMS remote control configuration..........................................................................................................78
Figure 49 – Send SMS....................................................................................................................................................78
Figure 50 – System Control ..........................................................................................................................................79
Figure 51 – LED .............................................................................................................................................................79
Figure 52 – GPIO ...........................................................................................................................................................80
Figure 53 – Device Identity Settings configuration page.........................................................................................81
Figure 54 – Gateway Management configuration page...........................................................................................82
Figure 55 – Date/Time Settings configuration page.................................................................................................83
Figure 56 – Diagnostic page.........................................................................................................................................84
Figure 57 – Update Firmware page.............................................................................................................................84
Figure 58 – Export/Import the configuration on the gateway................................................................................85
Figure 59 – Default Settings page................................................................................................................................86
Figure 60 – System Reboot page..................................................................................................................................86
Figure 61 – Command Line Interface .........................................................................................................................87
Figure 62 – Remote Management................................................................................................................................88
Figure 63 – Connection Manager ................................................................................................................................89
Figure 64 – Connection Wizard – Initial Step............................................................................................................90
Figure 65 – Connection Wizard – Router Detection #1............................................................................................91
Figure 66 – Connection Wizard – Router Detection #2............................................................................................91
Figure 67 – Connection Wizard – LAN Settings .......................................................................................................92
Figure 68 – Connection Wizard – WAN Settings......................................................................................................92
Figure 69 – SNMP configuration page........................................................................................................................93
Figure 70 – Syslog configuration page........................................................................................................................94
Figure 71 – GWG Gateway as Internet gateway.......................................................................................................97
Figure 72 – GRE tunnel between two GWG Gateways............................................................................................98
Figure 73 – Network configuration page for GWR Router 1...................................................................................99
Figure 74 – GRE configuration page for GWR Router 1 ..........................................................................................99
Figure 75 – Routing configuration page for GWG Gateway 1..............................................................................100
Figure 76 – Network configuration page for GWR Router 2.................................................................................100
Figure 77 – GRE configuration page for GWG Gateway 2....................................................................................101
Figure 78 – Routing configuration page for GWG Gateway 2..............................................................................101
Figure 79 – GRE tunnel between Cisco router and GWG Gateway .....................................................................103
Figure 80 – LAN Port configuration page................................................................................................................104
Figure 81 – GRE configuration page.........................................................................................................................105
Figure 82 – Routing configuration page...................................................................................................................105
Figure 83 – IPSec tunnel between two GWG Gateways.........................................................................................106
Figure 84 – LAN Port configuration page for GWG Gateway 1...........................................................................108
Figure 85 – IPSEC configuration page I for GWG Gateway 1...............................................................................109
Figure 86 – IPSec configuration page II for GWG Gateway 1...............................................................................110
Figure 87 – IPSec start/stop page for GWG Gateway 1.........................................................................................110
Figure 88 – Network configuration page for GWR Router 2.................................................................................111
Figure 89 – IPSEC configuration page I for GWG Gateway 2...............................................................................112
Figure 90 – IPSec configuration page II for GWG Gateway 2...............................................................................113
Figure 91 – IPSec configuration using certificates...................................................................................................113
Figure 92 – IPSec start/stop page for GWG Gateway 2.........................................................................................114
Figure 93 – Network configuration page for GWG Gateway 1.............................................................................115
Figure 94 – IPSEC configuration page I for GWG Gateway 1...............................................................................116
Figure 95 – IPSEC configuration page II for GWG Gateway 1..............................................................................117
Figure 96 – IPSEC configuration page III for GWG Gateway 1 ............................................................................117
Figure 97 – IPSec start/stop page for GWG Gateway 1.........................................................................................118
Figure 98 – Network configuration page for GWG Gateway 2.............................................................................118
7
User Manual
GWG Gateway
Figure 99 – IPSEC configuration page I for GWG Gateway 2...............................................................................119
Figure 100 – IPSEC configuration page II for GWG Gateway 2............................................................................120
Figure 101 – IPSEC configuration page III for GWG Gateway 2 ..........................................................................120
Figure 102 – IPSec start/stop page for GWG Gateway 1.......................................................................................120
Figure 103 – IPSec tunnel between GWG Gateway and Cisco Router.................................................................122
Figure 104 – LAN Port configuration page for GWG Gateway............................................................................123
Figure 105 – IPSEC configuration page I for GWG Gateway................................................................................124
Figure 106 – IPSec configuration page II for GWG Gateway................................................................................124
Figure 107 – IPSec configuration page III for GWG Gateway...............................................................................124
Figure 108 – IPSec start/stop page for GWG Gateway..........................................................................................125
Figure 109 – IPSec tunnel between GWG Gateway and Juniper SSG..................................................................127
Figure 110 – Network configuration page for GWG Gateway..............................................................................128
Figure 111 – IPSEC configuration page I for GWG Gateway................................................................................129
Figure 112 – IPSec configuration page II for GWG Gateway................................................................................129
Figure 113 – IPSec configuration page III for GWG Gateway...............................................................................130
Figure 114 – IPSec start/stop page for GWG Gateway..........................................................................................130
Figure 115 – Network Interfaces (list).......................................................................................................................131
Figure 116 – Network Interfaces (edit).....................................................................................................................131
Figure 117 – AutoKey Advanced Gateway..............................................................................................................132
Figure 118 – Gateway parameters.............................................................................................................................132
Figure 119 – Gateway advanced parameters...........................................................................................................133
Figure 120 – AutoKey IKE..........................................................................................................................................133
Figure 121 – AutoKey IKE parameters.....................................................................................................................134
Figure 122 – AutoKey IKE advanced parameters...................................................................................................134
Figure 123 – Routing parameters ..............................................................................................................................135
Figure 124 – Policies from untrust to trust zone .....................................................................................................135
Figure 125 – Policies from trust to untrust zone .....................................................................................................136
Figure 126 – Multipoint OpenVPN topology ..........................................................................................................137
Figure 127 – OpenVPN application settings............................................................................................................138
Figure 128 – OpenVPN GWG settings......................................................................................................................140
Figure 129 – Static routes on GWG ...........................................................................................................................140
Figure 130 – Starting OpenVPN application ...........................................................................................................141
Figure 131 – OpenVPN status on PC........................................................................................................................141
Figure 132 – OpenVPN status on GWG ...................................................................................................................141
Figure 133 – Portforwarding example......................................................................................................................142
Figure 134 – GWG port forwarding configuration.................................................................................................143
Figure 135 – Transparent serial connection .............................................................................................................143
Figure 136 – GWG Serial port settings......................................................................................................................144
Figure 137 – GWG settings for Serial-to-IP conversion..........................................................................................145
Figure 138 – Virtual COM port application.............................................................................................................146
Figure 139 – Settings for virtual COM port..............................................................................................................147
Figure 140 – Firewall example...................................................................................................................................149
Figure 141 – Initial firewall configuration on GWG...............................................................................................149
Figure 142 – Filtering of Telnet traffic.......................................................................................................................150
Figure 143 – Filtering of ICMP traffic.......................................................................................................................150
Figure 144 – Allowing ICMP traffic..........................................................................................................................151
Figure 145 – IPSec firewall rules................................................................................................................................151
Figure 146 – Allowing WEB access...........................................................................................................................152
Figure 147 – Outbound rule for WEB access ...........................................................................................................153
Figure 148 – Complete firewall configuration.........................................................................................................154
Figure 149 – Configuration page for SMS management ........................................................................................154
Figure 150 – Configuration page for SIM keepalive...............................................................................................156
8
User Manual
GWG Gateway
List of Tables
Table 1 – Technical parameters....................................................................................................................................16
Table 2 – GWG Gateway software features...............................................................................................................21
Table 3 – LAN parameters............................................................................................................................................34
Table 4 – DHCP Server parameters ............................................................................................................................36
Table 5 – Mobile settings ..............................................................................................................................................38
Table 6 – Routing parameters......................................................................................................................................40
Table 7 – Port forwarding.............................................................................................................................................41
Table 8- DMZ parameters ............................................................................................................................................42
Table 9 – RIP parameters..............................................................................................................................................44
Table 10- VRRP Parameters .........................................................................................................................................46
Table 11 – GRE parameters ..........................................................................................................................................47
Table 12 – IPSec Summary ...........................................................................................................................................50
Table 13 – IPSec Parameters.........................................................................................................................................54
Table 14 – OpenVPN parameters................................................................................................................................58
Table 15- PPTP Parameters ..........................................................................................................................................59
Table 16- L2TP Parameters...........................................................................................................................................61
Table 17– CA Certificate parameters ..........................................................................................................................62
Table 18-Local Certificate parameters ........................................................................................................................63
Table 19–Private Key parameters................................................................................................................................64
Table 20–CRL Certificates ............................................................................................................................................65
Table 21–Preshared Key Files ......................................................................................................................................66
Table 22 – Firewall parameters....................................................................................................................................68
Table 23 - MAC filtering parameters ..........................................................................................................................68
Table 24 – DynDNS parameters ..................................................................................................................................70
Table 25 – Serial Port over TCP/UDP parameters....................................................................................................72
Table 26 – Modbus gateway parameters....................................................................................................................74
Table 27- GPIO Parameters..........................................................................................................................................80
Table 28– Device Identity Parameters ........................................................................................................................81
Table 29 – Authentication parameters........................................................................................................................82
Table 30 – Date/time parameters................................................................................................................................83
Table 31 – Command Line Interface parameters ......................................................................................................87
Table 32 – Remote Management parameters.............................................................................................................88
Table 33 – SNMP parameters.......................................................................................................................................93
Table 34 – Syslog parameters.......................................................................................................................................95
SAFETY WARNINGS:
The power to use an adapter (with output voltage from 9 to 36 VDC) that is certified
EN 60950:2005-1+A1:2010+A2:2013+A11:2009+A12:2011 and in confirmation with article 2.5-LPS (Limited
Power Source).
All pinout (GPIO, Ignition etc.) must be SELV (Safety Extra Low Voltage).
9
User Manual
GWG Gateway
Description of the GWG-30/40 Gateway
Geneko GWG gateway is compact and cost effective communications solution that provides cellular
capabilities for fixed and mobile applications such as data acquisition, smart metering, remote monitoring
and management. GWG supports a variety of radio bands options, on 2G, 3G, 4G cellular technologies. It is
reliable solution thanks to high performance hardware platform and VPN/Security powerful options. When
coupled with the rich embedded intelligence, it is the perfect choice for a broad set of M2M solutions.
GWG comes with numerous connectivity options and multiple configuration methods. It allows you
to connect your existing Ethernet and serial devices using basic configuration. Besides Ethernet, RS-232 and
RS-485 serial ports, the device is equipped with USB port as well as 3 configurable input/output pins. Its
small size and easy installation makes it suitable for challenging and size-constrained applications. GWG
gateway can be used on either desktop or mounted on a DIN rail.
Figure 1 – GWG Gateway
10
User Manual
GWG Gateway
Typical application
Data collection and system supervision
• Extra–high voltage equipment monitoring
• Running water, gas pipe line supervision
• Centralized heating system supervision
• Environment protection data collection
• Flood control data collection
• Alert system supervision
• Weather station data collection
• Power Grid
• Oilfield
• Light Supervision
• Solar PV Power Solutions
Financial and department store
• Connection of ATM machines to central site
• Vehicle based bank service
• POS
• Vending machine
• Bank office supervision
Security
• Traffic control
• Video Surveillance Solutions
Other
• Remote Office Solution
• Remote Access Solution
There are numerous variations of each and every one of above listed applications. Therefore
GENEKO formed highly dedicated, top rated support team that can help you analyze your requirements
and existing system, chose the right topology for your new system, perform initial configuration and tests
and monitor the complete system after installation. Enhance your system performance and speed up the
ROI with high quality cellular routers and all relevant knowledge of GWG support team behind you.
11
User Manual
GWG Gateway
Technical Parameters
Wireless Interfaces – 4G WWAN (Cinterion
PLS8-E)
LTE
800/900/1800/2600 MHz
Transfer rate (max): 100 Mbps down, 50 Mbps up
UMTS/HSPA+/DCHSPA+
900/1800/2100 MHz
Transfer rate (max): 42 Mbps down, 5.76 Mbps up
GSM/GPRS/EDGE
900/1800 MHz
Transfer rate (max): 236.8 Kbps down, 236.8 Kbps up
GSM Connectors
1 or 2 x 50 Ω SMA (Center pin: female)
SIM Slots
1
Wireless Interfaces – 3G WWAN (Cinterion
PHS8-E)
UMTS/HSPA+
900/2100 MHz
Transfer rate (max): 14.4 Mbps down, 5.76 Mbps up
GSM/GPRS/EDGE
900/1800 MHz
Transfer rate (max): 384 Kbps down, 384 Kbps up
GSM Connectors
1 or 2 x 50 Ω SMA (Center pin:
female)
SIM Slots
1
Wireless Interfaces – GNSS (Cinterion PLS8E/PHS8-E)
GNSS Systems
GPS, GLONASS
GNSS Tracking Sensitivity
-159 dBm
GNSS Acquisition Sensitivity
-149 dBm
GNSS Cold Start Sensitivity
-145 dBm
GNSS Cold Start
< 32 seconds TTFF @ -130 dBm
GNSS Connector
1 x 50 Ω SMA (Center pin: female)
12
User Manual
GWG Gateway
Wired Interfaces – RS232
Ports
1
Standard
EIA/TIA-232, RS-232, V.28/ V.24
Data Rate
400 kbps
DTE/DCE
DCE
Signal Support
TXD, RXD, CTS, RTS
Flow Control
Software XON/XOFF, Hardware CTS/RTS
Connector
D-SUB 9, female
Pinout
2: TX,
3: RX,
5: GND,
7: CTS,
8: RTS, remaining pins: NC
Wired Interfaces – RS-485/RS-422
Ports
1
Standard
RS-485/RS-422, 4 wires, Full-Duplex
Data Rate
10 Mbps
On-Board Termination
None
Connector
Phoenix 1844249
Pinout
1: RX+,
2: RX-,
3: TX-,
4: TX+,
5: GND
Wired Interfaces – USB
Ports
1
13
User Manual
GWG Gateway
Standard
USB 2.0 Device
Signaling
Full Speed, High Speed
Connector
USB mini AB
Wired Interfaces – Ethernet
Ports
1
Standard/Physical Layer
IEEE 802.3; 10/100 Base-T
Data Rate/Mode/Interface
10/100 Mbit/s; Full or Half duplex; Auto MDI/MDIX
Connector
RJ-45
Wired Interfaces – Digital Input/Output
(available on GPIO Connector)*
Digital Inputs/Outputs
3 user selectable input or output
Digital Inputs
with internal weak pull-up, active when pulled down
to GND
Digital Outputs
open-drain, 4-28V, no over-current protection
Connector
Phoenix 1844249
Pinout
1: +5VDC with 500mA resettable PTC fuse,
2: IO1,
3: IO2,
4: IO3,
5: GND
Wired Interfaces – Digital Input/Output
(available on Power Connector)
Digital Inputs/Outputs
1 output, 1 ignition sense input
Digital Output
open-drain, 4-28V, 350 mA ressetable PTC fuse
Ignition Sense Input
active when pulled up to 9-36 VDC
Connector
Molex 43045-0400
Pinout
1: +9..36VDC (also Analog Input),
14
User Manual
GWG Gateway
2: GND,
3: Ignition Sense Input,
4: Digital Output
Wired Interfaces – Analog Input (available on
Power Connector)
Analog Input Range
9-36 VDC
Pinout
1: +9..36 VDC (also Analog Input),
2: GND,
3: Ignition Sense Input,
4: Digital Output
Power
Input
9-36V /1A
Input Protection
Reverse polarity, transients, overcurrent (internal 2 A
resettable PTC fuse)
Consumption at 12 VDC
Hibernation (GPS OFF, GSM OFF): TBD mA
Sleep (GPS OFF, GSM wake-up on SMS or call): TBD
mA
Typical (GPS ON, GSM ON): 150 mA
Peak (GPS ON, GSM TX burst for 577 s every 4.615
ms): 1 A
Connector
Molex 43045-0400
Pinout
1: +9..36VDC (also Analog Input),
2: GND,
3: Ignition Sense Input,
4: Digital Output
Physical
Dimensions (L x W x H)
101 mm x 88 mm x 30 mm
(connectors and rubber stands included)
15
User Manual
GWG Gateway
Weight
248 g
Status LEDs
Power, Signal, Network, LAN (on Ethernet connector:
Link, Activity)
Pushbuttons
1 – Device Reset (short press)/Factory Default (long
press)
Material
Steel sheet 0.8 mm
Mounting
desktop, wall, or DIN rail (DIN rail mounting kit sold
separately)
Environmental
Operating Temperature
-20° C to +70° C
Storage Temperature
-40° C to +85° C
Relative Humidity
5% to 95% (non-condensing)
IP rating
IP40
Ethernet Isolation
1.5 kV RMS
RS-485 Port Protection (ESD)
2 kV
Approvals
Safety
EN 60950-1:2006 + A1:2010 + A2:2013 + A11:2009 +
A12:2011
EMC
EN 301 489-1 V1.9.2, EN 301 489-7 V1.3.1, EN 301 48917 V2.1.1, EN 301 489-24
V1.5.1
Radio Spectrum
EN 301 511 v9.0.2, EN 301 908-2 v5.2.1, EN 301 908-13
v5.2.1, EN 300 328 v1.8.1
Accessories (included)
16
User Manual
GWG Gateway
Power supply cable
Cable length: 1.2 m
Cable connector: Molex 43025-0400
Wires: 4 wires, stranded, AWG-22
Pinout: 1 (red) POWER, 2 (black) GND, 3 (white)
IGNITION, 4 (green) GPIO OUT
3G/GSM antenna
Frequency: 850/900/1800/1900/2100 MHz
VSWR: ≤ 2.0
Gain: 4.5 dBi
Connector: SMA (Center pin: male)
Dimensions (L x W x H): 163 mm x 22 mm x 14 mm
Accessories (optional)
AC/DC adapter
Input: 90-264 VAC, 47-63 Hz
Output: 12 V /1A
GSM antenna extension cable with magnetic
base
Cable length: 3 m
Cable connector: SMA (Center pin: male)
Magnet base connector: SMA (Center pin: female)
Magnet base dimensions (D x H): 50 mm x 40 mm
Active uBlox GPS antenna with magnetic base
Cable length: 5 m
Cable connector: SMA (Center pin: male)
Frequency: 1575 ± 3 MHz
LNA Gain: 27 db
VSWR: max. 2
Dimensions (L x W x H): 48 mm x 40 mm x 13 mm
DIN rail mounting kit
DIN rail clip 3 screws
Table 1 – Technical parameters
17
User Manual
GWG Gateway
Protocols and features
Features
Description
Network
Routing
Static, NAT, PAT
DHCP server
DHCP server support
VRRP
VRRP (Virtual Router Redudancy Protocol) protocol increases the
availability and reliability of routing paths via automatic default
gateway.
Port forwarding
Port forwarding is an application of NAT ( Network Address
Translation) that redirects a communication request from one
address and port number combination to another while the packets
are traversing a network gateway.
DMZ host
DMZ (Demilitarized Zone) allows one IP Address to be exposed to
the Internet. DMZ provides this function by forwarding all the ports
to one computer at the same time. This setting allows one local user
to be exposed to the Internet to use a special–purpose services such
as Internet gaming, Video–conferencing and etc.
DynDNS
Client for various dynamic DNS services. This is a small utility for
updating your host name for the any of the dynamic DNS service
offered at:
http://www.ez-ip.net, http://www.justlinux.com,
http://www.dhs.org, http://www.dyndns.org,
http://www.ods.org, http://www.dyn.ca, http://www.tzo.com,
http://www.easydns.com, http://www.dyns.cx,
http://www.zoneedit.com, http://www.no-ip.org.
NTP
NTP (Network Time Protocol) is a protocol for synchronizing the
clocks of router.
Serial port
Modbus gateway carries out translation between Modbus/TCP and
Modbus/RTU. This means that Modbus serial slaves can be directly
attached to the unit's serial ports without any external protocol
converter.
FIREWALL:
• IP Filtering
• MAC Filtering
IP address / Network filtering
SMS :
• SMS Remote Control
• Send SMS
SMS remote control feature allows users to execute a short list of
predefined commands by sending SMS messages to the GWG-30/40
gateway.
Sending SMS messages is possible with this application. The SMS
message will be sent after entering Phone number and Message and
by pushing button Send.
GPS
GPS page will show a graphical view of router’s location. Modem
must provide capabilities of GPS, the router must be connected to
GPS antenna, coordinates are connected and GPS support is enabled,
GPS information will be displayed.
18
User Manual
GWG Gateway
VPN(VirtualPrivateNetwork)
GRE
GRE (Generic Routing Encapsulation) is a tunneling protocol that
can encapsulate a wide variety of network layer protocol packet
types inside IP tunnels.
GRE keepalive
Keepalive for GRE tunnels
Cisco compliant
GRE-max.number of tunnels
3
IPsec
IPSec (Internet Protocol Security) is a protocol suite for securing
Internet Protocol communication by authenticating and encrypting
each IP packet of a data stream.
Data integrity
HMAC-MD5, SHA1
Authentication and key management
Authenticate Mode
• Pre-shared secret
• Username / password
• X.509 cert. (client)
• X.509 (server)
Encryption
AES(128/192/256)
3DES
Blowfish(128/192/256).
IKE features
IKE with pre-shared key
IPSec IKE failover
Defines number of failed IKE negotiation attempts before failover.
IPSec tunnel failover
Switches to another provider when tunnel performance is bad or one
provider is unavailable.
IPSec-max. number of tunnels
3
OpenVPN
OpenVPN is a full-featured SSL VPN solution for securing
communications via the Internet. Implements OSI layer 2 or 3 secure
network extension using the industry standard SSL/TLS protocol,
with support of flexible client authentication methods based on
certificates, pre-shared secrets and username/password credentials.
OpenVPN offers a cost-effective, lightweight alternative to other
VPN technologies that is well-targeted for enterprise markets.
OpenVPN max. number of
tunnels
3
L2TP
L2TP is suitable for Layer-2 tunneling.
L2TP max. number of tunnels
5
PPTP
PPTP (Point-to-Point Tunneling Protocol) client PPTP uses a control
channel over TCP and a GRE tunnel operating to encapsulate PPP
packets.
19
User Manual
GWG Gateway
Certificatemanagement
CA Certificate
CA Certificate is used to manage CA certificate files so they can be
used for peer authentication.
Certification authority (CA) certificates are certificates that are
issued by a CA to itself or to a second CA for the purpose of creating
a defined relationship between the two CAs.
A certificate that is issued by a CA to itself is referred to as a trusted
root certificate, because it is intended to establish a point of ultimate
trust for a CA hierarchy.
Once the trusted root has been established, it can be used to
authorize subordinate CAs to issue certificates on its behalf.
Although the relationship between CAs is most commonly
hierarchical, CA certificates can also be used to establish trust
relationships between CAs in two different public key infrastructure
(PKI) hierarchies.
In all of these cases, the CA certificate is critical to defining the
certificate path and usage restrictions for all end entity certificates
issued for use in the PKI.
There are options to first browse for the file, then to upload the file.
After one or more files are uploaded, a table with uploaded files is
shown with the option to delete each of them if they are no longer
needed.
Local Client Certificates
Local Client Certificates is used to manage local client certificate files
so they can be used for peer authentication.
In cryptography, a client certificate is a type of digital certificate that
is used by client systems to make authenticated requests to a remote
server.
Client certificates play a key role in many mutual authentication
designs, providing strong assurances of a requester's identity.
There are options to first browse for the file, then to upload the file.
After one or more files are uploaded, a table with uploaded files is
shown with the option to delete each of them if they are no longer
needed.
Local Private Certificates
Local Private Certificates is used to manage local private (selfsigned) certificate files so they can be used for peer authentication.
In cryptography, a client certificate is a type of digital certificate that
is used by client systems to make authenticated requests to a remote
server.
Client certificates play a key role in many mutual authentication
designs, providing strong assurances of a requester's identity.
There are options to first browse for the file, then to upload the file.
After one or more files are uploaded, a table with uploaded files is
shown with the option to delete each of them if they are no longer
needed.
Key files
Key files is used to manage textual key files with shared secret
written into them so the same file can be used on more peers for
their authentication.
There are options to first browse for the file, then to upload the file.
After one or more files are uploaded, a table with uploaded files is
shown with the option to delete each of them if they are no longer
needed.
20
User Manual
GWG Gateway
GSM/UMTSfeatures
Authentication
This field specifies password authentication protocol. From the pop
up window choose appropriate protocol (PAP, CHAP, PAP-CHAP).
Operator locking
This option forces your SIM card to register to predefined PLMN
only.
Roaming protection
By enabling this option router will be able to connect to roaming
network.
Reset Location information
By enabling this option router will erase LOCI Elementary File in
SIM card. This will cause SIM card to scan all available networks
when registering.
SIM keepalive
Make some traffic periodically in order to maintain connection
active.
SIM data limit
Enable traffic data limit per SIM.
Serial port
The Geneko Router provides a way for a user to connect from a
network connection to a serial port. It provides all the serial port
setup, a configuration file to configure the ports, a control login for
modifying port parameters, monitoring ports, and controlling ports.
The Geneko Router supports RFC 2217 (remote control of serial port
parameters).
Modbus gateway carries out translation between Modbus/TCP and
Modbus/RTU. This means that Modbus serial slaves can be directly
attached to the unit's serial ports without any external protocol
converter.
USB port
USB host port is available and highly customized for our users. With
additional implementation in software user now can use more than
one usb storage on the device, exactly, up to eight partitions on one
medium or usb mediums extended with usb hub. By default, first
partition is reserved for logging feature, and will automatically
mounted as log partition.
Maintenance
System control
Create a scheduled task to reboot the device at a regular interval.
Device Identity Settings
There is an option to define name, location of device and description
of device function. These data are kept in device permanent
memory.
Authentication
Used for activating and deactivating device access system through
Username and Password mechanism.
Date and time settings
Current Date and Time
Date and Time Setup:
• Manually
• Automatically
Diagnostics
Ping utility
Import/Export settings
To import a configuration file, first specify where your backup
configuration file is located. Click Browse, and then select the
appropriate configuration file. To export the Router’s current
configuration file select the part of the configuration you would like
to backup and click Export. By default, this file will be called
21
User Manual
GWG Gateway
Configuration.tar.gz. This file contains confFile.bkg , cacert and
crlcert , Iccert files.
Factory default settings
Returns to factory default settings.
Reboot
System reboot
LED
LED Settings:
• Top
• Side
• Both
GPIO
GPIO sends SMS when some certain event occur.
On router’s board are 5 GPIO generic pins which represent:
1. +5VDC with 500mA resettable PTC fuse
2. IO1
3. IO2
4. IO3
5. GND
IO1, IO2, IO3 are 3 user selectable input or output.
Input value is readable (high=1, low=0).
Output value is writable (high=1, low=0).
PIN state
Action executed when GPIO pin change its state to Low or High.
Selecting an action will open a new SMS settings section for setting
the parameters.
Management
User-friendly WEB GUI
HTTP based
CLI:
• SSH
• telnet
• serial
Remote management over SSH.
Remote management over Telnet.
SNMP v1,2c
SNMP (Simple Network Management Protocol) is a network
protocol that provides network administrators with the ability to
monitor the status of the GWG-30/40 gateway and receive
notification of any critical events as they occur on the network. The
GWG-30/40 gateway supports SNMP v1/v2c and all relevant
Management Information Base II (MIBII) groups.
Traffic and event log
Log tracing.
Connection Manager
Enabling Connection Manager will allow Connection
Wizard(located on setup CD that goes with the gateway) to guide
you step–by–step through the process of device detection on the
network and setup of the PC–to–device communication. Thanks to
this utility user can simply connect the gateway to the local network
without previous setup of the gateway. Connection Wizard will
detect the device and allow you to configure some basic functions of
the router.
Customizationoptions
Chroot environment
Support for shell scripts, LUA. Perl and compiled C/C++
executables. Allowed access to device peripherals from user space.
Table 2 – GWG Gateway software features
*LTE is available at GWG-40.
22
User Manual
GWG Gateway
Product Overview
Front panel
On the front panel the following connectors are located:
• One RJ45 connector Ethernet port for connection into local computer network
• One RJ45 connector for RS232 serial communication
• One RS-485 connector
• One USB connector for connection to the PC
Ethernet connector LED:
• ACT (yellow) on – Network traffic detected (off when no traffic detected),
• Network Link (green LED) on – Ethernet activity or access point engaged.
Figure 2– GWG Gateway front panel
Back panel
On the back panel of device the following connectors are located:
• Power supply connectors
• SMA connector for connection of the GSM/UMTS/LTE antenna (main)
• Reset button
• GPIO connector
23
User Manual
GWG Gateway
Figure 3– GWG Gateway rear panel
The Reset button can be used for a warm reset or a reset to factory defaults.
Warm reset: If the GWG Gateway is having problem connecting to the Internet, press and hold the
reset button for a second using the tip of a pen.
Reset to Factory Defaults: To restore the default settings of the GWG Gateway, hold the RESET
button pressed for a few seconds. Restoration of the default configuration will be signaled by blinks of the
power LED on the top panel and the side. This will restore the factory defaults and clear all custom settings
of the GWG Gateway. You can also reset the GWG Gateway to factory defaults using the Maintenance >
Default Settings screen.
Top Panel
Figure 4 – GWG Gateway top panel side
24
User Manual
GWG Gateway
LED Indicator Description:
Power LED- This monitors the input power.
• OFF –No power or input voltage ≥36VDC or ≤7.5VDC
• Flashing Green- The device is entering low power mode or system low level boot.
• Green- The device is connected to nominal power and is operating normally.
• Green with a momentary red flash- The device has a GPS fix.
Signal LED-This shows the cellular network’s signal level.
• OFF-No signal is present. (RSSI>-110dBm)/ There is no network coverage at the location.
• Flashing Green- A bad or marginal signal is present. (RSSI> -85dBm or ≤ -110 dBm)
• Green- A good signal is present. (RSSI≤ -85dBm)
Network LED-This monitors the cellular network.
• Off-The device was unable to authenticate on the network.
• Flashing green (slow)- The cellular network is found and the device is connecting.
• Green- Connected to the cellular network.
• Flashing Green (fast)- The device is roaming.
Bottom Panel
SIM card holder is on the bottom of the GWG Gateway.
Figure 5– GWG Gateway bottom panel
Putting Into Operation
Before putting the GWG Gateway in operation it is necessary to connect all components needed for
the operation:
• GSM/UMTS antenna,
25
User Manual
GWG Gateway
• Ethernet cable and
• SIM card must be inserted.
And finally, device should have powered up using power supply adapter.
Power consumption of GWG Gateway is 2W in standby and 3W in burst mode.
SIM card must not be changed, installed or taken out while device operates. This procedure is
performed when power supply is not connected.
Device Configuration
There are two methods which can be used to configure the GWG Gateway. Administrator can use
following methods to access router:
• Web browser,
• Command line interface.
Default access method is by web interface. This method provides administrator full set of privileges
for configuring and monitoring the GWG Gateway. Configuration, administration and monitoring of the
GWG Gateway can be performed through the web interface. The default IP address of the router is
192.168.1.1. Another method is by Command Line Interface (CLI). This method has limited options for
configuring the GWG Gateway but still represents a very powerful tool when it comes to gateway setup and
monitoring. Another document deals with CLI commands and instructions.
Quick start
INSERTING SIM CARDS
Warning: do not insert or eject SIM cards while gateway is powered on. Make sure to disconnect gateway
from AC/DC adapter (9-36VDC) before inserting or ejecting SIM cards.
* Use a screwdriver to remove the cover from the back of the GWG Gateway
*UNLOCK SIM card holder
*Lift the SIM card HOLDER and put SIM card in it
*LOCK SIM card holder
*Put the cover back and use screwdriver to tighten the screw
26
User Manual
GWG Gateway
Figure 6 – Insert SIM card
CONNECTING GATEWAY
*Connect antenna to gateway. Make sure to tighten antenna so it is not loose.
* Plug AC/DC adapter (9-36VDC) cable into POWER CONNECTOR on the gateway.
*Red wire-power
*Black wire-ground
*Green wire-GPIO output
*White wire-ignition
*All wires must be isolated
Figure 7 – Wires for power, ground, GPIO output, ignition
27
User Manual
GWG Gateway
* Green POWER indicator will turn on.
* Wait approximately 52 seconds for gateway to become fully operational.
* Plug one side of ETHERNET CABLE to ETHERNET CONNECTOR on a gateway.
* Plug other side of ETHERNET CABLE to Ethernet port on the computer.
ADMINISTRATION WEB PAGE
Add network 192.168.1.0/24 to the interface on your PC
* Optional: Ping 192.168.1.1 to check if the gateway is accessible
* Open your Web browser (e.g. Firefox, Chrome, Safari, Opera, or Internet Explorer) and enter the following
address: http://192.168.1.1
* When prompted for your login credentials, use "admin" (without quotes) for both username and
password.
* After logging in you should be able to see administration web page, which allows you to easily setup the
gateway.
QUICK SETUP
* Once logged in to administration web page, click on SETTINGS » MOBILE SETTINGS link from the menu
on the left side of the screen.
* If SIM card is present, ENABLED check box will be checked. Otherwise, you need to insert SIM card as
explained in "Inserting SIM cards" chapter.
* Your GSM operator should provide you with PROVIDER, USERNAME (optional), PASSWORD (optional),
APN and PIN (optional) information. Make sure you enter this into corresponding fields, and then click on
SAVE button.
* Flashing red NETWORK indicator will turn on.
*After a few minutes when your gateway is connected, connection status will be accomplished.
*Green NETWORK indicator will turn on.
* Click on SETTINGS » ETHERNET SETTINGS »LAN PORTS link from the menu on the left side of the
screen
TURN LOGGING ON
When troubleshooting gateway make sure logs are turned on.
You should send logs to Geneko when submitting support request.
* Click on MANAGEMENT » LOGS link from the menu on the left side of the screen.
* Click on LOCAL SYSLOG radio button, and then click on SAVE button.
* Set appropriate log size and click on SAVE button.
* Log is now available for download from gateway to your computer when you click on EXPORT LOG
button.
28
User Manual
GWG Gateway
Device configuration using web application
The GWG Gateway’s web–based utility allows you to set up the Gateway and perform advanced
configuration and troubleshooting. This chapter will explain all of the functions in this utility.
For local access to the GWG Gateway’s web–based utility, launch your web browser, and enter the
Gateway’s default IP address, 192.168.1.1, in the address field. A login screen prompts you for your
Username and Password. Default administration credentials are admin/admin.
If you want to use web interface for gateway administration please enter IP address of gateway into
web browser. Please disable Proxy server in web browser before proceed.
Figure 8 – User authentication
After successfully finished process of authentication of Username/Password you can access Main
Configuration Menu.
You can set all parameters of the GWG Gateway using web application. All functionalities and
parameters are organized within few main tabs (windows).
29
User Manual
GWG Gateway
Add/Remove/Update manipulation in tables
To Add a new row (new rule or new parameter) in the table please do following:
• Enter data in fields at the bottom row of the table (separated with a line).
• After entering data in all fields click Add link.
To Update the row in the table:
• Change data directly in fields you want to change.
To Remove the row from the table:
• Click Remove link to remove selected row from the table.
Save/Reload changes
To save all the changes in the form press Save button. By clicking Save data are checked for validity. If they
are not valid, error message will be displayed. To discard changes press the Reload button. By clicking
Reload, previous settings will be loaded in the form.
30
User Manual
GWG Gateway
Status Information
The GWG Gateway’s Status menu provides general information about gateway as well as real–time
network information. Status information is divided into following categories:
General Information
Lan Information
DHCP
Mobile
Firewall
Routes
Router Monitoring
Status – General
General Information Tab provides general information about device type, device firmware version,
RootFS version, Kernel version, CPU info, Current Time, UpTime, Total Memory, Used Memory, Free
Memory, MAC Address. Screenshot of General Gateway information is shown at Error! Reference source
not found.. Data in Status menu are read only and cannot be changed by user. If you want to refresh screen
data press Refresh button.
SIM Card detection is performed only at time booting the system, and you can see the status of SIM
slot by checking the Enable SIM Card Detection option.
Figure 9– General gateway information
Status – LAN Port Information
Lan Port Information Tab provides information about Ethernet port and Ethernet traffic statistics.
Screenshot of Lan Port Information is shown in Figure 10.
31
User Manual
GWG Gateway
Figure 10– LAN Port Information
Status – DHCP
DHCP Information Tab provides information about DHCP clients with IP addresses gained from
DHCP server, MAC addresses, expiration period, and lease status.
Figure 11 – DHCP Information
Status – Mobile Information
Mobile Information Tab provides information about GPRS/EDGE/HSPA/HSPA+/LTE connection
and traffic statistics. Mobile information menu has three submenus which provide information about:
GPRS/EDGE/HSPA/HSPA+/LTE mobile module(manufacturer and model),
Mobile operator and signal quality,
Mobile traffic statistics (in bytes)
Screenshot of Mobile information from the router is shown in Figure 12:
32
User Manual
GWG Gateway
Figure 12– Mobile Information
As a primary and secondary DNS are always displayed DNS servers assigned by provider. They are
not necessarily used by the gateway. If Local DNS is configured it has priority to those DNS servers.
Status – Firewall
Firewall Information Tab provides information about active firewall rules divided in three groups:
INPUT, FORWARD and OUTPUT chain. Each of these groups has packet counter which can be cleared with
one of three displayed button: Reset INPUT, Reset FORWARD and Reset OUTPUT.
Figure 13– Firewall Information
33
User Manual
GWG Gateway
Status – Router Monitoring
Router Monitoring tab provides Base information, LAN and Mobile real-time information LAN,
Mobile, Wireless statistics and information about Mobile Connection. You can activate Automatic refresh
after 5, 10, 15, 30 or 60 seconds.
Figure 14– Router monitoring #1
Figure 15– Router monitoring #2
Status – GPS
This page will show a graphical view of router’s location. Modem must provide capabilities of GPS,
the router must be connected to GPS antenna, coordinates are connected and GPS support is enabled, GPS
34
User Manual
GWG Gateway
information will be displayed. If no information is displayed, check that both the modem and your carrier
support GPS. If GPS is supported, make sure the modem is in an area where it can receive a signal from the
GPS satellites.
Settings – LAN Ports
Click LAN Ports Tab, to open the LAN network screen. Use this screen to configure LAN TCP/IP
settings.
LAN Ports Parameters
Label Description
Method
Select static or DHCP. With DHCP option, the router will obtain an IP address
from DHCP server on the LAN.
Metric
This field specifies value which define routing priority
IP Address
Type the IP address of your GWG Gateway in dotted decimal notation.
192.168.1.1 is the factory default IP address.
Subnet Mask
The subnet mask specifies the network number portion of an IP address. The
GWG Gateway support sub–netting. You must specified subnet mask for your
LAN TCP/IP settings.
Gateway
Type the IP address of your local gateway. Use Local Gateway option carefully.
Gateway becomes unreachable from local subnet when this option is entered.
A
lias IP Address
IP address of internal virtual LAN interfaces (secondary).
A
lias Subnet Mask
Corresponding subnet mask for this alias.
Primary DNS
Type the IP address of your primary local DNS server.
Secondary DNS
Type the IP address of your secondary local DNS server.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save button to save your changes back to the GWG Gateway. Whether you
make changes or not, gateway will reboot every time you click Save.
Table 3 – LAN parameters
Figure 16– LAN Port configuration page
35
User Manual
GWG Gateway
Settings – DHCP Server
The GWG Gateway can be used as a DHCP (Dynamic Host Configuration Protocol) server on your
network. A DHCP server automatically assigns available IP addresses to computers on your network. If you
choose to enable the DHCP server option, computers on your LAN which will use DHCP server must be set
to obtain an IP address automatically from a DHCP server. (By default, Windows computers are set to
obtain an IP automatically.)
To use the GWG Gateway as your network’s DHCP server, click DHCP Server Tab for DHCP Server
setup. The GWG Gateway has built–in DHCP server capability that assigns IP addresses and DNS servers to
systems that support DHCP client capability.
DHCP Server Parameters
Label Description
Enable DHCP Server
To activate DHCP server, click checkbox Enable DHCP Server. To setup DHCP
server fill in the IP Starting Address (from) and IP Ending Address (to) fields. When
checkbox is unchecked,
y
ou must have another DHCP server on your LAN, or the
computers must be manually configured.
IP address range
This field specifies the IP address pool for assigning IP addresses. Address range
must be in the same network (subnet) as the router's LAN port.
IP Address range
(From)
This field specifies the first of the contiguous addresses in the IP address pool.
IP Address range (To)
This field specifies last of the contiguous addresses in the IP address pool.
Lease Duration
This field specifies DHCP session duration time.
Gateway
This field specifies default gateway for DHCP clients. If left blank, router will
become the gateway.
Network/netmask
This field shows current network and netmask of the gateway (DHCP server).
Primary DNS,
Secondary DNS
This field specifies IP addresses of DNS server that will be assi
g
ned to systems that
support DHCP client capability.
Select None to stop the DHCP Server from assi
g
ning DNS server IP address. When
y
ou select None, computers must be manually configured with proper DNS IP
address.
Select Used by ISP to have the GWG Gatewa
y
assign DNS IP address to DHCP
clients. DNS address is provided b
y
ISP (automatically obtained from WAN side).
This option is available onl
y
if mobile connection is active. Please establish mobile
connection first and then choose this option.
Select User defined to have the GWG Gatewa
y
assigns DNS IP address to DHCP
clients. DNS address is manually configured by user.
Static Lease
Reservation
This field specifies IP addresses that will be dedicated to specific DHCP Client
based on MAC address. DHCP server will alwa
y
s assign same IP address to
appropriate client.
A
ddress Exclusions
This field specifies IP addresses that will be excluded from the pool of DHCP IP
address. DHCP server will not assign this IP to DHCP clients.
Add
Click Add to insert (add) new item in table to the GWG Gateway.
Remove
Click Remove to delete selected item from table.
36
User Manual
GWG Gateway
Save
Click Save to save your changes back to the GWG Gateway.
Reload
Click Reload to discard any changes and reload previous settings.
Table 4 – DHCP Server parameters
Figure 17 – DHCP Server configuration page
Settings – Mobile Settings
Click Mobile Settings Tab, to open the Mobile Settings screen. Use this screen to configure the GWG
Gateway GPRS/EDGE/HSPA/HSPA+/LTE parameters on Figure 18.
37
User Manual
GWG Gateway
Figure 18– Mobile Settings configuration page
Mobile Settings
Label Description
Provider
This field specifies name of GSM/UMTS ISP. You can setup any name for provider.
A
uthentication
This field specifies password authentication protocol. From the pop up window
choose appropriate protocol (PAP, CHAP, PAP - CHAP)
Username
This field specifies Username for client authentication at GSM/UMTS network.
Mobile provider will assign you specific username for SIM card.
Password
This field specifies Password for client authentication at GSM/UMTS network.
Mobile provider will assign you specific password for each SIM card.
A
PN
This field specifies APN for client authentication at GSM/UMTS network. Mobile
provider will assign you specific APN for SIM card.
Connection Type
This field enables you to choose between GSM and UMTS network.
Dial String
This field specifies Dial String for GSM/UMTS modem connection initialization. In
most cases
y
ou have to change only APN field based on parameters obtained from
Mobile Provider.
38
User Manual
GWG Gateway
SIM PIN locking
(PIN enabled)
Enable locking of SIM card with PIN code.
Enable operator
locking
This option forces your SIM card to register to predefined PLMN only.
Roaming protection
By enabling this option router will be able to connect to roaming network.
Reset Location
information
By enabling this option router will erase LOCI Elementary File in SIM card. This
will cause SIM card to scan all available networks when registering.
Number of retries
This field specifies number of attempts to establish connection.
Default Gateway
Metric
Set the metric for mobile network interface as the default gateway.
Persistent connection
Keep connection alive, try to reopen the connection if it is broken.
Reboot after failed
connections
Reboot gateway after 'n' consecutive failed connection attempts
Enable SIM keepalive
Make some traffic periodicall
y
in order to maintain connection active. You can set
keepalive interval value in minutes.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save to save your changes back to the GWG Gateway.
Refresh
Click Refresh to see updated mobile network status.
Connect/
Disconnect
Click Connect/Disconnect to connect or disconnect from mobile network.
Table 5 – Mobile settings
Figure 18 shows screenshot of GSM/UMTS/LTE tab configuration menu. GSM/UMTS/LTE menu is
divided into two parts.
• Upper part provides all parameters for configuration GSM/UMTS/LTE connection. These
parameters can be obtained from Mobile Operator. Please use exact parameters given from Mobile
Operator.
• Bottom part is used for monitoring status of GSM/UMTS/LTE connection
(create/maintain/destroy GSM/UMTS/LTE connection). Status line show real–time status:
connected/disconnected.
If your SIM Card credit is too low, the GWG Gateway will performed periodically connect/disconnect
actions.
Settings – Routing
The static routing function determines the path that data follows over your network before and after
it passes through the GWG Gateway. You can use static routing to allow different IP domain users to access
the Internet through the GWG Gateway. Static routing is a powerful feature that should be used by
advanced users only. In many cases, it is better to use dynamic routing because it enables the GWG Gateway
to automatically adjust to physical changes in the network’s layout.
39
User Manual
GWG Gateway
The GWG Gateway is a fully functional gateway with static routing capability. Figure 19 shows
screenshot of Routing page.
Figure 19– Routing configuration page
Use this menu to setup all routing parameters. Administrator can perform following operations:
• Create/Edit/Remove routes (including default route),
• Reroute GRE and IPSEC packet to dedicated destination at inside network
• Port translation – Reroute TCP and UDP packets to desired destination inside the network.
Routing Settings
Label Description
Routing Table
Dest Network
This parameter specifies the IP network address of the final destination. Routin
g
is alwa
y
s based on network number. If you need to specify a route to a single
host, use a subnet mask of 255.255.255.255 in the subnet mask field to force the
network number to be identical to the host ID.
Netmask
This parameter specifies the IP netmask address of the final destination.
Gateway
This parameter specifies the IP network address of the final destination. Routin
g
is always based on network number. If you need to specif
y
a route to a single
host, use a subnet mask of 255.255.255.255 in the subnet mask field to force the
network number to be identical to the host ID.
Metric
Metric represents the "cost" of transmission for routin
g
purposes. IP routing uses
hop count as the measurement of cost, with a minimum of 1 for directl
y
connected networks. Enter a number that approximates the cost for this link. The
number does not need to be precise, but it must be between 1 and 15. In practice,
2 or 3 is usually a good number.
Interface
Interface represents the "exit" of transmission for routin
g
purposes. In this case
br0 represent LAN interface an ppp0 represent GSM/UMTS/LTE interface of the
GWG Gateway.
Add
Click Add to insert (add) new item in table to the GWG Gateway.
Remove
Click Remove to delete selected item from table.
Reload
Click Reload to discard any changes and reload previous settings.
40
User Manual
GWG Gateway
Save
Click Save to save your changes back to the GWG Gateway. After pressing Save
button it make take more than 10 seconds for
g
ateway to save parameters and
become operational again.
Table 6 – Routing parameters
Port forwarding
Port forwarding is an application of NAT ( Network Address Translation) that redirects a
communication request from one address and port number combination to another while the packets are
traversing a network gateway.
For incoming data, the GWG Gateway forwards IP traffic destined for a specific port, port range or
GRE/IPsec protocol from the cellular interface to a private IP address on the Ethernet “side” of the GWG
Gateway.
Figure 20– Port forwarding
TCP/UDP Traffic forwarding
Enable Network
A
ddress Translation
(NAT)
This field specifies if NAT is used on the router.
Protocol
This field specifies the IP protocol type. Choose between TCP and UDP protocol.
Source IP
This field specifies incoming IP address for which port forwarding is configured.
Source Netmask
This field specifies incoming IP address netmask for allowed IP subnet.
Source Interface
Select interface where port forwarding is done. Port forwarding from outside
(WAN) interface to inside (LAN) interface is done on PPP, and in reverse
direction on Ethernet interface.
Destination IP
This field specifies destination IP address for which port forwarding is
configured.
Destination Netmask
This field specifies destination IP address netmask.
Destination Start Port
This is the TCP/UDP start port of incoming traffic.
Destination End Port
This is the TCP/UDP end port of incoming traffic.
Target IP
This field specifies to which address will traffic be forwarded.
Target Start Port
This field specifies starting port for which the traffic will be forwarded.
Target End Port
This field specifies ending port for which the traffic will be forwarded.
41
User Manual
GWG Gateway
Add
Click Add to insert (add) new item in table to the GWG Gateway.
Remove
Click Remove to delete selected item from table.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save to save your changes back to the GWG Gateway. After pressing Save
button it make take more than 10 seconds for router to save parameters and
become operational again.
Table 7 – Port forwarding
42
User Manual
GWG Gateway
Settings – Demilitarized Zone (DMZ)
DMZ (Demilitarized Zone) allows one IP Address to be exposed to the Internet. Because some
applications require multiple TCP/IP ports to be open, DMZ provides this function by forwarding all the
ports to one computer at the same time. In other words, this setting allows one local user to be exposed to
the Internet to use a special–purpose services such as Internet gaming, Video–conferencing and etc. Host
which will be exposed to the Internet must always have the same IP address, added manually or through
DHCP server static lease.
Figure 21– DMZ configuration page
DMZ Settings
Label Description
DMZ Settings
Enable
This field specifies if DMZ settings is enabled at the GWG Gateway.
IP address from LAN
IP address which will be exposed to the Internet. This will secure rest of the
internal network from external access.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save to save your changes back to the Geneko Gateway.
Table 8- DMZ parameters
Routing Information Protocol (RIP)
The Routing Information Protocol (RIP) is a dynamic routing protocol used in local and wide area
networks. As such it is classified as an interior gateway protocol (IGP) using the distance–vector routing
algorithm. The Routing Information Protocol provides great network stability, guaranteeing that if one
network connection goes down the network can quickly adapt to send packets through another connection.
Click RIP Tab, to open the Routing Information Protocol screen. Use this screen to configure the
GWG Gateway RIP parameters.
43
User Manual
GWG Gateway
Figure 22– RIP configuration page
44
User Manual
GWG Gateway
RIP Settings
Label Description
Routing Manager
Hostname
Prompt name that will be displayed on telnet console.
Password
Login password.
Port to bind at
Local port the service will listen to.
RIPD
Hostname
Prompt name that will be displayed on telnet console of the Routing Information
Protocol Manager.
Password
Login password.
Port to bind at
Local port the service will listen to.
Routing Information Protocol Status
Start
Start RIP.
Stop
Stop RIP.
Restart
Restart RIP.
Save
Click Save to save your changes back to the GWG Gateway.
Reload
Click Reload to discard any changes and reload previous settings.
Table 9 – RIP parameters
Important: settings must be saved from console in order to be returned after router reboot or
export of configuration. It is done with command 'ripd# write' or 'ripd# copy running-config startup-
config'.
RIP routing engine for the GWG Gateway
Use telnet to enter in global configuration mode.
telnet 192.168.1.1 2602 // telnet to br0 at TCP port 2602///
After telnet, type enable followed by conf t and router rip to enter RIP configuration mode.
To associates a network with a RIP routing process, use following commands:
• ripd(config-router)# network [A.B.C.D/Mask]
By default, the GWG Gateway receives RIP version 1 and version 2 packets. You can configure the
GWG Gateway to receive and send only version 1. Alternatively, you can configure the GWG Gateway to
receive and send only version 2 packets. To configure GWG Gateway to send and receive packets from only
one version, use the following command:
ripd(config-router)# version [1|2] // Same as other router //
45
User Manual
GWG Gateway
Disable route redistribution:
• ripd(config-router)# no redistribute kernel
• ripd(config-router)# no redistribute static
• ripd(config-router)# no redistribute connected
Disable RIP update (optional):
• ripd(config-router)# passive-interface br0
• ripd(config-router)# no passive-interface br0
Routing protocols use
several timer that determine such variables as the frequency of routing updates, the
length of time before a route becomes invalid, an other parameters. You can adjust these timer to tune
routing protocol performance to better suit your internetwork needs. Use following command to setup RIP
timer:
• ripd(config-router)# timers basic [UPDATE-INTERVAL] [INVALID] [TIMEOUT] [GARBAGE-
COLLECT]
• ripd(config-router)# no timers basic
Configure interface for RIP protocol (first type exit if you are at ripd(config-router) to get up from configrouter to config mode).
• ripd(config)# interface greX
• ripd(config-if)# ip rip send version [VERSION]
• ripd(config-if)# ip rip receive version [VERSION]
Disable rip authentication at an interface.
• ripd(config-if)# no ip rip authentication mode [md5|text]
Debug commands:
• ripd(config)# debug rip
• ripd(config)# debug rip events
• ripd(config)# debug rip packet
• ripd(config)# terminal monitor
Routing – VRRP
Virtual Router Redundancy Protocol is a protocol which elects a master server on a LAN and the
master answers to a 'virtual IP address'. If it fails, a backup server takes over the IP address.
VRRP specifies an election protocol to provide the virtual router function described earlier. All protocol
messaging is performed using IP multicast datagrams, thus the protocol can operate over a variety of multiaccess LAN technologies supporting IP multicast. Each VRRP virtual router has a single well-known MAC
address allocated to it.
46
User Manual
GWG Gateway
Figure 23– VRRP
VRRP
Label Description
Enabled
Select this option to enable VRRPD service
Virtual Router ID
Enter Virtual Router Identifier (VRID) [1-255], which is the same for all physical
routers for virtual router with this ID in the network.
Priority
Routers have a priority of between 1-255 and the router with the highest priority
will become the master.
Password
Enter authentication password as hexkey[0-9a-fA-F]+.
Virtual IP address
Enter the IP address of the virtual server.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save to save changes.
Table 10- VRRP Parameters
Settings – VPN Settings
VPN (Virtual private network) is a communications network tunneled through another network and
dedicated to a specific network. One common application of VPN is secure communication through the
public Internet, but a VPN need not have explicit security features, such as authentication or content
encryption. VPNs, for example, can be used to separate the traffic of different user communities over an
underlying network with strong security features.
A VPN may have best–effort performance, or may have a defined Service Level Agreement (SLA)
between the VPN customer and the VPN service provider. Generally, a VPN has a topology more complex
than point–to–point. The distinguishing characteristics of VPNs are not security or performance, but that
they overlay other network(s) to provide a certain functionality that is meaningful to a user community.
Generic Routing Encapsulation (GRE)
Originally developed by Cisco, generic routing encapsulation (GRE) is now a standard, defined in
RFC 1701, RFC 1702, and RFC 2784. GRE is a tunneling protocol used to transport packets from one network
through another network.
If this sounds like a virtual private network (VPN) to you, that’s because it theoretically is:
Technically, a GRE tunnel is a type of a VPN — but it isn’t a secure tunneling method. However, you can
encrypt GRE with an encryption protocol such as IPSec to form a secure VPN. In fact, the point–to–point
47
User Manual
GWG Gateway
tunneling protocol (PPTP) actually uses GRE to create VPN tunnels. For example, if you configure
Microsoft VPN tunnels, by default, you use PPTP, which uses GRE.
Solution where you can use GRE protocol:
• You need to encrypt multicast traffic. GRE tunnels can carry multicast packets — just like real
network interfaces — as opposed to using IPSec by itself, which can’t encrypt multicast traffic. Some
examples of multicast traffic are OSPF, EIGRP. Also, a number of video, VoIP, and streaming music
applications use multicast.
• You have a protocol that isn’t routable, such as NetBIOS or non–IP traffic over an IP network. You
could use GRE to tunnel IPX/AppleTalk through an IP network.
• You need to connect two similar networks connected by a different network with different IP
addressing.
Click VPN Settings Tab, to open the VPN configuration screen. In the Figure 24 you can see
screenshot of GRE Tab configuration menu.
VPN Settings / GRE Tunneling Parameters
Label Description
Enable
This check box allows you to activate/deactivate VPN/GRE traffic.
Local Tunnel Address
This field specifies local IP address of virtual tunnel interface.
Local Tunnel Netmask
This field specifies the IP netmask address of virtual tunnel. This field is
unchangeable, always 255.255.255.252
Tunnel Source
This field specifies IP address or hostname of tunnel source.
Tunnel Destination
This field specifies IP address or hostname of tunnel destination.
Interface
This field specifies GRE interface. This field is populated from the Geneko Router.
Keep Alive Enable
Check box to enable keepalive packets.
Period
Defines the time interval (in seconds) between transmitted keepalive packets. Enter
a number from 3 to 60 seconds.
Retries
Defines the number of retry times of failed keepalives before determinin
g
that the
tunnel endpoint is down. Enter a number from 1 to 10 times.
A
dd
Click Add to insert (add) new item in table to the GWG Gateway.
Remove
Click Remove to delete selected item from table.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save to save your changes back to the GWG Gateway.
Table 11 – GRE parameters
Figure 24– GRE tunnel parameters configuration page
48
User Manual
GWG Gateway
GRE Keep alive
GRE tunnels can use periodic status messages, known as keepalives, to verify the integrity of the
tunnel from end to end. By default, GRE tunnel keepalives are disabled. Use the keepalive checkbox to
enable this feature. Keepalives do not have to be configured on both ends of the tunnel in order to work; a
tunnel is not aware of incoming keepalive packets. You should define the time interval (in seconds) between
transmitted keepalive packets. Enter a number from 1 to 60 seconds, and the number of times to retry after
failed keepalives before determining that the tunnel endpoint is down. Enter a number from 1 to 10 times.
49
User Manual
GWG Gateway
Internet Protocol Security (IPSec)
IPSec (Internet Protocol Security) is a protocol suite for securing Internet Protocol communication by
authenticating and encrypting each IP packet of a data stream.
Click VPN Settings - IPSec, to open the VPN configuration screen. At the Figure 25– IPSec Summary
screen you can see IPSec Summary. This screen gathers information about settings of all defined IPSec
tunnels. Up to 3 IPSec tunnels can be defined on GWG Gateway.
If you cannot use IP address as a peer identifier at one side of the tunnel (private IP subnet)
aggressive mode has to be utilized.
IPSec Summary and IPSec Settings are briefly displayed in following figures and tables.
Figure 25– IPSec Summary screen
VPN Settings / IPSec Summary
Label Description
Tunnels Used
This is the number of currently configured IPSec tunnels.
Maximum number of
tunnels
This is the number of available, not yet defined, IPSec tunnels.
No
This filed indicates the number of the IPSec tunnel.
Name
This field shows the Tunnel Name that you gave to the IPSec tunnel.
Enabled
This field shows if tunnel is enabled or disabled. After clicking on Start button, onl
y
enabled tunnels will be started.
Status
Field indicates status of the IPSec tunnel. Click on Refresh button to see current
status of defined IPSec tunnels.
Enc/Auth/Grp
This field shows both Phase 1 and Phase 2 details, Encryption method
3DES, AES
(128/192/256), BLOWFISH(128/192/256).
Authentication method (MD5/SHA1), and
DH Group number (1/2/5) that you have defined in the IPSec Setup section.
A
dvanced
Field shows the chosen mode of IPSec and options from IPSec Advanced section b
y
displaying the first letters of enabled options.
Local Group
Field shows the IP address and subnet mask of the Local Group.
Remote Group
Field displays the IP address and subnet mask of the Remote Group.
Remote Gateway
Field shows the IP address of the Remote Device.
A
ction
Edit or Delete the tunnel.
50
User Manual
GWG Gateway
Connection mode
Field displays connection mode of the current tunnel.
Log level
Set IPSec log level.
A
dd New Tunnel
Click on this button to add a new Device–to–Device IPSec tunnel. After
y
ou have
added the tunnel, you will see it listed in the Summary table.
Start
This button starts the IPSec negotiations between all defined and enabled tunnels. If
the IPSec is already started, Start button is replaced with Restart button.
Stop
This button will stop all IPSec started negotiations.
Refresh
Click on this button to refresh the Status field in the Summary table.
Table 12 – IPSec Summary
To create a tunnel click Add New Tunnel button. Depending on your selection, the Local Group
Setup and Remote Group Setup settings will differ. Proceed to the appropriate instructions for your
selection.
51
User Manual
GWG Gateway
Figure 26– IPSec Settings
VPN Settings / IPSec Settings
Label Description
Tunnel Number
This number will be generated automatically and it represents the tunnel number.
Tunnel Name
Enter a name for the IPSec tunnel. This allows you to identify multiple tunnels and
does not have to match the name used at the other end of the tunnel.
Enable
Check this box to enable the IPSec tunnel.
Local Security gateway
type
Select the type you want to use: IP Only, SIM card. IP Only - Only a specific IP
address will be able to establish a tunnel. NOTE: The Local Security Gateway Type
y
ou select should match the Remote Security Gateway Type selected on the IPSec
device at the other end of the tunnel.
IP Address
The WAN (or Internet) IP address of the GWG Gatewa
y
automatically appears. If
the GWG Gateway is not yet connected to the GSM/UMTS/LTE network this field
will be blank.
Local ID type
Authentication identity for one of the participant. It can be an IP address or a fullyqualified domain name preceded b
y
@. When using certificates, this field must be
filled with information from the certificate CN= field (for example FQDN is
@vpn.somethin
g
.com and user FQDN is someone@something.com if that's what's
written in the certificate files).
Local Security Group
Type
Define if only the computer with a specific IP address or whole subnet will be able
to access the tunnel.
IP Address
Select the local LAN user(s) behind the Geneko Router that can use this IPSec
52
User Manual
GWG Gateway
tunnel. Select the type you want to use: IP or Subnet. NOTE: The Local Security
Group T
y
pe you select should match the Remote Security Group Type selected on
the IPSec device at the other end of the tunnel.
Subnet Mask
Enter the subnet mask.
Remote Security
Gateway Type
Select the type you want to use: IP Only - Onl
y
a specific IP address will be able to
establish a tunnel. NOTE: The Remote Securit
y
Gateway Type you select should
match the Local Securit
y
Gateway Type selected on the IPSec device at the other
end of the tunnel.
IP Address
IP address of the remote end with which the tunnel will be formed.
Remote ID Type
Authentication identity for one of the participant. Can be an IP address or fully–
qualified domain name preceded by @.
Remote Security Group
Type
Define if only the computer with a specific IP address or whole subnet will be able
to access the tunnel.
IP Address
Select the remote LAN user(s) behind the Geneko Router at the other end that can
use this IPSec tunnel. Select the t
y
pe you want to use: IP or Subnet. NOTE: The
Remote Securit
y
Group Type you select should match the Local Security Group
Type selected on the IPSec device at the other end of the tunnel.
Subnet Mask
Enter the subnet mask.
IPSec Setup
In order to establish an encrypted tunnel, the two ends of an IPSec tunnel must
a
g
ree on the methods of encryption, decryption and authentication. This is done by
sharin
g
a key for the encryption code. For key management, the Geneko Router
uses only IKE with Preshared Key mode.
Key Exchange mode
IKE with Preshared Key
IKE is an Internet Ke
y
Exchange protocol used to negotiate key material for Security
Association (SA). IKE uses the Preshared Ke
y
to authenticate the remote IKE peer.
Both ends of IPSec tunnel must use the same mode of ke
y
management and the
same key.
IKE with Preshared Key File
One or more files which contain preshared secret must be uploaded in the IPSec ke
y
file management menu. IMPORTANT: context of the file should be plain text and
without space characters, so if a tool for generating secrets such as OpenSSL,
OpenVPN or IPSec PKI commands were used, make sure there are no spaces for
example like in term "----BEGIN CERTIFICATE----", where there is a space between
words BEGIN and CERTIFICATE.
IKE with X509 certificates and PSK
This option is used when X509 certificates are used for authentication. Certificate
files must first be uploaded through pages which are in the main menu under file
management. Pre shared ke
y
(PSK) is entered manually and must match on both
peers.
IKE with X509 certificates and PSK file
This option is used when X509 certificates are used for authentication. Certificate
files must first be uploaded throu
g
h pages which are in the main menu under file
mana
g
ement. Pre shared key file (PSK) is chosen from uploaded PSK files in the
IPSec key file management and must match on both peers.
Mode
Mode of IPSec can be main or aggressive.
53
User Manual
GWG Gateway
Phase 1 DH Group
Phase 1 is used to create the SA. DH (Diffie–Hellman) is a key exchange protocol
used during Phase 1 of the authentication process to establish pre–shared keys.
There are three groups of different prime key lengths. Group 1 is 768 bits, Group 2
is 1024 bits and Group 5 is 1536 bits long and Group 14 is 2048 bits long. If network
speed is preferred, select Group 1. If network security is preferred, select Group 5.
Phase 1 Encryption
Select a method of encryption: 3DES, AES-128 (128-bit), AES-192 (192-bit), AES-256
(256-bit), BLOWFISH-128 (128-bit), BLOWFISH-192 (192-bit), BLOWFISH-256 (256bit). The method determines the length of the key used to encrypt or decrypt ESP
packets. Make sure both ends of the IPSec tunnel use the same encryption method.
Phase 1 Authentication
Select a method of authentication: MD5 or SHA1. The authentication method
determines how the ESP packets are validated. MD5 is a one-wa
y
hashing
algorithm that produces a 128-bit digest. SHA1 is a one-wa
y
hashing algorithm that
produces a 160-bit di
g
est. Make sure both ends of the IPSec tunnel use the same
authentication method.
Phase 1 SA Life Time
Confi
g
ure the length of time IPSec tunnel is active in Phase 1. The default value is
28800 seconds. Both ends of the IPSec tunnel must use the same Phase 1 SA Life
Time setting.
Perfect Forward
Secrecy
If the Perfect Forward Secrec
y
(PFS) feature is enabled, IKE Phase 2 negotiation will
g
enerate new key material for IP traffic encryption and authentication, so hackers
usin
g
brute force to break encryption keys will not be able to obtain future IPSec
keys. Both ends of the IPSec tunnel must enable this option in order to use the
function.
Phase 2 DH Group
If the Perfect Forward Secrec
y
feature is disabled, then no new keys will be
g
enerated, so you do not need to set the Phase 2 DH Group. There are three groups
of different prime ke
y
lengths. Group 1 is 768 bits, Group 2 is 1024 bits, and Group
5 is 1536 bits lon
g
. If network speed is preferred, select Group 1. If network security
is preferred, select Group 5. You do not have to use the same DH Group that
y
ou
used for Phase 1, but both ends of the IPSec tunnel must use the same Phase 2 DH
Group.
Phase 2 Encryption
Phase 2 is used to create one or more IPSec SAs, which are then used to ke
y
IPSec
sessions. Select a method of encryption: NULL, 3DES, AES-128 (128-bit), AES-192
(192-bit), AES-256 (256-bit), BLOWFISH-128 (128-bit), BLOWFISH-192 (192-bit),
BLOWFISH-256 (256-bit). It determines the len
g
th of the key used to encrypt or
decrypt ESP packets. AES-128 is recommended because it is the most secure. Both
ends of the IPSec tunnel must use the same Phase 2 Encryption setting.
NOTE: If
y
ou select a NULL method of encryption, the next Phase 2 Authentication
method cannot be NULL and vice versa.
Phase 2 Authentication
Select a method of authentication: NULL, MD5 or SHA1. The authentication
method determines how the ESP packets are validated. MD5 is a one-wa
y
hashing
algorithm that produces a 128-bit digest. SHA1 is a one-wa
y
hashing algorithm that
produces a 160-bit di
g
est. SHA1 is recommended because it is more secure. Both
ends of the IPSec tunnel must use the same Phase 2 Authentication setting.
Phase 2 SA Life Time
Configure the length of time an IPSec tunnel is active in Phase 2. The default is 3600
seconds. Both ends of the IPSec tunnel must use the same Phase 2 SA Life Time
setting.
Preshared Key
This specifies the pre–shared ke
y
used to authenticate the remote IKE peer. Enter a
ke
y
of keyboard and hexadecimal characters, e.g., Ay_%4222 or 345fa929b8c3e. This
field allows a maximum of 1023 characters and/or hexadecimal values. Both ends
of the IPSec tunnel must use the same Preshared Key.
NOTE: It is stron
gly
recommended that you periodically change the Preshared Key
to maximize security of the IPSec tunnels.
54
User Manual
GWG Gateway
Key File
Select which key file to use.
CA Certificate
Select which CA certificate file to use.
Local Client Certificate
Select which Local Client Certificate file to use.
Local Client Key
Select which Local Client Key file to use.
Enable IKE failover
Enable IKE failover option which tries periodically to establish security association.
IKE SA retry
Number of IKE retries, before failover.
Enable Tunnel Failover
Enables tunnel failover. If there is more than one tunnel defined, this option will
failover to other tunnel in case that selected one fails to establish connection.
Ping IP or Hostname
IP address on other side of tunnel which will be pinged in order to determine
current state.
Ping interval
Specify time period in seconds between two pings.
Packet size
Specify size of data field in IP packet for ping message.
Maximum number of
f
ailed packets
Set percentage of failed packets until failover action is performed.
Compress (Support IP
Payload Compression
Protocol (IP Comp))
IP Payload Compression is a protocol that reduces the size of IP datagram. Select
this option if you want the GWG Gateway to propose compression when it initiates
a connection.
Dead Peer Detection
(DPD)
When DPD is enabled, the Geneko Router will send periodic HELLO/ACK
messages to check the status of the IPSec tunnel (this feature can be used onl
y
when
both peers or IPSec devices of the IPSec tunnel use the DPD mechanism). Once a
dead peer has been detected, the Geneko Router will disconnect the tunnel so the
connection can be re-established. Specif
y
the interval between HELLO/ACK
messa
g
es (how often you want the messages to be sent). The default interval is 20
seconds.
NAT Traversal
Both the IPSec initiator and responder must support the mechanism for detecting
the NAT gateway in the path and changing to a new port, as defined in RFC 3947.
NOTE: Keep-alive for NAT-T function is enabled b
y
default and cannot be disabled.
The default interval for keep-alive packets is 20 seconds.
Send initial contact
The initial contact status message may be used when one side wishes to inform the
other that this is the first SA being established with the remote system.The receiver
of this Notification Message might then elect to delete any existing SA's.
Back
Click Back to return on IPSec Summary screen.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save to save
y
our changes back to the GWG Gateway. After that router goes
back and begin negotiations of the tunnels by clicking on the Start.
Table 13 – IPSec Parameters
55
User Manual
GWG Gateway
OpenVPN
OpenVPN site to site allows connecting two remote networks via point–to–point encrypted tunnel.
OpenVPN implementation offers a cost–effective simply configurable alternative to other VPN technologies.
OpenVPN allows peers to authenticate each other using a pre–shared secret key, certificates, or
username/password. When used in a multi-client–server configuration, it allows the server to release an
authentication certificate for every client, using signature and Certificate authority. It uses the OpenSSL
encryption library extensively, as well as the SSLv3/TLSv1 protocol, and contains many security and control
features. The server and client have almost the same configuration. The difference in the client configuration
is the remote endpoint IP or hostname field. Also the client can set up the keepalive settings. For successful
tunnel creation a static key must be generated on one side and the same key must be uploaded on the
opposite side.
Figure 27– OpenVPN example
Click VPN Settings -OpenVPN, to open the VPN configuration screen. At the Figure 28 you can see
OpenVPN Summary. This screen gathers information about settings of all defined OpenVPN tunnels. Up to
3 OpenVPN tunnels can be defined on GWG Gateway.
OpenVPN Summary and OpenVPN Settings are briefly displayed in following figures and tables.
Figure 28-Open VPN Summary screen
56
User Manual
GWG Gateway
OpenVPN
Label Description
Tunnel Used
This number will be generated automatically and it represents a number of
configured tunnels.
Maximum number of
tunnels
This is the maximum number of allowed OpenVPN tunnels
No.
This filed indicates the number of the OpenVPN tunnel
Name
This field shows the Tunnel Name that you gave to the OpenVPN tunnel.
Enabled
This field shows if tunnel is enabled or disabled. After clickin
g
on Start button,
only enabled tunnels will be started.
Status
This field indicates status of the OpenVPN tunnel. Click on Refresh button to see
current status of defined OpenVPN tunnels.
A
uth Mode
This field shows authentication mode being used.
A
dvanced
This field shows the additional chosen options for OpenVPN tunnel.
Remote Address
This field displa
y
s the IP address of remote peer. If tunnel is in wait or client
state, X letter will appear.
Show
This button opens a detailed statistics window for the tunnel.
Delete
Click on this link to delete the tunnel and all settings for that particular tunnel.
Edit
This link opens screen where you can change the tunnel’s settings.
A
dd New Tunnel
Click on this button to add a new OpenVPN tunnel. After
y
ou have added the
tunnel, you will see it listed in the Summary table.
Start
This button starts the OpenVPN ne
g
otiations between all defined and enabled
tunnels. If the OpenVPN is already started, Start button is replaced with Restart
button.
Stop
This button will stop all OpenVPN started negotiations.
Refresh
Click on this button to refresh the Status field in the Summary table.
OpenVPN Settings
Tunnel Number
This number will be generated automatically and it represents a number of the
tunnel.
Tunnel Name
Enter a name for the OpenVPN tunnel. This allows
y
ou to identify multiple
tunnels and does not have to match the name used at the other end of the tunnel.
Enable
Check this box to enable this particular OpenVPN tunnel.
Interface Type
Select TUN or TAP mode.
A
uthenticate Mode
Select a method of authentication, options are: NONE, Pre-Shared secret (PSK),
Username/Password, X.509 client/server mode. The authentication method
determines how the peers are authenticated to each other and later to exchan
g
e
cipher and HMAC ke
y
s to protect the data channel. Use NONE if you do not
want authentication at all.
57
User Manual
GWG Gateway
Pre-Shared secret is a simple and easy way to authenticate your hosts.
Username/Password can be used onl
y
in client mode where your server needs
this kind of authentication. X.509 mode is full Transport La
y
er Security protocol
with use of certificate/ke
y
pairs. Note that the designation of X.509 client or X.509
server is only for the purpose of negotiatin
g
the TLS control channel. Make sure
both ends of the OpenVPN tunnel use the same authentication method.
Certificate and ke
y
files must first be uploaded through web pages listed in the
main menu under file management.
Encryption Cipher
Encrypt packets with cipher algorithm. The default is AES-128-CBC, an
abbreviation for AES in Cipher Block Chainin
g
mode. On the other hand,
Blowfish has the advanta
g
es of being fast, very secure, and allowing key sizes of
up to 448 bits. Blowfish is designed to be used in situations where ke
y
s are
changed infrequently. OpenVPN supports the CBC cipher mode.
Hash Algorithm
Authenticate packets with HMAC usin
g
message digest algorithm. The default is
SHA1. HMAC is a commonl
y
used message authentication algorithm (MAC) that
uses a data strin
g
, a secure hash algorithm and a key, to produce a digital
si
g
nature. OpenVPN's usage of HMAC is to first encrypt a packet, then HMAC
the resultin
g
ciphertext. In TLS mode, the HMAC key is dynamically generated
and shared between peers via the TLS control channel. If OpenVPN receives a
packet with a bad HMAC it will drop the packet. HMAC usuall
y
adds 16 or 20
bytes per packet. Set none to disable authentication.
Protocol
Select a protocol you want to use for tunnel connection. UDP connect and TCP
client will need the "Remote Host or IP Adress" field in order to successfull
y
establish a tunnel.
UDP Port/TCP Port
Enter a port number for a tunnel connection.
LZO Compression
Use fast LZO compression. This ma
y
add up to 1 byte per packet for
incompressible data.
NAT Rules
NAT Rules is enabled by default.
Keep Alive
Use this mechanism to keep tunnel alive.
Ping Interval
Pin
g
interval for sending pings over the TCP/UDP control channels. Number of
seconds is specified in this field.
Ping Timeout
Defines a timeout interval in seconds after which a restart of OpenVPN tunnel
will be triggered. This value must be twice as "Ping Interval" value.
Max Fragment Size
Enable internal data
g
ram fragmentation so that no UDP datagrams are sent
which are larger than max b
y
tes. This option is available only when UDP
protocol is bein
g
used. There are circumstances where using OpenVPN’s internal
fra
g
mentation capability may be your only option, such as tunneling a UDP
multicast stream which requires fragmentation.
Pre-shared Secret
Use Static Key encryption mode (non-TLS).
Generate PSK
Check this option and use "Generate" button to produce a pre-shared secret.
Paste
Use this option to manualy paste a pre-shared secret from remote host's PSK file.
CA Certificate
Certificate authority (CA) file, also referred to as the root certificate.
Username
Enter a username for authentication to the remote host server.
Password
Enter a password for authentication to the remote host server.
Local Certificate
Local peer’s signed certificate, must be si
g
ned by a certificate authority whose
58
User Manual
GWG Gateway
certificate is in "CA Certificate" field.
Local Private Key
Local peer’s private key.
Local / Remote Group Settings
Remote Host or IP
A
dress
Enter a remote peer IP address or host name. This filed is available onl
y
in UDP
connect and TCP client model.
Redirect Gateway
Check this option in order to use tunnel interface for default route.
Tunnel Interface
Configuration
Options are: "Pull from server" and "Manual confi
g
uration". "Pull from server"
mode is used where remote peer is an OpenVPN server and where confi
g
uration
will be pulled. In "Manual confi
g
uration" mode, you can enter tunnel interface IP
addresses.
Manual configuration
Local Interface IP
A
ddress
This is the IP address of the local VPN endpoint of local tunnel interface.
Remote Interface IP
A
ddress
This is the IP address of the remote VPN endpoint of remote tunnel interface.
Network Topology
Configure virtual addressing topology. net30 - use a point-to-point topolo
gy
, by
allocating one /30 subnet per client. p2p - use a point-to-point topolo
gy
where
the remote endpoint of the client's tunnel interface alwa
y
s points to the local
endpoint of the server's tunnel interface. This mode allocates a single IP address
per connecting client. Only use when none of the connectin
g
clients are Windows
systems. subnet - use a subnet rather than a point-to-point topolo
gy by
configuring the tunnel interface with a local IP address and subnet mask. This
mode allocates a sin
g
le IP address per connecting client and works on Windows
as well.
Table 14 – OpenVPN parameters
Figure 29– OpenVPN configuration page
59
User Manual
GWG Gateway
Settings – PPTP
The Geneko Router can be used as a PPTP (Point-to-Point Tunneling Protocol) client. PPTP enables
the secure transfer of data from a remote computer to a private server by creating a VPN connection across
IP-based data networks. PPTP uses a control channel over TCP and a GRE tunnel operating to encapsulate
PPP packets.
Figure 30–PPTP configuration page
PPTP
Label Description
Number
Selected tunnel number. Number of PPTP tunnels is limited to 5.
Enabled
Select this option to enable tunnel.
Tunnel name
Unique tunnel identifier.
PPTP server IP
address or
hostname
IPv4 address of remote PPTP server.
Remote Netmask
Netmask of remote subnet to route.
Domain
Some PPTP servers require domain name of authentication.
Username
Username to authenticate to the remote server.
Password
Password to authenticate to the remote server.
Encryption
Leave this option enabled to use default MPPE (Microsoft encryption) and MPPC
(Microsoft compression) protocols.
Persist
If this option enabled to use default MPPE (Microsoft encryption) and MPPC
(Microsoft compression) protocols.
Maxfail
Max number of retries to reconnect. 0 for infinite retries.
Debug
Enable extra information in system log.
Edit
Click Edit to edit selected tunnel from the table.
Delete
Click Delete to delete selected tunnel from table.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save to create new, or save changes to existing tunnel.
Table 15- PPTP Parameters
60
User Manual
GWG Gateway
Figure 31–PPTP Summary screen
Settings – L2TP
L2TP is suitable for Layer-2 tunneling. Static tunnels are useful to establish network links across IP
networks when the tunnels are fixed. L2TP tunnels can carry data of more than one session. Each session is
identified by a session id and its parent tunnel's tunnel id. A tunnel must be created before a session can be
placed in the tunnel.
Figure 32– L2TP configuration page
L2TP
Label Description
Number
Selected tunnel number. Number of L2TP tunnels is limited to 5.
Enabled
Select this option to enable L2TP tunnel.
Tunnel name
Unique tunnel identifier.
Local IP address
Set the IP address of the local interface to be used for the tunnel. This address
must be the address of a local interface.
Tunnel ID
Set the tunnel id, which is a 32-bit integer value. Uniquely identifies the tunnel.
The value used must match the peer tunnel id value being used at the peer.
61
User Manual
GWG Gateway
UDP Source Port
Set the UDP source port to be used for the tunnel. Must be present when udp
encapsulation is selected. Ignored when ip encapsulation is selected.
Session ID
Set the session id, which is a 32-bit integer value. Uniquely identifies the session
being created. The value used must match the peer_session id value bein
g
used at
the peer.
Cookie
Sets an optional cookie value to be assigned to the session. This is a 4 or 8 byte
value, specified as 8 or 16 hex digits, e.g. 014d3636deadbeef. The value must
match the peer cookie value set at the peer. The cookie value is carried in L2TP
data packets and is checked for expected value at the peer. Default is to use no
cookie.
Peer IP address
Set the IP address of the remote peer.
Peer Tunnel ID
Set the peer tunnel id, which is a 32-bit integer value assigned to the tunnel b
y
the
peer. The value used must match the tunnel id value being used at the peer.
UDP Destination Port
Set the UDP destination port to be used for the tunnel. Must be present when
UDP encapsulation is selected. Ignored when IP encapsulation is selected.
Peer Session ID
Set the peer session id, which is a 32-bit integer value assigned to the session by
the peer. The value used must match the session ID value being used at the peer.
Peer Cookie
Sets an optional peer cookie value to be assigned to the session. This is a 4 or 8
byte value, specified as 8 or 16 hex digits, e.g. 014d3636deadbeef. The value must
match the cookie value set at the peer. It tells the local system what cookie value
to expect to find in received L2TP packets. Default is to use no cookie
Encapsulation
Set the encapsulation t
y
pe of the tunnel. Valid values for encapsulation are: UDP,
IP.
Bridged
The two interfaces can be configured with IP addresses if only IP data is to be
carried. To carry non-IP data, the L2TP network interface is added to a bridge
instead of being assigned its own IP address. Since raw ethernet frames are then
carried inside the tunnel, the MTU of the L2TP interfaces must be set to allow
space for those headers.
Interface IP Address
Local private P-t-P IP address.
Peer Interface IP
A
ddress
Remote private P-t-P IP address.
MTU
MTU of the L2TP interface. Default 1446 for bridged or 1488 for Layer 3 tunnel.
Edit
Click Edit to edit selected tunnel from the table.
Delete
Click Delete to delete selected tunnel from table.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save to create new, or save changes to existing tunnel.
Table 16- L2TP Parameters
Figure 33– L2TP Summary screen
62
User Manual
GWG Gateway
File management – CA Certificate
CA Certificate page is used to manage CA certificate files so they can be used for peer
authentication.
Certification authority (CA) certificates are certificates that are issued by a CA to itself or to a second CA for
the purpose of creating a defined relationship between the two CAs. A certificate that is issued by a CA to
itself is referred to as a trusted root certificate, because it is intended to establish a point of ultimate trust for
a CA hierarchy. Once the trusted root has been established, it can be used to authorize subordinate CAs to
issue certificates on its behalf. Although the relationship between CAs is most commonly hierarchical, CA
certificates can also be used to establish trust relationships between CAs in two different public key
infrastructure (PKI) hierarchies. In all of these cases, the CA certificate is critical to defining the certificate
path and usage restrictions for all end entity certificates issued for use in the PKI.
Usually this file is called ca.crt and it can be generated with various tools, for example with OpenSSL,
OpenVPN e.t.c.
There are options to first browse for the file, then to upload the file. After one or more files are uploaded, a
table with uploaded files is shown with the option to delete each of them if they are no longer needed.
CA Certificate
Label Description
No
Ordinal number of the file.
File
Filename of the file.
A
ction
Action field shows the delete button for deleting the file.
Select file
This field shows the browse button for finding the file on local computer which
will be uploaded.
Upload
This is the upload button, it is used to start the upload of the file.
Table 17– CA Certificate parameters
Figure 34– CA Certificate screen
File management – Private Certificate
Local Certificate page is used to manage local client certificate files so they can be used for peer
authentication.
In cryptography, a client certificate is a type of digital certificate that is used by client systems to make
authenticated requests to a remote server. Client certificates play a key role in many mutual authentication
designs, providing strong assurances of a requester's identity. Usually this file is called client1.crt and it can
be generated with various tools, for example with OpenSSL, OpenVPN e.t.c. There are options to first
browse for the file, then to upload the file. After one or more files are uploaded, a table with uploaded files
is shown with the option to delete each of them if they are no longer needed.
63
User Manual
GWG Gateway
Figure 35– Local Certificate screen
Local Client Certificate files management
Label Description
Filename
Filename of the file.
Delete
Delete button for deleting the file.
Details
Details button for displa
ying
details about the certificate (issuer, valid from, valid
until)
Select file for upload
This field shows the browse button for finding the file on local computer which
will be uploaded.
Upload
This is the upload button, it is used to start the upload of the file.
Table 18-Local Certificate parameters
File management – Private Key
This page is used to manage local client or server key files so they can be used for peer
authentication.
In public key infrastructure (PKI) systems, a certificate signing request (also CSR or certification
request) is a message sent from an applicant to a certificate authority in order to apply for a digital identity
certificate.
Before creating a CSR, the applicant first generates a key pair, keeping the private key secret. The
CSR contains information identifying the applicant (such as a distinguished name in the case of an X.509
certificate) which must be signed using the applicant's private key. The CSR also contains the public key
chosen by the applicant. The CSR may be accompanied by other credentials or proofs of identity required by
the certificate authority, and the certificate authority may contact the applicant for further information.
The three main parts that a certification request consists of are the certification request information,
a signature algorithm identifier, and a digital signature on the certification request information. The first
part contains the significant information, including the public key. The signature by the requester prevents
an entity from requesting a bogus certificate of someone else's public key. Thus the private key is needed to
produce, but it is not part of, the CSR.
64
User Manual
GWG Gateway
Private Key File Management
Label Description
Filename
Filename of the file.
Delete
Delete button for deleting the file.
Details
Details button for displa
ying
details about the certificate (issuer, valid from, valid
until)
Select file for upload
This field shows the browse button for finding the file on local computer which
will be uploaded.
Upload
This is the upload button ,it is used to start the upload of the file.
Table 19–Private Key parameters
65
User Manual
GWG Gateway
Figure 36– Private Key screen
File management – CRL Certificates
This page is used to manage Certificate Revocation List certificate files so they can be used for
validating certificates. In the operation of some cryptosystems, usually public key infrastructures (PKIs), a
certificate revocation list (CRL) is a list of certificates (or more specifically, a list of serial numbers for
certificates) that have been revoked, and therefore, entities presenting those (revoked) certificates should no
longer be trusted. There are two different states of revocation defined in RFC 3280: revoked and hold.
Usually this file is called crl.crl or crl.pem and it can be generated with various tools, for example with
OpenSSL, OpenVPN e.t.c.
CRL Certificate
Label Description
Filename
Filename of the file.
Delete
Delete button for deleting the file.
Details
Details button for displa
ying
details about the certificate (issuer, valid from, valid
until).
Select file for upload
This field shows the browse button for finding the file on local computer which
will be uploaded.
Upload
This is the upload button, it is used to start the upload of the file.
Table 20–CRL Certificates
Figure 37– CRL Certificates
File management – Preshared Key Files
This page is used to manage textual key files with shared secret written into them so the same file can be
used on more peers for their authentication.
IMPORTANT: context of the file should be plain text and without space characters, so if a tool for
generating secrets such as OpenSSL, OpenVPN or IPSec PKI commands were used, make sure there are no
spaces for example like in term "----BEGIN CERTIFICATE----", where there is a space between words BEGIN
66
User Manual
GWG Gateway
and CERTIFICATE. There are options to first browse for the file, then to upload the file. After one or more
files are uploaded, a table with uploaded files is shown with the option to delete each of them if they are no
longer needed.
Preshared Key Files
Label Description
Filename
Filename of the file.
Delete
Delete button for deleting the file.
Details
Details button for displaying contents of the file.
Select file for upload
This field shows the browse button for finding the file on local computer which
will be uploaded.
Upload
This is the upload button ,it is used to start the upload of the file.
Table 21–Preshared Key Files
Figure 38-Preshared Key screen
Settings – Firewall – IP Filtering
TCP/IP traffic flow is controlled over IP address and port number through router’s interfaces in
both directions. With firewall options it is possible to create rule which exactly matches traffic of interest.
Traffic can be blocked or forward depending of action selected. It is important when working with firewall
rules to have in mind that traffic for router management should always be allowed to avoid problem with
unreachable router. Firewall rules are checked by priority from the first to the last. Rules which are after
matching rule are skipped.
67
User Manual
GWG Gateway
Figure 39– Firewall configuration page
Firewall
Label Description
Firewall Rule Basic
Enable Firewall
This field specifies if Firewall is enabled at the router.
Firewall Rule Settings
Priority
This field indicates the order in which the rule will be processed.
Name
Field shows the Rule Name that you gave to the firewall rule.
Enabled
This field shows if rule is enabled or disabled. After clicking on Apply rule
button, only enabled rules will be applied.
Chain
Field displays chosen chain of the firewall rule.
Service
This field specifies a service which is based on a predefined service protocol and
service port. Also it can specifies a custom defined values.
Protocol
The protocol of the rule or of the packet to check. The specified protocol can be
one of All, TCP, UDP, UDPLITE, ICMP, ESP, AH, SCTP or it can be a numeric
value (from 0 to 255), representing one of these protocols or a different one. The
number zero is equivalent to all. Protocol all will match with all protocols and is
taken as default when this option is omitted.
Port(s)
This field specifies a service port with predefined or custom defined values.
Input Interface
Select the name of an interface via which a packet was received (only for packets
entering the INPUT and FORWARD chains).
Output Interface
Select the name of an interface via which a packet is going to be sent (for packets
entering the FORWARD and OUTPUT chains).
Source address
Field shows source IP address of the packet. It can be single IP address, range of
68
User Manual
GWG Gateway
IP addresses or "any".
Destination address
Destination IP address for the packet. It can be single IP address, range of IP
addresses or "any".
Packet state
This option, when combined with connection tracking, allows access to the
connection tracking state for this packet. Possible states are INVALID meaning
that the packet could not be identified for some reason which includes running
out of memory and ICMP errors which don't correspond to any known
connection, ESTABLISHED meaning that the packet is associated with a
connection which has seen packets in both directions, NEW meaning that the
packet has started a new connection or otherwise associated with a connection
which has not seen packets in both directions, and RELATED meaning that the
packet is starting a new connection, but is associated with an existing connection,
such as an FTP data transfer or an ICMP error.
Policy
Field shows selected firewall polic
y
: ACCEPT, REJECT or DROP. If selected
policy is REJECT field displays chosen reject type of the firewall rule.
DDos
This field shows if Distributed Denial of Service is disabled or enabled.
Edit
This link opens screen where you can change the rule’s settings.
Delete
Click on this link to delete the rule and all settings for that particular rule.
A
dd New Rule
Click Add New Rule to add a new firewall rule. After you have added the rule,
you will see it listed in the Summary table.
A
pply rules
Click Add New Rule to add a new firewall rule. After you have added the rule,
you will see it listed in the Summary table.
Table 22 – Firewall parameters
Settings – Firewall – MAC Filtering
MAC filtering can be used to restrict which Ethernet devices can send packets to the router. If MAC
filtering is enabled, only Ethernet packets with a source MAC address that is configured in the MAC Filter
table will be allowed. If the source MAC address is not in the MAC Filter table, the packet will dropped.
MAC Filtering Settings
Label Description
Enable MAC Filtering
This field specifies if MAC Filtering is enabled at the router
Enable
Enable MAC filtering for a specific MAC address
Name
Field shows the Rule Name that is given to the MAC filtering rule.
MAC address
The Ethernet MAC source address to allow.
Reload
Click Reload to discard any changes and reload previous settings
Save
Click Save to save changes back to the GWR router
Table 23 - MAC filtering parameters
69
User Manual
GWG Gateway
Figure 40– MAC filtering configuration page
Settings – Dynamic DNS
Dynamic DNS is a domain name service allowing to link dynamic IP addresses to static hostname.
To start using this feature firstly you should register to DDNS service provider. Section of the web interface
where you can setup DynDNS parameters is shown in Figure 41.
Figure 41– DynDNS settings
DynDNS
Label Description
Enable DynDNS Cilent
Enable DynDNS Client.
Service
The type of service that you are using, try one of: no–ip, dhs, pgpow, dyndns,
dyndns–static, dyndns–custom, ods, easydns, dyns, justlinux and zoneedit.
70
User Manual
GWG Gateway
Custom Server IP or
Hostname
The server IP or Hostname to connect to.
Custom Server port
The server port to connect to.
Hostname
String to send as host parameter.
Username
User ID
Password
User password.
Update cycle
Defines interval between updates of the DynDNS client. Default and minimum
value for all DynDNS services, except No–IP service, is 86400 seconds. Update
cycle value for No–IP service is represented in minutes and minimum is 1
minute.
Number of tries
Number of tries (default: 1) if network problem.
Timeout
The amount of time to wait between retries.
Period
Time between update retry attempts, default value is 1800.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save to save your changes back to the GWR Router.
Table 24 – DynDNS parameters
Settings – Serial Port 1
The Geneko GWG Gateway provides a way for a user to connect from a network connection to a
serial port. It provides all the serial port setup, a configuration file to configure the ports, a control login for
modifying port parameters, monitoring ports, and controlling ports. The Geneko Gateway supports RFC
2217 (remote control of serial port parameters). Modbus gateway carries out translation between
Modbus/TCP and Modbus/RTU. This means that Modbus serial slaves can be directly attached to the unit's
serial ports without any external protocol converter.
71
User Manual
GWG Gateway
Figure 42– Serial Port Settings initial menu
Settings – Serial Port 2
Serial port over TCP/UDP settings
The GWG Gateway provides a way for a user to connect from a network connection to a serial port.
It provides all the serial port setup, a configuration file to configure the ports, a control login for modifying
port parameters, monitoring ports, and controlling ports. The GWG Gateway supports RFC 2217 (remote
control of serial port parameters).
Serial Port over TCP/UDP Settings
Label Description
Disable all
Disable serial to Ethernet converter and Modbus gateway.
Serial port over
TCP/UDP settings
Enable serial to Ethernet converter. This provides a way for a user to connect
from a network connection to a serial port.
Modbus gateway
settings
Enable translation between Modbus/TCP and Modbus/RTU.
Bits per second
The unit and attached serial device, such as a modem, must a
g
ree on a speed or
baud rate to use for the serial connection. Valid baud rates are 300, 1200, 2400,
4800, 9600, 19200, 38400, 57600 or 115200.
Data bits
Indicates the number of bits in a transmitted data package.
Parity
Checks for the parity bit. None is the default.
Stop bits
The stop bit follows the data and parit
y
bits in serial communication. It indicates
the end of transmission. The default is 1.
Flow control
Flow control mana
g
es data flow between devices in a network to ensure it is
processed efficientl
y
. Too much data arriving before a device is prepared to
manage it causes lost or retransmitted data. None is the default.
72
User Manual
GWG Gateway
Protocol
Choose which protocol to use [TCP/UDP].
Mode
Select server mode in order to listen for incoming connection, or client mode to
establish one.
Type
Select whatever to use server IP address or server hostname.
Server IP address
Enter server's IP address.
Server hostname
Enter server's hostname.
Bind to TCP port
Number of the TCP/IP port on which to accept connections from for this device.
Type of socket
Either raw or telnet. Raw enables the port and transfers all data as-is. Telnet
enables the port and runs the telnet protocol on the port to set up telnet
parameters. This is most useful for using telnet.
Enable local echo
Enables or disables local echo.
Enable inactivity
timeout
Close connection after some period of inactivity.
Enable retry timeout
Timeout for retrying connection to unreachable server or port
Check TCP connection
Enable connection checking.
Kepalive idle time
Set keepalive idle time in seconds.
Kepalive interval
Set time period between checking.
TCP accept port
This field determines the TCP port number on which the server will listen for
connections. The value entered should be a valid TCP port number. The default
Modbus/TCP port number is 502.
Connection timeout
When this field is set to a value greater than 0, the server will close connections
that have had no network receive activity for longer than the specified period.
Transmission mode
Select RTU, based on the Modbus slave equipment attached to the port.
Response timeout
This is the timeout (in miliseconds) to wait for a response from a serial slave
device before retrying the request or returning an error to the Modbus master.
Pause between request
Set pause between requests in milliseconds. Valid values are between 1 and
10000. Default value is 100.
Maximum number of
retries
If no valid response is received from a Modbus slave, the value in this field
determines the number of times the serial server will retransmit request before
giving up.
Log Level
Set importance level of log messages.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save button to save your changes back to the GWR Router. Whether you
make changes or not, gateway will reboot every time you click Save.
Table 25 – Serial Port over TCP/UDP parameters
73
User Manual
GWG Gateway
Click Serial Port Tab to open the Serial Port Configuration screen. Use this screen to configure the
GWG Gateway serial port parameters.
Figure 43– Serial Port configuration page
Modbus Gateway settings
The serial server will perform conversion from Modbus/TCP to Modbus/RTU, allowing polling by
a Modbus/TCP master. The Modbus IPSerial Gateway carries out translation between Modbus/TCP and
Modbus/RTU. This means that Modbus serial slaves can be directly attached to the unit's serial ports
without any external protocol converters.
Click Serial Port Tab to open the Modbus Gateway configuration screen. Choose Modbus Gateway
settings to configure Modbus. At the Figure 44– Modbus gateway configuration page you can see screenshot
of Modbus Gateway configuration menu.
Modbus Gateway Settings
Label Description
TCP accept port
This field determines the TCP port number that the serial server will listen for
connections on. The value entered should be a valid TCP port number. The
default Modbus/TCP port number is 502.
Connection timeout
When this field is set to a value greater than 0, the serial server will close
74
User Manual
GWG Gateway
connections that have had no network receive activity for longer than the
specified period.
Transmission mode
Select RTU, based on the Modbus slave equipment attached to the port.
Response timeout
This is the timeout (in milliseconds) to wait for a response from a serial slave
device before retrying the request or returning an error to the Modbus master.
Pause between request
Set pause between requests in milliseconds. Valid values are between 1 and
10000. Default value is 100.
Maximum number of
retries
If no valid response is received from a Modbus slave, the value in this field
determines the number of times the serial server will retransmit request before
giving up.
Log level
Set importance level of log messages.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save button to save your changes back to the GWR Router and
activate/deactivate serial to Ethernet converter.
Table 26 – Modbus gateway parameters
Figure 44– Modbus gateway configuration page
75
User Manual
GWG Gateway
GWG RS-422/RS-485 Port Wiring
Figure 45- GWR RS-422/RS-485 Port Wiring
USB Port
USB host port is available and highly customized for our users. With additional implementation in
software user now can use more than one usb storage on the device, exactly, up to eight partitions on one
medium or usb mediums extended with usb hub. By default, first partition is reserved for logging feature,
and will automatically mounted as log partition. Web interface configuration for external message logging is
presented at Figure 46.
76
User Manual
GWG Gateway
Figure 46- USB Flash LOG example
All other partitions are automatically mounted under chroot work environment and become available under
/media/usbx, right after usb is being inserted.
Note: x represents current available partitions, mounted in ascending order.
Example of usage custom partitions is represented at Figure 47 .
Figure 47- USB multi partition mounted
77
User Manual
GWG Gateway
SMS – SMS Remote Control
SMS remote control feature allows users to execute a short list of predefined commands by sending SMS
messages to the router. GWG-40 v3 with Cinterion PLS8-E can not receive SMS messages.
GWR router series implement following predefined commands:
1. In order to establish PPP connection, user should send SMS containing following string:
:PPP–CONNECT
After the command is executed, router sends a confirmation SMS with “OK” if the command is
executed without errors or “ERROR” if something went wrong during the execution of the
command.
2. In order to disconnect the router from PPP, user should send SMS containing following string:
:PPP–DISCONNECT
After the command is executed, router sends a confirmation SMS with “OK” if the command is
executed without errors or “ERROR” if something went wrong during the execution of the
command.
3. In order to reestablish (reconnect the router) the PPP connection, user should send SMS containing
following string:
:PPP–RECONNECT
After the command is executed, router sends a confirmation SMS with “OK” if the command is
executed without errors or “ERROR” if something went wrong during the execution of the
command.
4. In order to obtain the current router status, user should send SMS containing following string:
:PPP–STATUS
After the command is executed, router sends one of the following status reports to the user:
– CONNECTING
– CONNECTED, WAN_IP: {WAN IP address or the router}
– DISCONNECTING
– DISCONNECTED
5. In order to establish PPP connection over the other SIM card, user should send SMS containing
following string:
:SWITCH-SIM
After the command is executed, router sends a confirmation SMS with “OK” if the command is
executed without errors or “ERROR” if something went wrong during the execution of the
command.
6. In order to restart whole router user should send SMS containing following string:
:REBOOT
After the command is executed, router sends a confirmation SMS with “OK” if the command is
executed without errors or “ERROR” if something went wrong during the execution of the
command.
Remote control configuration page is presented on the following figure. In order to use this feature,
user must enable the SMS remote control and specify the list of SIM card numbers that will be used for SMS
remote control. The SIM card number should be entered in the following format: {Country Code}{Mobile
Operator Prefix}{Phone Number} (for example +38164111222). SMS service centre number can be obtained
automatically (option “Use default SMSC is enabled”) or manually by entering number under field “Custom
SMSC”.
As presented in the figure configuration should be performed separately for both SIM cards. After
78
User Manual
GWG Gateway
the configuration is entered, user must click on Save button in order to save the configuration.
Figure 48– SMS remote control configuration
SMS – Send SMS
SMS send feature allows users to send SMS message from WEB interface. In following picture is page
where SMS can be sent. There are two required fields on this page: Phone number and Message.
Sending SMS messages is possible with this application. The SMS message will be sent after entering Phone
number and Message and by pushing button Send.
Figure 49– Send SMS
79
User Manual
GWG Gateway
Maintenance
The GWG Gateway provides administration utilities via web interface. Administrator can setup
basic router’s parameters, perform network diagnostic, update software or restore factory default settings.
Maintenance – System Control
Create a scheduled task to reboot the device at a regular interval.
Figure 50– System Control
Maintenance – LED
Select the side of the router on which will the LEDs be active. LEDs are located on the top and on the side of
the router housing.
Figure 51 – LED
Maintenance – GPIO
GPIO (General-purpose input/output ) sends SMS when some certain event occur.
80
User Manual
GWG Gateway
Figure 52– GPIO
Enable GPIO
Label Description
Enable GPIO
Enable or disable GPIO.
Show GPIO1, Show
GPIO2, Show GPIO3
Show or hide GPIO settings
Enable digital input
Enable or disable digital input
Pin state
Action executed when GPIO pin chan
g
e its state to Low or High. Selecting an action
will open a new SMS settings section for setting the parameters.
Destination phone
Recipient phone numbers.
SMS header
Text of the message which will be sent.
SMS text
Click Reload to discard any changes and reload previous settings.
Save
Click Save button to save your changes back to the GWG Gateway.
Reload
Click Reload to discard any changes and reload previous settings.
Table 27- GPIO Parameters
81
User Manual
GWG Gateway
On router’s board are 5 GPIO generic pins which represent:
1. +5VDC with 500mA resettable PTC fuse
2. IO1
3. IO2
4. IO3
5. GND
IO1, IO2, IO3 are 3 user selectable input or output.
Input value is readable (high=1, low=0).
Output value is writable (high=1, low=0).
Maintenance – Device Identity Settings
Within Device Identity Settings Tab there is an option to define name, location of device and
description of device function. These data are kept in device permanent memory. Device Identity Settings
window is shown on Figure 48.
Device Identity Settings
Label Description
Name
This field specifies name of the GWG Gateway.
Description
This field specifies description of the GWG Gateway. Only for information purpose.
Location
This field specifies location of the GWG Gateway. Only for information purpose.
Save
Click Save button to save your changes back to the GWR Router.
Reload
Click Reload to discard any changes and reload previous settings.
Table 28– Device Identity Parameters
Figure 53– Device Identity Settings configuration page
Maintenance – Authentication
By Administrator Password Tab it is possible to activate and deactivate device access system
through Username and Password mechanism. Within this menu change of authorization data
Username/Password is also done. Administrator Password Tab window is shown on Figure 49.
NOTE: The password cannot be recovered if it is lost or forgotten. If the password is lost or
forgotten, you have to reset the Gateway to its factory default settings; this will remove all of your
configuration changes.
82
User Manual
GWG Gateway
Figure 54– Gateway Management configuration page
Administrator Password
Label Description
Enable Password
A
uthentication
With this checkbox you can activate or deactivate function for local (password)
authentication when you access the web/console application.
New Password
Enter a new password for GWG Gateway.
Confirm Password
Re–enter the new password to confirm it.
Enable Radius
A
uthentication
With this checkbox you can activate or deactivate function for authentication via
remote radius server.
Enable
Enable or disable usage of this radius server.
Server
Enter remote radius server IP address or hostname.
Port
Enter remote radius server port
Shared secret
Enter remote radius server shared secret.
Timeout
Enter remote radius server timeout in seconds [1-60].
Save
Click Save button to save your changes back to the GWG Gateway. Whether you
make changes or not, gateway will reboot every time you click Save.
Reload
Click Reload to discard any changes and reload previous settings.
Table 29 – Authentication parameters
NOTE: The password can not be recovered if it is lost or forgotten. If the password is lost or forgotten, you
have to reset the Geneko Router to its factory default settings. This will remove all of your configuration
changes.
83
User Manual
GWG Gateway
Maintenance – Date/Time Settings
To set the local time, select Date/Time Settings using the Network Time Protocol (NTP)
automatically or Set the local time manually. Date and time settings on the GWG Gateway are done through
window Date/Time Settings.
Figure 55– Date/Time Settings configuration page
Date/Time Settings
Label Description
Manually
Sets date and time manually as you specify it.
From time server
Sets the local time using the Network Time Protocol (NTP) automatically.
Time/Date
This field species Date and Time information. You can chan
g
e date and time by
changing parameters.
Time Protocol
Specify time protocol. Currently only NTP is supported.
Time Server Address
Enter the Hostname or IP address of the NTP server.
A
utomatically
synchronize NTP
Setup automatic synchronization with time server.
Update time every
Time interval for automatic synchronization.
Time Zone
Enables daylight saving time and GMT offset based on TZ database.
Sync Clock
Synchronize Date and time setting with PC calendar.
Save
Click Save button to save your changes back to the GWG Gateway.
Reload
Click Reload to discard any changes and reload previous settings.
Table 30 – Date/time parameters
84
User Manual
GWG Gateway
Maintenance – Diagnostics
The GWG Gateway provides built–in tool, which is used for troubleshooting network problems. The
ping test bounces a packet of machine on the Internet back to the sender. This test shows if the GWG
Gateway is able to connect the remote host. If users on the LAN are having problems accessing service on
the Internet, try to ping the DNS server or other machine on network.
Click Diagnostic tab to provide basic diagnostic tool for testing network connectivity. Insert valid IP
address in Hostname box and click Ping. Every time you click Ping router sends four ICMP packets to
destination address.
Before using this tool make sure you know the device or host’s IP address.
Figure 56– Diagnostic page
Maintenance – Update Firmware
You can use this feature to upgrade the GWG Gateway firmware to the latest version. If you need to
download the latest version of the GWG Gateway firmware, please visit Geneko support site. Follow the
on–screen instructions to access the download page for the GWG Gateway.
If you have already downloaded the firmware onto your computer, click Browse button, on Update
firmware Tab, to look for the firmware file. After selection of new firmware version through Browse button,
mechanism the process of data transfer from firmware to device itself should be started. This is done by
Upload button. The process of firmware transfer to the GWG device takes a few minutes and when it is
finished the user is informed about transfer process success.
NOTE: The Gateway will take a few minutes to upgrade its firmware. During this process, do not
power off the Gateway or press the Reset button.
Figure 57– Update Firmware page
In order to activate new firmware version it is necessary that the user performs system reset. In the
process of firmware version change all configuration parameters are not changed and after that the system
continues to operate with previous values.
85
User Manual
GWG Gateway
Maintenance – Import/Export Settings
To import a configuration file, first specify where your backup configuration file is located. Click
Browse, and then select the appropriate configuration file. To export the Router’s current configuration file
select the part of the configuration you would like to backup and click Export. By default, this file will be
called Configuration.tar.gz. This file contains confFile.bkg , cacert and crlcert , Iccert files.
Figure 58– Export/Import the configuration on the gateway
Import Configuration File
To import a configuration file, first specify where your backup configuration file is located. Click
Browse, and then select the appropriate configuration file.
After you select the file, click Import. This process may take up to a minute. Restart the Router in order to
changes will take effect.
Export Configuration File
To export the Router’s current configuration file select the part of the configuration you would like
to backup and click Export.
By default, this file will be called Configuration.tar.gz. This
file contains confFile.bkg , cacert and crlcert ,
Iccert files.
Maintenance – Default Settings
Use this feature to clear all of your configuration information and restore the GWG Gateway to its
factory default settings. Only use this feature if you wish to discard all the settings and preferences that you
have configured.
Click Default Setting to have the GWG Gateway with default parameters. Keep network settings
checkbox allows user to keep all network settings after factory default reset. System will be reset after
pressing Restore button.
86
User Manual
GWG Gateway
Figure 59
– Default Settings page
Maintenance – System Reboot
If you need to restart the GWG Gateway, Geneko recommends that you use the Reboot tool on this
screen. Click Reboot to have the GWG Gateway reboot. This does not affect the router’s configuration.
Figure 60– System Reboot page
Management – Timed Actions
Create a schedule of actions to be performed in a certain time of the day. There is a possibility to
add more actions for each day of the week.
87
User Manual
GWG Gateway
Management – Command Line Interface
CLI (Command line interface) is a user text–only interface to a computer's operating system or an
application in which the user responds to a visual prompt by typing in a command on a specified line and
then receives a response back from the system.
In other words, it is a method of instructing a computer to perform a given task by "entering" a command.
The system waits for the user to conclude the submitting of the text command by pressing the Enter or
Return key. A command–line interpreter then receives, parses, and executes the requested user command.
On router's Web interface, in Management menu, click on Command Line Interface tab to open the
Command Line Interface settings screen. Use this screen to configure CLI parameters Figure 61 – Command
Line Interface.
Command Line Interface
Label Description
CLI Settings
Enable telnet service
Enable or disable CLI via telnet service.
Enable ssh service
Enable or disable CLI via ssh service.
View Mode Username
Username for View mode.
View Mode Password
Password for View mode
Confirm Password
Confirm password for View mode
View Mode Timeout
Inactivit
y
timeout for CLI View mode in minutes. After timeout, session will auto
logout.
A
dmin Mode Timeout
Inactivit
y
timeout for CLI Edit mode in seconds. Note that Username and
Password for Edit mode are the same as Web interface lo
g
in parameters. After
timeout, session will auto logout.
Save
Click Save to save your changes back to the GWG Gateway.
Reload
Click Reload to discard any changes and reload previous settings.
Table 31 – Command Line Interface parameters
Figure 61 – Command Line Interface
88
User Manual
GWG Gateway
Management – Remote Management
Remote Management Utility is a standalone Windows application with many useful options for
configuration and monitoring of GWG Gateways. In order to use this utility user has to enable Remote
Management on the router, Figure 62.
Figure 62– Remote Management
Remote Management
Label Description
Enable Remote
Management
Enable or disable Remote Management.
Protocol
Choose between Geneko and Sarian protocol.
Bind to
Specify the interface.
TCP port
Specify the TCP port.
Save
Click Save button to save
y
our changes back to the Geneko Router. Whether you
make changes or not, gateway will reboot every time you click Save.
Reload
Click Reload to discard any changes and reload previous settings.
Table 32 – Remote Management parameters
89
User Manual
GWG Gateway
Management – Connection Manager
Enabling Connection Manager will allow Connection Wizard (located on setup CD that goes with
the gateway) to guide you step–by–step through the process of device detection on the network and setup of
the PC–to–device communication. Thanks to this utility user can simply connect the gateway to the local
network without previous setup of the gateway. Connection Wizard will detect the device and allow you to
configure some basic functions of the gateway. Connection Manager is enabled by default on the gateway
and if you do not want to use it you can simply disable it .
Figure 63– Connection Manager
Getting started with the Connection Wizard
Connection Wizard is installed through few very simple steps and it is available immediately upon
the installation. It is only for Windows OS. After starting the wizard you can choose between two available
options for configuration:
• GWR Router’s Ethernet port – With this option you can define LAN interface IP address and
subnet mask.
• GWR router’s Ethernet port and GPRS/EDGE/HSPA/HSPA+/LTE network connection – Selecting
this option you can configure parameters for LAN and WAN interface
90
User Manual
GWG Gateway
Figure 64– Connection Wizard – Initial Step
Select one of the options and click Next. On the next screen after Connection Wizard inspects the network
(whole broadcast domain) you’ll see a list of routers and gateways present in the network, with following
information:
- Serial number
- Model
- Ethernet IP
- Firmware version
- Pingable (if Ethernet IP address of the router is in the same IP subnet as PC interface then this field
will be marked, i.e. you can access router over web interface).
91
User Manual
GWG Gateway
Figure 65– Connection Wizard – Router Detection #1
Figure 66– Connection Wizard – Router Detection #2
When you select one of the routers from the list and click Next you will get to the following screen.
92
User Manual
GWG Gateway
Figure 67– Connection Wizard – LAN Settings
If you selected to configure LAN and WAN interface click, upon entering LAN information click Next and
you will be able to setup WAN interface.
Figure 68– Connection Wizard – WAN Settings
After entering the configuration parameters if you mark option Establish connection router will start with
connection establishment immediately when you press Finish button. If not you have to start connection
establishment manually on the router’s web interface.
93
User Manual
GWG Gateway
Management – Simple Management Protocol (SNMP)
SNMP, or Simple Network Management Protocol, is a network protocol that provides network
administrators with the ability to monitor the status of the Gateway and receive notification of any critical
events as they occur on the network. The Gateway supports SNMP v1/v2c and all relevant Management
Information Base II (MIBII) groups. The appliance replies to SNMP Get commands for MIBII via any
interface and supports a custom MIB for generating trap messages.
Figure 69 – SNMP configuration page
SNMP Settings
Label Description
Enable SNMP
Enable or disable SNMP.
Get Community
Create the name for a group or community of administrators who can view
SNMP data. The default is public. It supports up to 64 alphanumeric characters.
Set Community
Create the name for a group or community of administrators who can view
SNMP data and send SET commands via SNPM. The default is private. It
supports up to 64 alphanumeric characters.
Service Port
Sets the port on which SNMP data has been sent. The default is 161. You can
specif
y
port by marking on user defined and specify port you want SNMP data to
be sent.
Service Access
Sets the interface enabled for SNMP traps. The default is Both.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save button to save your changes back to the GWG Gateway and
enable/disable SNMP.
Table 33 – SNMP parameters
94
User Manual
GWG Gateway
Management – Logs
Syslog is a standard for forwarding log messages in an IP network. The term "syslog" is often used
for both the actual syslog protocol, as well as the application or library sending syslog messages.
Syslog is a client/server protocol: the syslog sender sends a small (less than 1KB) textual message to
the syslog receiver. Syslog is typically used for computer system management and security auditing. While
it has a number of shortcomings, syslog is supported by a wide variety of devices and receivers across
multiple platforms. Because of this, syslog can be used to integrate log data from many different types of
systems into a central repository.
Figure 70 – Syslog configuration page
The GWR Router supports this protocol and can send its activity logs to an external server.
Syslog Settings
Label Description
Disable
Mark this option in order to disable Syslog feature.
Local syslog
Mark this option in order to enable Local syslog feature. Logs will remain on the
router.
Remote + local syslog
Mark this option in order to enable remote and local syslog feature.
Log to
Log to
Set syslog storage to the router's internal buffer (local) or external to the USB
flash. If you choose USB flash, drive must be formatted usin
g
the FAT32 file
system.
Syslog file size
Set log size on one of the six predefined values. [10 / 20 / 50 / 128 / 256 / 512 /
1024]KB
Event log
Choose which events to be stored. You can store System, IPsec events or both of
them.
Enable syslog saver
Save logs periodically on filesystem.
95
User Manual
GWG Gateway
Save log every
Set time duration between two saves.
Service server IP
The Geneko Router can send a detailed log to an external syslog server. The
Gateway’s syslog captures all log activities and includes this information about
all data transmissions: every connection source and destination IP address, IP
service and number of bytes transferred. Enter the syslog server name or IP
address.
Service protocol
Sets the protocol type.
Service port
Sets the port on which syslog data has been sent. The default is 514. You can
specif
y
port by marking on user defined and specify port you want syslog data to
be sent.
Reload
Click Reload to discard any changes and reload previous settings.
Save
Click Save button to save your changes back to the GWG Gateway and
enable/disable Syslog.
Table 34 – Syslog parameters
Logout
The Logout tab is located on the down left–hand corner of the screen. Click this tab to exit the web–
based utility. (If you exit the web–based utility, you will need to re–enter your Username and Password to
log in and then manage the Gateway.)
CHROOT
A chroot environment is an operating system call that will change the root location temporarily to a
new folder. Chroot runs a command or an interactive shell from another directory, and treats that directory
as root. Only a privileged process and root user can use chroot command
.
Use Putty, Secure CRT and etc. on Windows, or Putty, GTK on Linux for connection over serial RS-232 port
or SSH over LAN port.
For example: Use SSH to enter in global configuration mode.
SSH 192.168.1.1 // SSH to br0 at TCP port 22 //
Login as: admin
admin@192.168.1.1's password: admin
admin@geneko> gwr_chroot
Press TAB twice quickly to see all commands which are available.
The list of possibilities is:
! dirs interfaces-up ping6 tee
./ disown ip popd telnet
: dmesg ipcalc pppstats test
JSON.sh do ipsec printf tftp
96
User Manual
GWG Gateway
[ done ipsec-mode ps tftpd
[[ du ipsec-routes pushd then
]] ebtables ipsec-sa-status pwd time
alias echo ipsec-status read times
ar egrep iptables-view readarray top
arping elif jobs readlink touch
awk else json2lua readonly tr
basename enable kill realpath traceroute
bash env killall reboot trap
bg esac ldd return true
bind eval less rip-ripd-conf tty
break exec let rip-zebra-conf type
builtin exit ln rm typeset
bunzip2 export local route udpsvd
busybox expr local_dns run-parts ulimit
bzcat factory_default logger scp umask
cal false logname sed unalias
caller fc logout select uname
case fg ls send_at_command uniq
cat fgrep lsof seq unset
cd fi lua service until
chattr find luac set unzip
chmod flock mapfile sh upfirmware
clear for md5sum shift uptime
cmp free microcom shopt users
command ftpd mkdir show usleep
compgen function mkfifo sleep vi
complete fuser mobile-activity sms_send wait
compopt getopts modem_info snmp-view wc
configuration_export grep modem_state sort wget
configuration_import gunzip more source which
configuration_show gzip mv ssh while
continue hash nc strace who
coproc head ncftp strings whoami
cp help netstat stty xargs
cpu hexdump nohup su xtables-multi
cut history nslookup suspend yes
date hostname ntpdate syslog_export zcat
dc hwclock od syslog_start {
dd id openvt syslog_start+view }
declare if passwd syslog_stop
df ifconfig perl tail
diff in pidof tar
dirname interfaces-all ping tcpsvd
97
User Manual
GWG Gateway
Configuration Examples
GWG Gateway as Internet Gateway
The GWG Gateways can be used as Internet router for a single user or for a group of users (entire
LAN). NAT function is enabled by default on the GWG Gateway. The GWG Gateway uses Network
Address Translation (NAT) where only the mobile IP address is visible to the outside world. All outgoing
traffic uses the GWG Gateway mobile IP address.
Figure 71 – GWG Gateway as Internet gateway
• Click LAN Ports Tab, to open the LAN Port Settings screen. Use this screen to configure LAN
TCP/IP settings. Configure IP address and Netmask.
IP address: 10.1.1.1,
Netmask: 255.255.255.0.
• Click LAN Ports Tab, to open the LAN Port Settings screen. Use this screen to configure LAN
TCP/IP settings. Configure IP address and Netmask.
• IP address: 10.1.1.1,
• Netmask: 255.255.255.0.
• Press Save to accept the changes.
• Use SIM card with a dynamic/static IP address, obtained from Mobile Operator. (Note the default
gateway may show, or change to, an address such as 10.0.0.1; this is normal as it is the GSM/UMTS
provider’s network default gateway).
• Click Mobile Settings Tab to configure parameters necessary for GSM/UMTS/LTE connection. All
parameters necessary for connection configuration should be provided by your mobile operator.
• Check the status of GSM/UMTS/LTE connection (Mobile Settings Tab). If disconnected please click
Connect button.
• Check Routing Tab to see if there is default route (should be there by default).
98
User Manual
GWG Gateway
• Router will automatically add default route via ppp0 interface.
• Optionally configure IP Filtering to block any unwanted incoming traffic.
• Configure the GWG Gateway LAN address (10.1.1.1) as a default gateway address on your PCs.
• Configure valid DNS address on your PCs.
GRE Tunnel configuration between two GWG Gateways
GRE tunnel is a type of a VPN tunnel, but it is not a secure tunneling method. Simple network with
two GWG Gateways is illustrated on the diagram below (Figure 7272). Idea is to create GRE tunnel for LAN
to LAN (site to site) connectivity.
Figure 72 – GRE tunnel between two GWG Gateways
The GWG Gateways requirements:
• Static IP WAN address for tunnel source and tunnel destination address;
• Source tunnel address should have static WAN IP address;
• Destination tunnel address should have static WAN IP address;
GSM/UMTS APN Type: For GSM/UMTS/LTE networks GWG Gateway connections may require a
Custom APN. A Custom APN allows for various IP addressing options, particularly static IP addresses,
which are needed for most VPN connections. A custom APN should also support mobile terminated data
that may be required in most site–to–site VPNs.
The GWG Gateway 1 configuration:
• Click LAN Ports, to open the LAN Port Settings screen. Use this screen to configure LAN TCP/IP
settings. Configure IP address and Netmask.
• IP Address: 192.168.4.1,
• Subnet Mask: 255.255.255.0,
• Press Save to accept the changes.
99
User Manual
GWG Gateway
Figure 73 – Network configuration page for GWR Router 1
• Use SIM card with a static IP address, obtained from Mobile Operator. (Note the default gateway
may show, or change to, an address such as 10.0.0.1; this is normal as it is the GSM/UMTS/LTE
provider’s network default gateway).
• Click Mobile Settings Tab to configure parameters necessary for GSM/UMTS connection. All
parameters necessary for connection configuration should be required from mobile operator.
• Check the status of GSM/UMTS/LTE connection (Mobile Settings Tab). If disconnected please click
Connect button.
• Click VPN Settings > GRE to configure GRE tunnel parameters:
• Enable: yes
• Local Tunnel Address: 10.10.10.1
• Local Tunnel Netmask: 255.255.255.252 (Unchangeable, always 255.255.255.252)
• Tunnel Source: 1. 10.251.49.2 ( obtained by the network provider )
2. Select HOST from drop down menu if you want to use host name as peer
identifier
• Tunnel Destination: 1. 10.251.49.3 (obtained by the network provider )
2. Select HOST from drop down menu if you want to use host name as
peer identifier
• KeepAlive enable: no,
• Period:(none),
• Retries:(none),
• Press ADD to put GRE tunnel rule into GRE table.
• Press Save to accept the changes.
Figure 74 – GRE configuration page for GWR Router 1
• Click Static Routes on Routing Tab to configure GRE Route. Parameters for this example are:
100
User Manual
GWG Gateway
• Destination Network: 192.168.2.0,
• Netmask: 255.255.255.0,
• Interface: gre_x.
Figure 75 – Routing configuration page for GWG Gateway 1
• Optionally configure IP Filtering to block any unwanted incoming traffic.
• On the device connected on GWG Gateway 1 setup default gateway 192.168.4.1
The GWG Gateway 2 configuration:
• Click LAN Ports Tab, to open the LAN Ports Settings screen. Use this screen to configure LAN
TCP/IP settings. Configure IP address and Netmask.
• IP Address: 192.168.2.1,
• Subnet Mask: 255.255.255.0,
• Press Save to accept the changes.
Figure 76 – Network configuration page for GWR Router 2
• Use SIM card with a static IP address, obtained from Mobile Operator. (Note the default gateway
may show, or change to, an address such as 10.0.0.1; this is normal as it is the GSM/UMTS/LTE
provider’s network default gateway).
• Click Mobile Settings Tab to configure parameters necessary for GSM/UMTS/LTE connection. All
Loading...