Page 1
NetModule Router NB2710
User Manual for Software Version 4.0
Manual Version 1.8
NetModule AG, Switzerland
May 4, 2017
Page 2
NetModule Router NB2710
This manual covers all variants of the NB2710 product type.
The specifications and information regarding the products in this manual are subject to change without notice. We
would like to point out that NetModule makes no representation or warranties with respect to the contents herein and
shall not be responsible for any loss or damage caused to the user by the direct or indirect use of this information This
document may contain information about third party products or processes. Such third party information is generally
out of influence of NetModule and therefore NetModule shall not be responsible for the correctness or legitimacy of
this information. Users must take full responsibility for their application of any products.
Copyright ©2017 NetModule AG, Switzerland All rights reserved
This document contains proprietary information of NetModule. No parts of the work described herein may be
reproduced. Reverse engineering of the hardware or software is prohibited and protected by patent law. This material
or any portion of it may not be copied in any form or by any means, stored in a retrieval system, adopted or transmitted
in any form or by any means (electronic, mechanical, photographic, graphic, optic or otherwise), or translated in any
language or computer language without the prior written permission of NetModule.
A large amount of the source code to this product is available under licenses which are both free and open source.
Most of it is covered by the GNU General Public License which can be obtained from www.gnu.org. The remainder
of the open source software which is not under the GPL, is usually available under one of a variety of more permissive
licenses. A detailed license information for a particular software package can be provided on request.
NetModule and NB2710 are trademarks and the logo is a service mark of NetModule AG, Switzerland.
All other products or company names mentioned herein are used for identification purposes only and may be trademarks
or registered trademarks of their respective owners. The following description of software, hardware or process of
NetModule or other third party provider may be included with your product and will be subject to the software,
hardware or other license agreements.
Contact
www.netmodule.com/support
NetModule AG Tel +41 31 985 25 10
Meriedweg 11 Fax +41 31 985 25 11
CH-3172 Niederwangen [email protected]
Switzerland http://www.netmodule.com
2
Page 3
Contents
1. Welcome to NetModule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2. Conformity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1. Safety Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2. Declaration of Conformity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3. Waste Disposal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4. National Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.5. Open Source Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3. Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.1. Appearance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.2. Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.3. Operating Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.4. Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.4.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.4.2. Mobile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.4.3. WLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.4.4. GPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.4.5. USB 2.0 Host Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.4.6. RJ45 Ethernet Connectors . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.4.7. 13 Pin Terminal Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.4.8. Extension Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
4. Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.1. Environmental Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.2. Installation of the Router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.3. Installation of the Mini-SIM Cards . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.4. Installation of the GSM/UMTS/LTE Antenna . . . . . . . . . . . . . . . . . . . 23
4.5. Installation of the WLAN Antennas . . . . . . . . . . . . . . . . . . . . . . . . . 23
4.6. Installation of the GPS Antenna . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
4.7. Installation of the Local Area Network . . . . . . . . . . . . . . . . . . . . . . . 24
4.8. Installation of the Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
5. Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5.1. First Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5.1.1. Initial Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5.1.2. Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
5.2. HOME . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
5.3. INTERFACES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.3.1. WAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.3.2. Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
5.3.3. Mobile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
5.3.4. WLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
5.3.5. USB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
5.3.6. Serial Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
5.3.7. Digital I/O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
5.3.8. Audio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
5.3.9. GNSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
3
Page 4
NB2710 User Manual 4.0
5.4. ROUTING . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
5.4.1. Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
5.4.2. Extended Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
5.4.3. Multipath Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
5.4.4. Mobile IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
5.4.5. Quality Of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
5.4.6. Multicast . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
5.4.7. OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
5.4.8. BGP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
5.5. FIREWALL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
5.5.1. Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
5.5.2. Adress/Port Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
5.5.3. Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
5.5.4. NAPT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
5.6. VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
5.6.1. OpenVPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
5.6.2. IPsec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
5.6.3. PPTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
5.6.4. GRE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
5.6.5. Dial-In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
5.7. SERVICES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
5.7.1. SDK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
5.7.2. DHCP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
5.7.3. DNS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
5.7.4. NTP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
5.7.5. Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
5.7.6. E-Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
5.7.7. Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
5.7.8. SMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
5.7.9. SSH/Telnet Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
5.7.10. SNMP Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
5.7.11. Web Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
5.7.12. Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
5.7.13. Redundancy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
5.7.14. Voice Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
5.8. SYSTEM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
5.8.1. System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
5.8.2. Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
5.8.3. Software Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
5.8.4. Module Firmware Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
5.8.5. Software Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
5.8.6. Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
5.8.7. Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
5.8.8. Keys and Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
5.8.9. Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
5.8.10. Legal Notice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
5.9. LOGOUT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
4
Page 5
NB2710 User Manual 4.0
6. Command Line Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
6.1. General Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
6.2. Print Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
6.3. Getting Config Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
6.4. Setting Config Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
6.5. Getting Status Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
6.6. Scanning Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
6.7. Sending E-Mail or SMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
6.8. Updating System Facilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
6.9. Manage keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
6.10. Restarting Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
6.11. Debug System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
6.12. Resetting System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
6.13. Rebooting System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
6.14. Running Shell Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
6.15. Working with History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
6.16. CLI-PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
A. Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
A.1. Abbrevations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
A.2. System Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
A.3. Factory Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
A.4. SNMP VENDOR MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
A.5. SDK Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
5
Page 6
List of Figures
5.1. Initial Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
5.2. Home . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
5.3. WAN Links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.4. WAN Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
5.5. Link Supervision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
5.6. Ethernet Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
5.7. Ethernet Link Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
5.8. VLAN Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
5.9. LAN IP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
5.10. SIMs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
5.11. WWAN Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
5.12. WLAN Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
5.13. WLAN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
5.14. WLAN IP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
5.15. USB Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
5.16. USB Device Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.17. Serial Port Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
5.18. Serial Port Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
5.19. Digital I/O Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
5.20. Static Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
5.21. Extended Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
5.22. Multipath Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
5.23. Mobile IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
5.24. Firewall Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
5.25. Firewall Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
5.26. Masquerading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
5.27. Inbound NAPT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
5.28. OpenVPN Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
5.29. OpenVPN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
5.30. OpenVPN Client Management . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
5.31. IPsec Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
5.32. IPsec Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
5.33. PPTP Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
5.34. PPTP Tunnel Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
5.35. PPTP Client Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
5.36. Dial-in Server Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
5.37. SDK Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
5.38. SDK Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
5.39. DHCP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
5.40. DNS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
5.41. NTP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
5.42. Dynamic DNS Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
5.43. E-Mail Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
5.44. SMS Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
6
Page 7
NB2710 User Manual 4.0
5.45. SSH and Telnet Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
5.46. SNMP Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
5.47. Web Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
5.48. VRRP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
5.49. Voice Gateway Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
5.50. Voice Gateway Endpoint Configuration . . . . . . . . . . . . . . . . . . . . . . . 129
5.51. Voice Gateway Routing Configuration . . . . . . . . . . . . . . . . . . . . . . . . 132
5.52. System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
5.53. Regional settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
5.54. User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
5.55. Remote Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
5.56. Manual File Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
5.57. Automatic File Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
5.58. Factory Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
5.59. Log Viewer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
5.60. Tech Support File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
5.61. Keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
5.62. Certificate Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
5.63. Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
7
Page 8
List of Tables
3.1. NB2710 Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2. NB2710 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.3. Mobile Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.4. IEEE 802.11 Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.5. GPS Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.6. GNSS Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.7. USB 2.0 Host Port Specification . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.8. Ethernet Port Specification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.9. Pin Assignments of RJ45 Ethernet Connectors . . . . . . . . . . . . . . . . . . . 17
3.10. Power Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.11. RS-232 Port Specification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.12. Common Digital I/O Specification . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.13. Isolated Digital Outputs Specification . . . . . . . . . . . . . . . . . . . . . . . . 19
3.14. Isolated Digital Inputs Specification . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.15. Pin Assignments of Terminal Block . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.16. Audio Port Specification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.17. Pin Assignments of RJ45 Audio Connector . . . . . . . . . . . . . . . . . . . . . 21
3.18. Pin Assignments of RJ45 CAN/RS485 Connector . . . . . . . . . . . . . . . . . 21
4.1. Operating Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.2. LTE/UMTS antenna port types . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
4.3. WLAN antenna port types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
5.19. IEEE 802.11 Network Standards . . . . . . . . . . . . . . . . . . . . . . . . . . 47
5.38. Static Route Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
5.83. SMS Control Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
5.93. SMS Number Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
5.130. Certificate Sections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
5.131. Certificate Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
A.1. Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
A.2. System Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
A.3. SDK Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
8
Page 9
1. Welcome to NetModule
Thank you for purchasing a NetModule Router. This document should give you an introduction to
the router and its features. The following chapters describe any aspects of commissioning the device,
installation procedure and provide helpful information towards configuration and maintenance.
Please find further imformation such as sample SDK script or configuration samples in our wiki on
http://wiki.netmodule.com.
9
Page 10
2. Conformity
This chapter provides general information for putting the router into operation.
2.1. Safety Instructions
NetModule routers must be used in compliance with any and all applicable national and international
laws and with any special restrictions regulating the utilization of the communication module in
prescribed applications and environments.
We would like to point out that only the original accessories, shipping with the router, must be
used in order to prevent possible injury to health or damage to appliances and to ensure that
all the relevant provisions have been complied with. Unauthorized modifications or utilization of
unapproved accessories may void the warranty. The routers must not be opened. However, it is
possible to replace any pluggable SIM cards even during operation.
All circuits connected to the interfaces of the router must comply with the requirements of Safety
Extra Low Voltage (SELV) circuits and have to be designed for indoor use only. Interconnections
must not leave the building nor penetrate the body shell of a vehicle. Possible antenna circuits
must be limited to over-voltage transient levels below 1 500 VDC (according to IEC 60950-1, TNV-1
circuit levels) by using safety approved components.
NB2710 routers shall only be used with a certified (CE or equivalent) power supply which must
have a power limited and SELV circuit output.
They are basically designed for indoor use. Do not expose the communication module to extreme ambient conditions and protect the communication module against dust, moisture and high
temperature.
We remind the user of the duty to observe the restrictions concerning the utilization of radio devices
at petrol stations, in chemical facilities or in the course of blasting works in which explosives are
used. Switch off the communication module when traveling by plane.
You need to pay increased attention when using the communication module close to personal
medical devices, such as cardiac pacemakers or hearing aids. NetModule routers may also cause
interference in the nearer distance of TV sets, radio receivers and personal computers.
Avoid any installation of the antenna during a lightning. Always keep a distance of more than 40
cm from the antenna in order to reduce exposure to electromagnetic fields below the legal limits.
This distance applies to
gain.
Any Ethernet cabling must be shielded, the Ethernet section of this manual provides more information.
Devices with a WLAN interface may be operated only with applicable Regulatory Domain configured. Special attention must be paid to country, number of antennas and the antenna gain (see
also chapter 5.3.4). A misconfiguration will lead to loss of the approval.
Cellular antennas attached to the router must have an antenna gain of equal or less than 2.5 dBi.
If an extension cable is used to attach the antenna, the antenna gain may be higher by the amount
of cable attenuation. The user is responsible for the compliance with the legal regulations.
We highly recommended creating a copy of a working system configuration. It can be downloaded
using the Web Manager and easily applied to a newer software release afterwards as we generally
guarantee backward compatibility.
λ
- and
4
λ
-antennas. Larger distances may apply to antennas with higher
2
10
Page 11
2.2. Declaration of Conformity
NetModule hereby declares that under our own responsibility that the routers
comply with the relevant standards following the provisions of the Council Di-
rective 1999/5/EC. The signed version of the Declarations of Conformity can
be found on the NetModule web page.
2.3. Waste Disposal
In accordance with the requirements of the Council Directive 2002/96/EC regarding Waste Electrical and Electronic Equipment (WEEE), you are urged to
ensure that this product will be segregated from other waste at end-of-life and
delivered to the WEEE collection system in your country for proper recycling.
2.4. National Restrictions
NB2710 User Manual 4.0
This product may be generally used in all EU countries (and other countries following the EU
directive 1999/5/EC) without any limitation. Please refer to our WLAN Regulatory Database for
getting further national radio interface regulations and requirements for a particular country.
11
Page 12
NB2710 User Manual 4.0
2.5. Open Source Software
We inform you that NetModule products may contain in part open-source software. We are distributing such open-source software to you under the terms of GNU General Public License (GPL)1,
GNU Lesser General Public License (LGPL)2or other open-source licenses3. These licenses allow
you to run, copy, distribute, study, change and improve any software covered by GPL, Lesser GPL,
or other open-source licenses without any restrictions from us or our end user license agreement
on what you may do with that software. Unless required by applicable law or agreed to in writing, software distributed under open-source licenses is distributed on an "AS IS" basis, WITHOUT
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
To obtain the corresponding open source codes covered by these licenses, please contact our technical support at [email protected].
Acknowledgements
This product includes:
• PHP, freely available from http://www.php.net
• Software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org)
• Cryptographic software written by Eric Young ([email protected])
• Software written by Tim Hudson ([email protected])
• Software written Jean-loup Gailly and Mark Adler
• MD5 Message-Digest Algorithm by RSA Data Security, Inc.
• An implementation of the AES encryption algorithm based on code released by Dr Brian
Gladman
• Multiple-precision arithmetic code originally written by David Ireland
• Software from The FreeBSD Project (http://www.freebsd.org)
1
Please find the GPL text under http://www.gnu.org/licenses/gpl-2.0.txt
2
Please find the LGPL text under http://www.gnu.org/licenses/lgpl.txt
3
Please find the license texts of OSI licenses (ISC License, MIT License, PHP License v3.0, zlib License) under
http://opensource.org/licenses
12
Page 13
3. Specifications
3.1. Appearance
13
Page 14
NB2710 User Manual 4.0
3.2. Features
All models of NB2710 have following standard functionalities:
• Input power
• 4 Ethernet ports (10/100 Mbps)
• 2 digital inputs, 2 digital outputs
• 1 serial port (RS-232)
• 1 USB 2.0 host port
• 6 mini SIM card slots
• Extension port
The NB2710 can be equipped with the following options:
• LTE
• LTE 450MHz
• LTE US
• CDMA 450MHz
• WLAN IEEE 802.11abgn
• GPS/GNSS
• RS-232
• RS-485
• IBIS
• CAN
• Audio
• 64 GB internal storage
• Software Key Server
• Software Key Voice
Note:All LTE models include support for UMTS/EDGE/GPRS.
Due to its modular approach, the NB2710 router and its hardware components can be arbitrarily
assembled according to its indented usage or application. Please contact us in case of special
project requirements.
14
Page 15
NB2710 User Manual 4.0
3.3. Operating Elements
The following table describes the NB2710 status indicators.
Label Color State Function
Status l blinking The device is busy due to startup, software or configuration
update.
l on The device is ready. The captions of the top bank apply.
l on The device is ready. The captions of the bottom bank apply.
Mob1 lll
Mob2 lll
[1]
on Mobile connection 1 is up.
l blinking Mobile connection 1 is being established.
m off Mobile connection 1 is down.
[1]
on Mobile connection 2 is up.
l blinking Mobile connection 2 is being established.
m off Mobile connection 2 is down.
VPN l on VPN connection is up.
m off VPN connection is down.
WLAN lll
[1]
on WLAN connection is up.
l blinking WLAN connection is being established.
m off WLAN connection is down.
GNSS l on GNSS is turned on and a valid NMEA stream is available.
l blinking GNSS is searching for satellites.
m off GNSS is turned off or no valid NMEA stream is available.
Voice l on A voice call is currently active.
m off No voice call is active.
DO1 l on Normally open output port 1 is closed.
m off Normally open output port 1 is open.
DO2 l on Normally closed output port 2 is closed.
m off Normally closed output port 2 is open.
15
Page 16
NB2710 User Manual 4.0
Label Color State Function
DI1 l on Input port 1 is set.
m off Input port 1 is not set.
DI2 l on Input port 2 is set.
m off Input port 2 is not set.
[1]
The color of the LED represents the signal quality for wireless links.
l red means low
l yellow means moderate
l green means good or excellent
Table 3.1.: NB2710 Status Indicators
16
Page 17
NB2710 User Manual 4.0
3.4. Interfaces
3.4.1. Overview
Label Panel Function
SIM 1 Front SIM 1, it can be assigned dynamically to any modem by configura-
tion.
SIM 2 Front SIM 2, it can be assigned dynamically to any modem by configura-
tion.
SIM 3 Front SIM 3, it can be assigned dynamically to any modem by configura-
tion.
SIM 4 Front SIM 4, it can be assigned dynamically to any modem by configura-
tion.
SIM 5 Front SIM 5, it can be assigned dynamically to any modem by configura-
tion.
SIM 6 Front SIM 6, it can be assigned dynamically to any modem by configura-
tion.
USB Front USB 2.0 host port, can be used as USB device server or for software
configuration updates.
Ethernet 1-4 Rear Ethernet switch ports, can be used for LAN/WAN.
Extension Rear Audio/CAN/IBIS/RS485 extension.
Mob 1 Rear 2 SMA female connectors for MIMO LTE antenna
Mob 2 Rear 2 SMA female connectors for MIMO LTE antenna
GPS Rear SMA female connector for GPS antenna
WLAN1 Rear 2 SMA female connectors for MIMO WLAN antenna
WLAN2 Rear 2 SMA female connectors for MIMO WLAN antenna
Power Rear Power supply 12-48 VDC (Pins 1 and 2)
RS-232 Rear Non-isolated serial RS-232 interface (Pins 3 to 5) which can be
used for console administration, serial device server or other serial
based communication applications.
Outputs Rear Galvanically isolated digital outputs (Pins 6 to 9)
Inputs Rear Galvanically isolated digital inputs (Pins 10 to 13)
Reset Front The reset button is accessible through a small hole below the USB
connector. Press at least 3 seconds for reboot and at least 10 second
for a factory reset. The start of the factory reset is confirmed by
all LEDs lighting up for a second. The button can be released then
again.
Table 3.2.: NB2710 Interfaces
17
Page 18
NB2710 User Manual 4.0
3.4.2. Mobile
The various variants of the NB2710support multiple multimode modules for mobile communication.
Standard Bands
4G (LTE/FDD) B1(2100), B2(1900), B3(1800), B5(850), B7(2600), B8(900),
B20(800)
3G (DC-HSPA+/UMTS) B5(850), B8(900), B2(1900), B1(2100)
2G (EDGE/GPRS/GSM) B9(900), B3(1800), B2(1900)
LTE450 LTE Band 3 (1800 MHz), LTE Band 7 (2600 MHz), LTE Band
20 (800 MHz), LTE Band 31 (450 MHz), UMTS Band 1 (2100
MHz), UMTS Band 8 (900 MHz)
CDMA450 Band Class 5 Block Designators A + B
Table 3.3.: Mobile Interface
The LTE modules support 2x2 MIMO.
Data rates: LTE max. 100 Mbps downlink / 50 Mbps uplink (DC-HSPA+ 42/5.76); CDMA450
max. 14,7 Mbps downlink / 5.4 Mbps uplink
3.4.3. WLAN
The variants of the NB2710support 802.11 a/b/g/n WLAN modules. It can operate either as client
or access point.
Standard Frequencies Bandwidth Data Rate
802.11a 5 GHz 20 MHz 54 Mbit/s
802.11b 2.4 GHz 20 MHz 11 Mbit/s
802.11g 2.4 GHz 20 MHz 54 Mbit/s
802.11n 2.4/5 GHz 20/40 MHz 300 Mbit/s
Table 3.4.: IEEE 802.11 Standards
Note: 802.11n supports 2x2 MIMO
18
Page 19
NB2710 User Manual 4.0
3.4.4. GPS
Feature Specification
Systems GPS/GLONASS
Data stream JSON or NMEA
Tracking sensitivity -154 dBm
Supported antennas Active and passive
Table 3.5.: GPS Specifications
GNSS (Option Ge)
The GNSS module supports Dead Reckoning with onboard 3D accelerometer and 3D gyroscope.
Feature Specification
Systems GPS/GLONASS/BeiDu/Galileo ready
Data stream NMEA or UBX
Tracking sensitivity -160 dBm
Channels 72
Accuracy 2m
Supported antennas Active and passive
Table 3.6.: GNSS Specifications
3.4.5. USB 2.0 Host Port
The USB 2.0 host port has the following specification:
Feature Specification
Speed Low, Full & Hi-Speed
Current max. 500mA
Table 3.7.: USB 2.0 Host Port Specification
19
Page 20
NB2710 User Manual 4.0
3.4.6. RJ45 Ethernet Connectors
Specification
The Ethernet ports are specified as follows:
Feature Specification
Isolation 1000 VAC
Speed 10/100 Mbps
Mode Half- & Full-Duplex
Crossover Automatic MDI/MDI-X
Table 3.8.: Ethernet Port Specification
Pin Assignment
Pin Signal
1 TX+
2 TX−
3 RX+
4 -
5 -
6 RX−
7 -
8 -
Table 3.9.: Pin Assignments of RJ45 Ethernet Connectors
Note: Pairs 4-5 and 7-8 have an internal 100 Ω termination.
20
Page 21
NB2710 User Manual 4.0
3.4.7. 13 Pin Terminal Block
Power Supply
NB2710 routers provide a non-isolated power supply input. The power port has the following
specifications:
Feature Specification
Power supply nominal voltages 12 VDC, 24 VDC, 36 VDC and 48 VDC
Voltage range 12 VDC to 48 VDC (−15% / +20%)
Max. power consumption 8 W
Table 3.10.: Power Specifications
RS-232
The RS-232 port is specified as follows:
Feature Specification
Protocol 3-wire RS-232 (TXD, RXD, GND)
Baud rate 300, 1 200, 2 400, 4 800, 9 600, 19 200, 38 400,
57 600, 115 200
Data bits 7 bit, 8 bit
Parity none, odd, even
Stop bits 1, 2
Software flow control None, XON/XOFF
Hardware flow control None
Table 3.11.: RS-232 Port Specification
21
Page 22
NB2710 User Manual 4.0
Isolated Digital I/Os
The isolated input and oputput ports have the following specification in common:
Feature Specification
Isolation to enclosure/GND 1’414 VDC
Isolation to adjacent I/O functional
Table 3.12.: Common Digital I/O Specification
Isolated Outputs
The isolated digital output ports have the following specification:
Feature Specification
Number of output ports 2
Limiting continuous current 1 A
Maximum switching voltage 60 VDC, 42 VAC ( Vrms)
Maximum switching capacity 60 W
Table 3.13.: Isolated Digital Outputs Specification
Isolated Inputs
The isolated digital input ports have the following specification:
Feature Specification
Number of inputs 2
Maximum input voltage 40 VDC
Minimum voltage for level 1
(set) 7.2 VDC
Maximum voltage for level 0
(not set) 5.0 VDC
Table 3.14.: Isolated Digital Inputs Specification
Note: A negative input voltage is not recognized.
22
Page 23
Pin Assignment
Pin Name Description
1 VGND Power Ground
PWR
2 V+ 12 VDC to 48 VDC
3 RxD RS-232 RxD (non-isolated)
4 TxD RS-232 TxD (non-isolated)
RS232
5 GND RS-232 GND (non-isolated)
6 DO1 Dry contact relay normally open
7 DO1 Dry contact relay normally open
8 DO2 Dry contact relay normally closed
Outputs
9 DO2 Dry contact relay normally closed
10 DI1− Digital Input 1 (negative)
11 DI1+ Digital Input 1 (positive)
NB2710 User Manual 4.0
Inputs
12 DI2− Digital Input 2 (negative)
13 DI2+ Digital Input 2 (positive)
Table 3.15.: Pin Assignments of Terminal Block
3.4.8. Extension Port
Specification
In case of an audio extension, the audio port has the following specification:
Feature Specification
Input Impedance 44 kΩ, signal level 2 Vpp
Output Impedance 100 Ω, signal level 2 Vpp
Table 3.16.: Audio Port Specification
Note: Only the output signal level can be adjusted by software.
23
Page 24
NB2710 User Manual 4.0
Pin Assignment Audio
Pin Signal
1 Input Left Channel +
2 Input Left Channel −
3 Input Right Channel +
4 Output Right Channel +
5 Output Right Channel −
6 Input Right Channel −
7 Output Left Channel +
8 Output Left Channel −
Table 3.17.: Pin Assignments of RJ45 Audio Connector
Note: In the case of mono operation the left channels are used.
Pin Assignment CAN
Pin Signal
1 CAN_H
2 CAN_L
3 CAN_GND
4 RxD/TxD (B)
5 RxD/TxD (A)
6
7 CAN_GND
8 GND
Table 3.18.: Pin Assignments of RJ45 CAN/RS485 Connector
24
Page 25
4. Installation
4.1. Environmental Conditions
The following precautions must be taken before installing a NB2710 router:
• Avoid direct solar radiation
• Protect the device from humidity, steam and aggressive fluids
• Guarantee sufficient circulation of air around the device
• The device is for indoor use only
Parameter Rating
Input Voltage 12 VDC to 48 VDC (−15% / +20%)
main board: −40◦C to +85◦C
Operating Temperature Range
Humidity 0 to 95% (non-condensing)
Altitude up to 4000m
Over-Voltage Category I
Pollution Degree 2
Ingress Protection Rating IP40 (with SIM and USB covers mounted)
Table 4.1.: Operating Conditions
UMTS: −25◦C to +70◦C
LTE: −25◦C to +70◦C
WLAN: −25◦C to +70◦C
4.2. Installation of the Router
The NB2710 is designed for mounting it on a worktop or wall. Please consider the safety instructions
and the environmental conditions in chapter 2.
4.3. Installation of the Mini-SIM Cards
Up to six Mini-SIM cards can be inserted in a NB2710 router.
SIM cards can be inserted by sliding it into one of the designated slots on the front panel. You
have to push the SIM card using a small paper clip (or similar) until it snaps into place. To remove
the SIM, you will need to push it again in the same manner. The SIM card will then rebounce and
can be pulled out.
SIMs can be assigned flexibly to any modem in the system. It is also possible to switch a SIM to a
different modem during operation, for instance if you want to use another provider upon a certain
condition. However, a SIM switch usually takes about 10-20 seconds which can be bypassed (e.g.
at bootup) if SIMs are installed reasonably. Using only a single SIM with one modem, it should be
preferably placed into the SIM 1 holder. For systems which should operate two modems with two
SIMs in parallel, we recommend to assign Mob 1 to SIM 1 and Mob 2 to SIM 2.
25
Page 26
NB2710 User Manual 4.0
Further information about SIM configuration can be found in chapter 5.3.3.
4.4. Installation of the GSM/UMTS/LTE Antenna
NetModule routers will only operate efficiently in the cellular network if there is a good signal.
A stub antenna will be suitable for most applications. However, in some circumstances it might
be necessary to use remote antennas together with an extended cable to reach a better location
offering an adequate signal. In doubt, please contact us and we would be pleased to assist you in
figuring out the best matching antenna setup for your application.
Keep in mind that effects caused by Faraday cages such as large metal surfaces (elevators, machine
housings, etc.), close meshed iron constructions and others may reduce signal reception significantly.
The mounted antennas or antenna cables should be fixed with a wrench.
The following table shows how to connect the LTE/UMTS antennas. Generally, LTE antennas use
both, main and auxiliary ports, but UMTS requrires only main ports.
Antenna Port Type
Mob 1 (Top) Main
Mob 1 (Bottom) Auxiliary
Mob 2 (Top) Main
Mob 2 (Bottom) Auxiliary
Table 4.2.: LTE/UMTS antenna port types
4.5. Installation of the WLAN Antennas
The following table shows how to connect the WLAN antennas. The number of attached antennas
can be configured in the software. If only one antenna is used, it must be attached to the main
port. However, for better diversity and thus better throughput and coverage, we highly recommend
using two antennas.
Antenna Port Type
WLAN (Top) Main
WLAN (Bottom) Auxiliary
Table 4.3.: WLAN antenna port types
4.6. Installation of the GPS Antenna
The GNSS antenna must be mounted to the connector GPS. Whether the antenna is an active or
passive GPS antenna has to be configured in the software. We recommend active GPS antennas
for highly accurate GPS tracking.
26
Page 27
NB2710 User Manual 4.0
4.7. Installation of the Local Area Network
Up to four 10/100 Mbps Ethernet devices can be directly connected to the router, further devices
can be attached via an addtional Ethernet switch. Please ensure that the connector has been
plugged in properly and remains in a fixed state, you might otherwise experience sporadical link
loss during operation. The Link/Act LED will lit up as soon as the device has synced. If not, it
might be necessary to configure a different link setting as described in chapter 5.3.2.
4.8. Installation of the Power Supply
The router can be powered with an external source supplying between 12 VDC and 48 VDC. It is to be
used with a certified (CE or equivalent) power supply, which must have a limited and SELV circuit
output. The router is now ready for getting engaged.
27
Page 28
5. Configuration
The following chapters give information about setting up the router and configuring its features as
provided with system software 4.0.
5.1. First Steps
NetModule routers can be easily set up by using the HTTP-based configuration interface, called
the Web Manager. It is supported by the latest web browsers (e.g. Microsoft Internet Explorer 11,
Mozilla Firefox 28.0, Safari 7 and many others). Please ensure to have JavaScript turned on.
Any submitted configuration via the Web Manager will be applied immediately to the system when
pressing the Apply button. When configuring subsystems which require multiple steps (for instance
WLAN) you can use the Continue button to store any settings temporarily and apply them at a
later time. Please note, that those settings will be neglected at logout unless applied.
You may also upload configuration files via SNMP, SSH, HTTP or USB in case you intend to deploy
a larger numbers of routers. Advanced users may also use the Command Line Interface (CLI) and
set configuration parameters directly.
The IP address of Ethernet1 is 192.168.1.1 and the Dynamic Host Configuration Protocol
(DHCP) is activated on the interface by default. The following steps need to be taken to establish your first Web Manager session:
1. Connect the Ethernet port of your computer to the Ethernet1 port of the router using a
standard CAT5 cable with RJ45 (or M12) connectors.
2. If not yet activated, enable DHCP on your computer’s Ethernet interface so that an IP
address can be obtained automatically from the router. This usually takes a short amount
of time until your PC has received the corresponding parameters (IP address, subnet mask,
default gateway, name server). You may track the progress by having a look to your network
control panel and check whether your PC has correctly retrieved an IP address of the range
192.168.1.100 to 192.168.1.199.
3. Launch your favorite web browser and point it to the IP address of the router (the URL is
http://192.168.1.1).
4. Please follow the instructions of the Web Manager for configuring the router. Most of the
menus are self-explanatory, further details are given in the following chapters.
5.1.1. Initial Access
In factory state you will be prompted for a new administrator password. Please choose a password
which is both, easy to remember but also robust against dictionary attacks (such as one that
contains numbers, letters and punctuation characters). The password shall have a minimum length
of 6 characters. It shall contain a minimum of 2 numbers and 2 letters.
28
Page 29
NB2710 User Manual 4.0
Figure 5.1.: Initial Login
Please note that the admin password will be also applied for the root user which can be used to
access the device via the serial console, telnet, SSH or to enter the bootloader. You may also
configure additional users which will only be granted to access the summary page or retrieve status
information but not to set any configuration parameters.
A set of services (USB Autorun, CLI-PHP) are by default activated in factory state and will be
disabled as soon as the admin password has been set. They can be enabled again afterwards in
the relevant sections. Other services (SSH, Telnet, Console) can be accessed in factory state by
providing an empty or no password.
5.1.2. Recovery
Following actions might be taken in case the router has been misconfigured and cannot be reached
anymore:
1. Factory Reset: You can initiate a reset back to factory settings via the Web Manager, by
running the command factory-reset or by pressing the reset button. The latter would
require a slim needle or paper clip which must be inserted into the hole below the USB
port . The button must be hold pressed for up to 5 seconds until all LEDs flash up.
2. Serial Console Login: It is also possible to log into the system via the serial port. This would
require a terminal emulator (such as PuTTY or HyperTerminal) and an RS232 connection
(115200 8N1) attached to the serial port of your local computer. You will also see the kernel
messages at bootup there.
3. Recovery Image: In severe cases we can provide a recovery image on demand which can be
29
Page 30
NB2710 User Manual 4.0
loaded into RAM via TFTP and executed. It offers a minimal system image for running a software update or doing other modifications. You will be provided with two files, recovery-image
and recovery-dtb, which must be placed in the root directory of a TFTP server (connected via
LAN1 and address 192.168.1.254). The recovery image can be launched from the boot-loader
using a serial connection. You will have to stop the boot process by pressing s and enter the
bootloader. You can then issue run recovery to load the image and start the system which
can be accessed via HTTP/SSH/Telnet and its IP address 192.168.1.1 afterwards. This
procedure can be also initiated by holding the factory reset button longer than 15 seconds.
30
Page 31
NB2710 User Manual 4.0
5.2. HOME
This page provides a status overview of enabled features and connections.
Figure 5.2.: Home
Summary
This page offers a short summary about the administrative and operational status of the router’s
interfaces.
WAN
This page offers details about any enabled Wide Area Network (WAN) links (such as the IP
addresses, network information, signal strength, etc.) The information about the amount of downloaded/uploaded data is stored in non-volatile memory, thus survive a reboot of the system.
The counters can be reset by pressing the Reset button.
WWAN
This page shows information about modems and their network status.
WLAN
The WLAN page offers details about the enabled WLAN interfaces when operating in access-point
mode. This includes the SSID, IP and MAC address and the currently used frequency and transmit
power of the interface as well as the list of associated stations.
31
Page 32
NB2710 User Manual 4.0
GNSS
This page displays the position status values, such as latitude/longitude, the satellites in view and
more details about the used satellites.
Ethernet
This page shows information about the Ethernet interfaces and packet statistics information.
LAN
This page shows information about the LAN interfaces plus the neighborhood information.
DHCP
This page offers details about any activated DHCP service, including a list of issued DHCP leases.
OpenVPN
This page provides information about the OpenVPN tunnel status.
IPSec
This page provides information about the IPsec tunnel status.
PPTP
This page provides information about the PPTP tunnel status.
GRE
This page provides information about the GRE tunnel status.
MobileIP
This page provides information about Mobile IP connections.
Firewall
This page offers information about any firewall rules and their matching statistics. It can be used
to debug the firewall.
QoS
This page provides information about the used QoS queues.
BGP
This page provides information about the Border Gateway Protocol.
OSPF
This page provides information about the Open Shortest Path First routing protocol.
DynDNS
This page provides information about Dynamic DNS.
System Status
The system status page displays various details of your NB2710 router, including system details,
information about mounted modules and software release information.
32
Page 33
NB2710 User Manual 4.0
SDK
This section will list all webpages generated by SDK scripts.
33
Page 34
NB2710 User Manual 4.0
5.3. INTERFACES
5.3.1. WAN
Link Management
Depending on your hardware model, WAN links can be made up of either Wireless Wide Area
Network (WWAN), Wireless LAN (WLAN), Ethernet or PPP over Ethernet (PPPoE) connections.
Please note that each WAN link has to be configured and enabled in order to appear on this page.
Figure 5.3.: WAN Links
34
Page 35
NB2710 User Manual 4.0
In general, a link will be only dialed or declared as up if the following prerequisites are met:
Condition WWAN WLAN ETH PPPoE
Modem is registered X
Registered with valid service type X
Valid SIM state X
Sufficient signal strength X X
Client is associated X
Client is authenticated X
Valid DHCP address retrieved X X X X
Link is up and holds address X X X X
Ping check succeeded X X X X
The menu can be used further to prioritize your WAN links. The highest priority link which has
been established successfully will become the so-called hotlink which holds the default route for
outgoing packets.
In case a link goes down, the system will automatically switch over to the next link in the priority
list. You can configure each link to be either established when the switch occurs or permanently
in order to minimize link downtime.
Parameter WAN Link Priorities
1st priority The primary link which will be used whenever possible.
2nd priority The first fallback link, it can be enabled permanently or being dialed
as soon as Link 1 goes down.
3rd priority The second fallback link, it can be enabled permanently or being
dialed as soon as Link 2 goes down.
4th priority The third fallback link, it can be enabled permanently or being
dialed as soon as Link 3 goes down.
Links are being triggered periodically and put to sleep in case it was not possible to establish them
within a certain amount of time. Hence it might happen that permanent links will be dialed in
background and replace links with lower priority again as soon as they got established. In case of
interfering links sharing the same resources (for instance in dual-SIM operation) you may define a
switch-back interval after which an active hotlink is forced to go down in order to let the higher-prio
link getting dialed again.
We recommend to use the permanent operation mode for WAN links in general. However, in case
of time-limited mobile tariffs for instance, the switchover mode might be applicable. By using
the distributed mode, it is possible to distribute outgoing traffic over multiple WAN links based
on their weight ratio.
35
Page 36
NB2710 User Manual 4.0
For mobile links, it is further possible to pass through the WAN address towards a local host (also
called Drop-In or IP Pass-through). In particular, the first DHCP client will receive the public IP
address. More or less, the system acts like a modem in such case which can be helpful in case of
firewall issues. Once established, the Web Manager can be reached over port 8080 using the WAN
address but still over the LAN1 interface using port 80.
Parameter WAN Link Operation Modes
disabled Link is disabled
permanent Link is being established permanently
on switchover Link is being established on switchover, it will be dialled if previous
links failed
distributed Link is member of a load distribution group
Parameter WAN Link Settings
Operation mode The operation mode of the link
Weight The weight ratio of a distributed link
Switch-back Specifies the switch-back condition of a switchover link and the
time after an active hotlink will be teared down
NetModule routers provide a feature called IP pass-through (aka Drop-In mode). If enabled, the
WAN address will be be passed-through to the first DHCP client of the specified LAN interface.
As Ethernet-based communication requires additional addresses, we pick an appropriate subnet to
talk to the LAN host. In case this overlaps with other addresses of your WAN network, you may
optionally specify the network given by your provider to avoid any address conflicts.
Parameter IP Pass-Through Settings
IP Pass-through Enables or disables IP pass-through
Interface Specifies the interface on which the address shall be passed-through
WAN network Specifies the WAN network
WAN netmask Specifies the WAN netmask
36
Page 37
NB2710 User Manual 4.0
WAN Settings
This page can be used to configure WAN specific settings like the Maximum Segment Size (MSS).
The MSS corresponds to the largest amount of data (in bytes) that the router can handle in a
single, unfragmented TCP segment. In order to avoid any negative side effects the number of
bytes in the data segment and the headers must not add up to more than the number of bytes
in the Maximum Transmission Unit (MTU). The MTU can be configured per each interface and
corresponds to the largest packet size that can be transmitted.
Figure 5.4.: WAN Settings
Parameter TCP MSS Settings
MSS adjustment Enable or disable MSS adjustment on WAN interfaces.
Maximum segment size Maximum number of bytes in a TCP data segment.
37
Page 38
NB2710 User Manual 4.0
Supervision
Network outage detection on a per-link basis can be performed by sending pings on each link to
some authoritative hosts. A link will be declared as down in case all trials have failed and only as
up if at least one host can be reached.
Figure 5.5.: Link Supervision
Parameter Supervision Settings
Link The WAN link to be monitored (can be ANY)
Mode Specifies whether the link shall only be monitored if being up (e.g.
for using a VPN tunnel) or if connectivity shall be also validated at
connection establishment (default)
Primary host The primary host to be monitored
Secondary host The secondary host to be monitored (optional)
Ping timeout The amount of time in milliseconds a response for a single ping can
take, consider to increase this value in case of slow and tardy links
(such as 2G connections)
Ping interval The interval in seconds at which pings are transmitted on each
interface
38
Page 39
NB2710 User Manual 4.0
Parameter Supervision Settings
Retry interval The interval in seconds at which pings are re-transmitted in case a
first ping failed
Max. number of failed trials
Emergency action The emergency action which should be taken after a maximum
The maximum number of failed ping trials until the link will be
declared as down
downtime has been reached. Using reboot would perform a reboot
of the system, restart link services will restart all link-related
applications including a reset of the modem.
39
Page 40
NB2710 User Manual 4.0
5.3.2. Ethernet
NB2710 routers ship with an Ethernet switch (ETH1-ETH4) and an additional extension port which
can be linked via RJ45 connectors.
ETH1 usually forms the LAN1 interface which should be used for LAN purposes. Other interfaces
can be used to connect other LAN segments or for configuring a WAN link. The LAN10 interface
will be available as soon as a pre-configured USB Ethernet device has been plugged in.
Ethernet Port Assignment
Figure 5.6.: Ethernet Ports
This menu can be used to individually assign each Ethernet port to a LAN interface, just in case
you want to have different subnets per port or use one port as WAN interface. You may assign
multiple ports to the same interface.
40
Page 41
Ethernet Link Settings
NB2710 User Manual 4.0
Figure 5.7.: Ethernet Link Settings
Link negotiation can be set for each Ethernet port individually. Most devices support autonegotiation which will configure the link speed automatically to comply with other devices in the
network. In case of negotiation problems, you may assign the modes manually but it has to be
ensured that all devices in the network utilize the same settings then.
VLAN Management
NetModule routers support Virtual LAN according to IEEE 802.1Q which can be used to create
virtual interfaces on top of an Ethernet interface. The VLAN protocol inserts an additional header
to Ethernet frames carrying a VLAN Identifier (VLAN ID) which is used for distributing the packets
to the associated virtual interface. Any untagged packets, as well as packets with an unassigned
ID, will be distributed to the native interface.
41
Page 42
NB2710 User Manual 4.0
Figure 5.8.: VLAN Management
In order to form a distinctive subnet, the network interface of a remote LAN host must be configured
with the same VLAN ID as defined on the router. Further, 802.1P introduces a priority field which
influences packet scheduling in the TCP/IP stack.
The following priority levels (from lowest to highest) exist:
Parameter VLAN Priority Levels
0 Background
1 Best Effort
2 Excellent Effort
3 Critical Applications
4 Video (< 100 ms latency and jitter)
5 Voice (< 10 ms latency and jitter)
6 Internetwork Control
7 Network Control
42
Page 43
NB2710 User Manual 4.0
IP Settings
This page can be used to configure IP addressing for your LAN/WAN Ethernet interfaces. In
addition to the primary IP address/subnet mask you may define an additional IP address alias on
the interface.
Please keep in mind that the DNS servers can be set globally in the DNS server configuration menu.
But as soon as a link comes up it will use the interface-specific name-servers (e.g. the ones being
retrieved over DHCP) and update the resolver configuration accordingly.
Figure 5.9.: LAN IP Configuration
Parameter LAN IP Settings
Mode Defines whether this interface is being used as LAN or WAN inter-
face
When running in LAN mode, the interface may be configured with the following settings:
Parameter LAN IP Settings
IP address The IP interface address
Subnet mask The subnet mask for this interface
Alias IP address The alias IP interface address
Alias subnet mask The alias subnet mask for this interface
43
Page 44
NB2710 User Manual 4.0
When running in WAN mode, the interface may be configured with the following settings:
Parameter WAN IP Settings
WAN mode The WAN operation mode, defines whether the interface should
run as DHCP client, statically configured or over PPPoE.
MTU The Maximum Transmission Unit for the interface, if provided it will
specify the largest size of a packet transmitted on the interface.
When running as DHCP client, no further configuration is required because all IP-related settings
(address, subnet, gateway, DNS server) will be retrieved from a DHCP server in the network. You
may also define static values but caution has to be taken to assign an unique IP address as it would
otherwise raise IP conflicts in the network.
PPPoE is commonly used when communicating with another WAN access device (like a DSL
modem). The following settings can be applied:
Parameter PPPoE Configuration
User name PPPoE user name for authenticating at the access device
Password PPPoE password for authenticating at the access device
Service name Specifies the service name set of the access concentrator and can
be left blank unless you have multiple services on the same physical
network and need to specify the one you want to connect to.
Access concentrator name The name of the concentrator (the PPPoE client will connect to
any access concentrator if left blank)
44
Page 45
5.3.3. Mobile
SIMs
NB2710 User Manual 4.0
Figure 5.10.: SIMs
The SIM page gives an overview about the available SIM cards, their assigned modems and the
current state. Once a SIM card has been inserted, assigned to a modem and successfully unlocked,
the card should remain in state ready and the network registration status should have turned to
registered. If not, please double-check your PIN.
Please keep in mind that registering to a network usually takes some time and depends on signal
strength and possible radio interferences. You may hit the Update button at any time in order to
restart PIN unlocking and trigger another network registration attempt.
Under some circumstances (e.g. in case the modem flaps between base stations) it might be
necessary to set a specific service type or assign a fixed operator. The list of operators around
can be obtained by initiating a network scan (may take up to 60 seconds). Further details can be
retrieved by querying the modem directly, a set of suitable commands can be provided on request.
45
Page 46
NB2710 User Manual 4.0
Configuration
A SIM card is generally assigned to a default modem but might be switched, for instance if you set
up two WWAN interfaces with one modem but different SIM cards.
Close attention has to be paid when other services (such as SMS or Voice) are operating on that
modem, as a SIM switch will naturally affect their operation.
The following settings can be applied:
Parameter WWAN SIM Configuration
Default modem The default modem assigned to this SIM card
Service type The service type to be used by default with this SIM card. Remem-
ber that the link manager might change this in case of different
settings. The default is to use automatic, in areas with interfering
base stations you can force a specific type (e.g. 3G-only) in order
to prevent any flapping between the stations around.
PIN protection Depending on the used card, it can be necessary to unlock the SIM
with a PIN code. Please check the account details associated with
your purchased SIM and figure out whether it is protected with a
PIN.
PIN code The PIN code for unlocking the SIM card
SMS gateway The service center number for sending short messages. It is gener-
ally retrieved automatically from your SIM card but you may define
a fix number here.
Network
This page provides information about the current network status, signal strength and the Local
Area Identifier (LAI) to which the modem has been registered. An LAI is a globally unique number
that identifies the country, network provider and Local Area Code (LAC, group of base stations) of
any given location area. It can be used to force the modem to register to a particular mobile cell
in case of competing stations.
You may further initiate a mobile network scan for getting networks in range and assign an LAI
manually.
Query
This page allows you to send Hayes AT commands to the modem. Besides the 3GPP-conforming
AT command-set further modem-specific commands can be applicable which we can provide on
demand. Some modems also support running Unstructured Supplementary Service Data (USSD)
requests, e.g. for querying the available balance of a prepaid account.
46
Page 47
NB2710 User Manual 4.0
WWAN Interfaces
This page can be used to manage your WWAN interfaces. The resulting link will pop up automatically as WAN link once an interface has been added. Please refer to chapter 5.3.1 for how to
manage them.
The Mobile LED will be blinking during the connection establishment process and goes on as soon
as the connection is up. Refer to section 5.8.7 or consult the system log files for troubleshooting
the problem in case the connection did not come up.
Figure 5.11.: WWAN Interfaces
The following mobile settings are required:
Parameter WWAN Mobile Parameters
Modem The modem to be used for this WWAN interface
SIM The SIM card to be used for this WWAN interface
Service type The required service type
Please note that these settings supersede the general SIM based settings as soon as the link is
being dialed.
47
Page 48
NB2710 User Manual 4.0
Generally, the connection settings are derived automatically as soon as the modem has registered
and the network provider has been found in our database. Otherwise, it will be required to configure
the following settings manually:
Parameter WWAN Connection Parameters
Phone number The phone number to be dialed, for 3G+ connections this com-
monly refers to be *99***1#. For circuit-switched 2G connections
you can enter the fixed phone number to be dialed in international
format (e.g. +41xx).
Access point name The access point name (APN) being used
Authentication The authentication scheme being used, if required this can be PAP
or/and CHAP
Username The user-name used for authentication
Password The password used for authentication
Furtheron, you may configure the following advanced settings:
Parameter WAN Advanced Parameters
Required signal strength Sets a minimum required signal strength before the connection is
dialed
Home network only Determines whether the connection should only be dialed when
registered to a home network
Negotiate DNS Specifies whether the DNS negotiation should be performed and
the retrieved name-servers should be applied to the system
Call to ISDN Has to be enabled in case of 2G connections talking to an ISDN
modem
Header compression Enables or disables 3GPP header compression which may improve
TCP/IP performance over slow serial links. Has to be supported
by your provider.
Data compression Enables or disables 3GPP data compression which shrinks the size
of packets to improve throughput. Has to be supported by your
provider.
Client address Specifies a fixed client IP address if assigned by the provider
MTU The Maximum Transmission Unit for this interface
48
Page 49
NB2710 User Manual 4.0
5.3.4. WLAN
WLAN Management
In case your router is shipping with a WLAN (or Wi-Fi) module you can operate it either as client,
access point or managed mode. As a client it can create an additional WAN link which for
instance can be used as backup link. As access point, it can form another LAN interface which can
be either bridged to an Ethernet-based LAN interface or create a self-contained IP interface which
can be used for routing and to provide services (such as DHCP/DNS/NTP) in the same way like
an Ethernet LAN interface does.
Figure 5.12.: WLAN Management
If the administrative status is set to disabled, the module will be powered off in order to reduce the
overall power consumption. Regarding antennas, we generally recommend using two antennas for
better coverage and throughput. A second antenna is definitely mandatory if you want to achieve
higher throughput rates as in 802.11n.
A WLAN client will automatically became a WAN link and can be managed as described in
chapter 5.3.1.
49
Page 50
NB2710 User Manual 4.0
Configurable parameters for access-point and client mode:
Parameter WLAN Management
Regulatory Domain Select the country the Router operates in
Number of antennas Set the number of connected antennas
Antenna gain Specify the antenna gain for the connected antennas. Please refer
to the antennas datasheet for the correct gain value.
Warning
Please be aware that any inappropriate parameters can lead to an infringement of
conformity regulations.
Running as access point, you can further configure the following settings:
Parameter WLAN Management
Operation type Specifies the desired IEEE 802.11 operation mode
Radio band Selects the radio band to be used for connections, depending on
your module it could be 2.4 or 5 GHz
Bandwidth Specify the channel bandwidth operation mode
Channel Specifies the channel to be used
Available operation modes are:
Standard Frequencies Bandwidth Data Rate
802.11a 5 GHz 20 MHz 54 Mbit/s
802.11b 2.4 GHz 20 MHz 11 Mbit/s
802.11g 2.4 GHz 20 MHz 54 Mbit/s
802.11n 2.4/5 GHz 20/40 MHz 300 Mbit/s
802.11ac
1
5 GHz 20/40/80 MHz 866.7 Mbit/s
Table 5.19.: IEEE 802.11 Network Standards
Note: NetModule Routers with 802.11n and 802.11ac support 2x2 MIMO
1
Only available for NetModule Routers NB2800, NB3701, NB3711 and NB3800
50
Page 51
NB2710 User Manual 4.0
Prior to setting up an access point, it is always a good idea to run a network scan for getting a list
of neighboring WLAN networks and then choose the less interfering channel. Please note that two
adequate channels are required for getting good throughputs with 802.11n and a bandwidth of 40
MHz.
Running in managed mode, the access-point can be controlled over CAPWAP (RFC 5415). It
establishes a layer-2 tunneling protocol to encrypt transmission of user data from connected stations.
You can configure the following settings:
Parameter WLAN Management
Primary Access Controller Specifies the primary access controller
Secondary Access Controller
WLAN Configuration
Running in client mode, it is possible to connect to one ore more remote access-points. The
system will switch to the next network in the list in case one goes down and return to the highestprioritized network as soon as it comes back. You can perform a WLAN network scan and pick
the settings from the discovered information directly. The authentication credentials have to be
obtained by the operator of the remote access point.
Parameter WLAN Client Configuration
SSID The network name (called SSID)
Security mode The desired security mode
WPA/WPA2 mixed mode WPA2 should be preferred over WPA1, running WPA/WPA2
WPA cipher The WPA cipher to be used, the default is to run both (TKIP and
Identity The identity used for WPA-RADIUS and WPA-EAP-TLS
Passphrase The passphrase used for authentication with WPA-PSK, otherwise
Specifies the secondary access controller
mixed-mode offers both.
CCMP)
the key passphrase for WPA-EAP-TLS
Force PMF Enables Protected Management Frames
Required signal strength Required signal strength to esablish the connection
51
Page 52
NB2710 User Manual 4.0
Running in access-point mode you can create up to 4 SSIDs with each running their own network
configuration. The networks can be individually bridged to a LAN interface or operate as dedicated
interface in routing-mode.
Figure 5.13.: WLAN Configuration
52
Page 53
NB2710 User Manual 4.0
This section can be used to configure security-related settings.
Parameter WLAN Access-Point Configuration
SSID The network name (called SSID)
Security mode The desired security mode
WPA/WPA2 mixed mode WPA2 should be preferred over WPA1, running WPA/WPA2
mixed-mode offers both.
WPA cipher The WPA cipher to be used, the default is to run both (TKIP and
CCMP)
Identity The identity used for WPA-RADIUS and WPA-EAP-TLS
Passphrase The passphrase used for authentication with WPA-PSK, otherwise
the key passphrase for WPA-EAP-TLS
Force PMF Enables Protected Management Frames
Hide SSID Hides the SSID
Isolate clients Disables client-to-client communication
Accounting Sets accounting profile
The following security modes can be configured:
Parameter WLAN Security Modes
Off SSID is disabled
None No authentication, provides an open network
WEP WEP (is nowadays discouraged)
WPA-PSK WPA-PSK (TKIP, CCMP) aka WPA-Personal/Enterprise, provides
password-based authentication
WPA-RADIUS EAP-PEAP/MSCHAPv2, can be used to authenticate against a
remote RADIUS server which can be configured in chapter 5.8.2
WPA-TLS EAP-TLS, performs authentication using certificates which can be
configured in chapter 5.8.8
53
Page 54
NB2710 User Manual 4.0
WLAN IP Settings
This section lets you configure the TCP/IP settings of your WLAN network. A client interface
can be run over DHCP or with a statically configured address and default gateway.
Figure 5.14.: WLAN IP Configuration
The access point networks can be bridged to any LAN interface for letting WLAN clients and
Ethernet hosts operate in the same subnet. However, for multiple SSIDs we strongly recommend to
set up separated interfaces in routing-mode in order to avoid unwanted access and traffic between
the interfaces. The corresponding DHCP server for each network can be configured in afterwards
as described in chapter 5.7.2.
Parameter WLAN IP Settings
Network mode Choose whether the interface shall be operated bridged or in
routing-mode
Bridge interface If bridged, the LAN interface to which the WLAN network should
be bridged
IP address / netmask In routing-mode, the IP address and netmask for this WLAN net-
work
54
Page 55
NB2710 User Manual 4.0
5.3.5. USB
NetModule routers ship with a standard USB host port which can be used to connect a storage,
network or serial USB device. Please contact our support in order to get a list of supported devices.
Figure 5.15.: USB Administration
USB Administration
Parameter USB Administration
Administrative status Specifies whether devices shall be recognized
Enable hotplug Specifies whether device shall be recognized if plugged in during
runtime or only at bootup
Enable USB/IP device
server
If the USB/IP device server has been enabled you can discover the mounted USB devices and
attach them to the USB/IP server. Enabled devices can now be exported to a remote host. You
will need an additional driver on the client for which we provide Windows or Linux drivers. Further
installation instructions can be provided on demand.
Specifies if devices shall be exported over IP
55
Page 56
NB2710 User Manual 4.0
Please note that some USB devices behave latency-sensitive which may raise problems when operating over a slow IP connection. Some devices may generally not work with the USB/IP driver.
Please contact our support in case of compatibility issues.
USB Devices
This page show the currently connected devices and it can be used to enable a specific device based
on its Vendor and Product ID. Only enabled devices will be recognized by the system and raise
additional ports and interfaces.
Figure 5.16.: USB Device Management
Parameter USB Devices
Vendor ID The USB Vendor ID of the device
Product ID The USB Product ID of the device
Module The USB module and type of driver to be applied for this device
Any ID must be specified in hexadecimal notation, wildcards are supported (e.g. AB[0-1][2-3]
or AB*) A USB network device will be referenced as LAN10.
56
Page 57
NB2710 User Manual 4.0
USB Autorun
This feature can be used to automatically launch a shell script or perform a software/config update
as soon as an USB storage stick has been plugged in. For authentication, a file called autorun.key
must exist in the root directory of a FAT16/32 formatted stick. It can be downloaded from that
page and holds the SHA256 hash key of the admin password. The file can hold multiple hashes
which will be processed line-by-line during authentication which can be used for setting up more
systems with different admin passwords.
For new devices with an empty password the hash key
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
can be used.
The hash keys can be generated by running the command echo -n "<admin-password>" |
sha256sum on a Linux system or an Internet hash key generator (search for "sha-256 hash calculator").
Once authentication has succeeded, the system scans for other files in the root directory which can
perform the following actions:
1. For running a script: autorun.sh
2. For a configuration update: cfg-<SERIALNO>.zip (e.g. cfg-00112B000815.zip), or if not
available cfg.zip
3. For a software update: sw-update.img
57
Page 58
NB2710 User Manual 4.0
5.3.6. Serial Port
This page can be used to manage your serial ports. A serial port can be used by:
Parameter Serial Port Usage
none The serial port is not used
login console The serial port is used to open a console which can be accessed with
a serial terminal client from the other side. It will provide helpful
bootup and kernel messages and spawns a login shell, so that users
can login to the system.
device server The serial port will be exposed over a TCP/IP port and can be used
to implement a Serial/IP gateway.
SDK The serial port will be reserved for SDK scripts.
Figure 5.17.: Serial Port Administration
58
Page 59
NB2710 User Manual 4.0
Running a device server, the following settings can be applied:
Figure 5.18.: Serial Port Settings
Parameter Serial Settings
Physical protocol Selects the desired physical protocol on the serial port
Baud rate Specifies the baud rate run on the serial port
Data bits Specifies the number of data bits contained in each frame
Parity Specifies the parity used for every frame that is transmitted or re-
ceived
Stop bits Specifies the number of stop bits used to indicate the end of a
frame
Software flow control Defines the software flow control for the serial port, XOFF will send
a stop, XON a start character to the other end to control the rate
of any incoming data
Hardware flow control You may enable RTS/CTS hardware flow control, so that the RTS
and CTS lines are used to control the flow of data
59
Page 60
NB2710 User Manual 4.0
Parameter Serial Settings
Protocol on TCP/IP You may choose the IP protocols Telnet or TCP raw for the device
server
Port The TCP port for the device server
Timeout The timeout until a client is declared as disconnected
Parameter Server Settings
Protocol on IP port Selects the desired IP protocol (TCP or Telnet)
Port Specifies the TCP port on which the server will be available
Timeout The time in seconds before the port will be disconnected if there is
no activity on it. A zero value disables this function.
Allow remote control Allow remote control (ala RFC 2217) of the serial port
Show banner Show a banner when clients connect
Stop bits Specifies the number of stop bits used to indicate the end of a
frame
Allow clients from Specifies which clients are allowed to connect to the server
Please note that the device server does not provide authentication or encryption and clients will
be able connect from everywhere. Please consider to restrict access to a limited network/host or
block packets by using the firewall.
60
Page 61
NB2710 User Manual 4.0
5.3.7. Digital I/O
The Digital I/O page displays the current status of the I/O ports and can be used to turn output
ports on or off.
Figure 5.19.: Digital I/O Ports
You can apply the following settings:
Parameter Digital I/O Settings
DO1 after reboot Initial status of DO1 after system has booted
DO2 after reboot Initial status of DO2 after system has booted
Besides on and off you may keep the default status as the hardware has initialized it after
power-up.
The digital inputs and outputs can also be monitored and controlled by SDK scripts.
61
Page 62
NB2710 User Manual 4.0
5.3.8. Audio
Audio Administration
This page can be used to pre-configure the audio module. They can be later used for the voice
gateway.
It can be configured as follows:
Parameter Audio Settings
Volume level Default volume level for line-out
Audio Testing
This page can be used to play or record an audio sample.
62
Page 63
NB2710 User Manual 4.0
5.3.9. GNSS
Administration
The GNSS page lets you enable or disable the GNSS modules present in the system and can be
used to configure the daemon that can be used to share access to receivers without contention or
loss of data and to respond to queries with a format that is substantially easier to parse than the
NMEA 0183 emitted directly by the GNSS device.
We are currently running the Berlios GPS daemon (version 3.15), supporting the new JSON format.
Please navigate to http://gpsd.berlios.de for getting more information about how to connect
any clients to the daemon remotely. The position values can also be queried by the CLI and used
in SDK scripts.
Parameter GNNS Module Configuration
Administrative status Enable or disable the GNSS module
Operation mode The mode of operation, either standalone or assisted (for A-GPS)
Antenna type The type of the connected GPS antenna, either passive or actively
3 volt powered
Accuracy The desired accuracy in meters
Fix frame interval The amount of time to wait between fix attempts
Parameter GNNS Server Configuration
Server port The TCP port on which the daemon is listening for incoming con-
nections
Allow clients from Specifies where clients can connect from, can be either everywhere
or from a specific network
Clients start mode Specifies how data transferal is accomplished when a client con-
nects. You can specify on request which typically requires an R
to be sent. Data will be sent instantly in case of raw mode which
will provide NMEA frames or super-raw which includes the original
data of the GPS receiver. If the client supports the JSON format
(i.e. newer libgps is used) the json mode can be specified.
Please consider to restrict access to the server port, either by a specifying a dedicated client network
or by using a firewall rule.
63
Page 64
NB2710 User Manual 4.0
Position
This pages provides further information about the satellites in view and values derived from them:
Parameter GNSS Information
Latitude The geographic coordinate specifying the north-south position
Longitude The geographic coordinate specifying the east-west position
Altitude The height above sea level of the current location
Satellites in view The number of satellites in view as stated in GPGSV frames
Speed The horizontal and vertical speed in meter per second as stated in
GPRMC frames
Satellites used The number of satellites used for calculating the position as stated
in GPGGA frames
Dilution of precision The dilution of precision as stated in GPGSA frames
Furtheron, each satellite also comes with the following details:
Parameter GNSS Satellite Information
PRN The PRN code of the satelitte (also referred as satellite ID) as
stated in GPGSA frames
Elevation The elevation (up-down angle between the dish pointing direction)
in degrees as stated in GPGSV frames
Azimuth The azimuth (rotation around the vertical axis) in degrees as stated
in GPGSV frames
SNR The SNR (Signal to Noise Ratio), often referred as signal strength
Please note that the values are shown as calculated by the daemon, their accuracy might be
suggestive.
Supervision
Parameter GNNS Supervision
Administrative status Enable or disable GNSS supervision
Max. downtime The period of time without valid NMEA information after which an
emergency action will be taken
Emergency action The corresponding emergency action. You can either let just restart
the server which also re-initializes GPS on the module or also reset
the module in severe cases. Please note that this might also have
effect any running WWAN/SMS services.
64
Page 65
NB2710 User Manual 4.0
5.4. ROUTING
5.4.1. Static Routes
This menu shows all routing entries of the system. They are typically formed by an address/netmask
couple (represented in IPv4 dotted decimal notation) which specify the destination of a packet.
The packets can be directed to either a gateway or an interface or both. If interface is set to ANY,
the system will choose the route interface automatically, depending on the best matching network
configured for an interface.
Figure 5.20.: Static Routing
In general, host routes precede network routes and network routes precede default routes. Additionally, a metric can be used to determine the priority of a route, a packet will go in the direction
with the lowest metric in case a destination matches multiple routes.
Netmasks can be specified in CIDR notation (i.e. /24 expands to 255.255.255.0).
65
Page 66
NB2710 User Manual 4.0
Parameter Static Route Configuration
Destination The destination address of a packet
Netmask The subnet mask which forms, in combination with the destination,
the network to be addressed. A single host can be specified by a
netmask of 255.255.255.255, a default route corresponds to 0.0.0.0.
Gateway The next hop which operates as gateway for this network (can be
omitted on peer-to-peer links)
Interface The network interface on which a packet will be transmitted in
order to reach the gateway or network behind it
Metric The routing metric of the interface (default 0), higher metrics have
the effect of making a route less favorable
Flags (A)ctive, (P)ersistent, (H)ost Route, (N)etwork Route, (D)efault
Route
The flags obtain the following meanings:
Flag Description
A The route is considered active, it might be inactive if the interface for this route is not
yet up.
P The route is persistent, which means it is a configured route, otherwise it corresponds
to an interface route.
H The route is a host route, typically the netmask is set to 255.255.255.255.
N The route is a network route, consisting of an address and netmask which forms the
subnet to be addressed.
D The route is a default route, address and netmask are set to 0.0.0.0, thus matching
any packet.
Table 5.38.: Static Route Flags
66
Page 67
NB2710 User Manual 4.0
5.4.2. Extended Routing
Extended routes can be used to perform policy-based routing, they generally precede static routes.
Figure 5.21.: Extended Routing
In contrast to statis routes, extended routes can be made up, not only of a destination address/netmask, but also a source address/netmask, incoming interface and the type of service (TOS) of
packets.
Parameter Extended Route Configuration
Source address The source address of a packet
Source netmask The source address of a packet
Destination address The destination address of a packet
Destination netmask The destination address of a packet
Incoming interface The interface on which the packet enters the system
Type of service The TOS value within the header of the packet
Route to Specifies the target interface or gateway to where the packet should
get routed to
discard if down Discard packets if the specified interface is down
67
Page 68
NB2710 User Manual 4.0
5.4.3. Multipath Routes
Multipath routes will perform weighted IP-session distribution for particular subnets across multiple
interfaces.
Figure 5.22.: Multipath Routes
At least two interfaces have to be defined to establish multipath routing. Additional interfaces can
be added by pressing the plus sign.
Parameter Add Multipath Routes
Target network/netmask Defines the target network for which multipath routing shall be
applied
Interface Selects the interface for one path
Weight Weight of the interface in relation to the others
NextHop Overrides the default gateway of this interface
68
Page 69
NB2710 User Manual 4.0
5.4.4. Mobile IP
Mobile IP (MIP) can be used to enable seamless switching between different kinds of WAN links
(e.g. WWAN/WLAN). The mobile node hereby remains reachable via the same IP address (home
address) at any time, independently of the WAN link being used. Effectively, any WAN link switch
causes very small outages during switchover while keeping all IP connections alive.
Moreover, NetModule routers also support NAT-Traversal for mobile nodes running behind a firewall (performing NAT), which makes mobile nodes even there accessible from a central office via
their home address, and thus, bypassing any complicated VPN setups.
The home agent accomplishes this by establishing a tunnel (similar to a VPN tunnel) between
itself and the mobile node. WAN link switching works by telling the home agent that the WAN
IP address (called the care-of address in MIP terms) of the mobile node has changed. The
home agent will then encapsulate packets destined to a mobile node’s home address into a tunnel
packet containing the current care-of address of the mobile node as its destination address.
To prevent problems with firewalls and private IP addressing, the MIP implementation always
employs reverse tunneling, which means that all traffic sent by a mobile node is relayed via the
tunnel to the home agent instead of directly being conveyed to the final destination. This fact
also empowers MIP to be used as a lightweight VPN replacement (without payload secrecy).
The MIP implementation supports RFCs 3344, 5177, 3024 and 3519. For applications requiring
vast numbers of mobile nodes, interoperability with the Cisco 2900 Series home agent implementation has been verified. However, since NetModule routers implement a mobile node as well as
a home agent, a MIP network with up to 10 mobile nodes can be implemented without requiring
expensive third party routers.
If MIP is run as a mobile node, the following settings can be configured:
Parameter Mobile IP Configuration
Primary home agent address
Secondary home agent address
Home address The permanent home address of the mobile node which can be
SPI The Security Parameter Index (SPI) identifying the security context
The address of the primary home agent
The address of the secondary home agent. The mobile node will
try to register with this home agent, if the primary home agent is
not reachable.
used to reach the mobile router at any time
for the mobile IP tunnel between the mobile node and the home
agent. This is used to distinguish mobile nodes from each other.
Therefore each mobile node needs to be assigned a unique SPI.
This is a 32-bit hexadecimal value.
Authentication type The used authentication algorithm. This can be prefix-suffix-md5
(default for MIP) or hmac-md5.
69
Page 70
NB2710 User Manual 4.0
Parameter Mobile IP Configuration
Shared secret The shared secret used for authentication of the mobile node at
the home agent. This can be either a 128-bit hexadecimal value
or a random length ASCII string.
Life time The lifetime of security associations in seconds
UDP encapsulation Specifies whether UDP encapsulation shall be used or not. To allow
NAT traversal, UDP encapsulation must be enabled.
Mobile network address Optionally specifies a subnet which should be routed to the mobile
node. This information is forwarded via Network Mobility (NEMO)
extensions to the home agent. The home agent can then automatically add IP routes to the subnet via the mobile node. Note
that this feature is not supported by all third party home agent
implementations.
Mobile network mask The network mask for the optional routed network
70
Page 71
NB2710 User Manual 4.0
If MIP is run as a home agent, you will have to set up a home address and network mask for the
home agent first. Then you will need to add the configuration for all mobile nodes which is made
up of the following settings:
Figure 5.23.: Mobile IP
Parameter Mobile IP Node Configuration
SPI The Security Parameter Index (SPI) identifying the security context
for the tunnel between the mobile node and the home agent.
This is used to distinguish mobile nodes from each other. Therefore
each mobile node needs to be assigned a unique SPI. This is a
32-bit hexadecimal value.
Authentication type The used authentication algorithm. This can be prefix-suffix-md5
(default for mobile IP) or hmac-md5.
Shared secret The shared secret used for authentication of the mobile node at
the home agent. This can be either a 128-bit hexadecimal value
or a random length ASCII string.
71
Page 72
NB2710 User Manual 4.0
5.4.5. Quality Of Service
NetModule routers are able to prioritize and shape certain kinds of IP traffic. This is currently
limited on egress, which means that only outgoing traffic can be stipulated.
The current QoS solution is using Stochastic Fairness Queueing (SFQ) classes in combination with
Hierarchy Token Bucket (HTB) qdiscs. Its principle of operation can be summarized as ceiling the
max. throughput per link and shaping traffic by reflecting the specified queue priorities. In general,
the lowest priority number of a queue gets most out of the available bandwidth.
In case of demands for other class or qdisc algorithms please contact our support team in order to
evaluate the best approach for your application.
QoS Administration
The administration page can be used to enable and disable QoS.
QoS Classification
The classification section can be used to define the WAN interfaces on which QoS should be active.
Parameter QoS Interface Parameters
Interface The WAN interface on which QoS should be active
Bandwidth congestion The bandwidth congestion method. In case of auto the system will
try to apply limits in a best-effort way. However, it is suggested to
set fixed bandwidth limits as they also offer a way of tuning the
QoS behaviour.
Downstream bandwidth The available bandwidth for incoming traffic
Upstream bandwidth The available bandwidth for outgoing traffic
IP to ping (primary) An IP, which answers ICMP echo requests to determine the band-
width of the link
IP to ping (secondary) An IP, which answers ICMP echo requests to determine the band-
width of the link
When defining limits, you should consider bandwidth limits which are at least possible as most
shaping and queues algorithms will not work correctly if the specified limits cannot be achieved.
In particular, any WWAN interfaces operating in a mobile environment are suffering variable bandwidths, thus rather lower values should be used.
72
Page 73
NB2710 User Manual 4.0
In case an interface has been activated, the system will automatically create the following queues:
Parameter QoS Default Queues
high A high priority queue which may hold any latency-critical services
(such as VoIP)
default A default queue which will handle all other services
low A low priority queue which may hold less-critical services for which
shaping is intended
Each queue can be configured as follows:
Parameter QoS Queue Parameters
Name The name of the QoS queue
Priority A numerical priority for the queue, lower values indicate higher
priorities
Bandwidth The maximum possible bandwidth for this queue in case the total
bandwidth of all queues exceeds the set upstream bandwidth of
"QoS Interface Parameters"
Set TOS The TOS/DiffServ value to set on matching packets
You can now configure and assign any services to each queue. The following parameters apply:
Parameter QoS Service Parameters
Interface The QoS interface of the queue
Queue The QoS queue to which this service shall be assigned
Source Specifies a network address and netmask used to match the source
address of packets
Destination Specifies a network address and netmask used to match the desti-
nation (target) address of packets
Protocol Specifies the protocol for packets to be matched
Source Port Specifies the source port for packets to be matched
Destination Port Specifies the destination port for packets to be matched
Type of Service Specifies the TOS/DiffServ for packets to be matched
73
Page 74
NB2710 User Manual 4.0
5.4.6. Multicast
Multicast routing (MCR) can be configured and managed by a daemon. Only one MCR daemon
can be used at a time.
NetModule routers ship with two different MCR daemons to select from depending on your dependencies:
Parameter Administrative Status
IGMP proxy
static routes List of MCR rules to forward messages of dedicated source and
disabled Disable routing of multicast messages
IGMP proxy
IGMP proxy which is able to maintain multicast groups on a particular interface and distribute
incoming multicast packets towards the downstream interfaces on which hosts have joined the
groups.
Parameter Multicast Routing Settings
Administrative status Specifies whether multicast routing is active
Incoming interface The upstream interface on which multicast groups are joined and
Distribute to Specifies the downstream interfaces to which multicast packets will
Forwarding of multicast messages that are dynamically detected on
a given interface to another interface
group from a given interface to another
on which multicast packets come in
be forwarded
Static Routes
Routes multicast messages in different directions depending on their origin and group based on a
given set of MCR rules:
Parameter Static Multicast Route
Group IP address of MCR group
Source Source-IP of the packets
Incoming interface Interface to listen on for messages of given group and source
Outgoing interface Interface to forward the messages to
74
Page 75
NB2710 User Manual 4.0
5.4.7. OSPF
The OSPF tab allows the NetModule router to be added to a network of OSPF routers.
Parameter OSPF General Settings
OSPF status Specifies whether the OSPF routing protocol is active
Redistribute connected
routes
Redistribute local routes Redistribute routes from the NetModule router’s own routing table
Redistribute BGP routes Redistribute routes learned via the BGP routing protocol
Redistribute default route Redistribute the routers default route
Disable BGP when VRRP
slave
The interfaces tab is used to define OSPF specific settings for the IP interfaces of the router. If no
settings are defined for a specific interface, default settings will be used.
Parameter OSPF Interfaces
Interface The name of the interface for which settings shall be defined
Authentication The authentication protocol to be used on the interface to authen-
Key The key to be used for authentication
Key ID The ID of the key to be used for authentication (1-255)
Redistribute routes to networks which are directly connected to the
NetModule router
Disables the OSPF protocol when the router is set to slave mode
by the VRRP redundancy protocol
ticate OSPF packets
Cost The cost for sending packets via this interface. If not specified or
set to 0 OSPF defaults are used.
Passive Do not send out OSPF packets on this interface
The networks tab defines the IP networks to be handled in OSPF as well as to which routing area
they belong.
Parameter OSPF Networks
Prefix Prefix of the network
Prefix length Length of the prefix
Area Routing area to which this interface belongs (0-65535, 0 means
backbone)
75
Page 76
NB2710 User Manual 4.0
5.4.8. BGP
The BGP tab allows to set up peerings of the NetModule router with other Border Gateway Protocol
enabled routers.
Parameter BGP General Settings
BGP status Specifies whether the BGP routing protocol is active
AS number The number of the autonomous system to which the NetMod-
ule router belongs (1-4294967295)
Redistribute connected
routes
Redistribute local routes Redistribute routes from the NetModule router’s own routing table
Redistribute OSPF routes Redistribute routes learned via the OSPF routing protocol
Disable BGP when VRRP
slave
The neighbors tab is used to configure all the BGP routers to peer with.
Parameter BGP Neighbors
IP address IP address of the peer router
As number Autonomous system number of the peer router (1-4294967295)
Password Password for authentication with the peer router. If left blank
Multihop Allow multiple hops between this router and the peer router instead
Redistribute routes to networks which are directly connected to the
NetModule router
Disables the BGP protocol when the router is set to slave mode by
the VRRP redundancy protocol
authentication is disabled.
of requiring the peer to be directly connected.
The Networks tab allows to add IP network prefixes that shall be distributed via BGP in addition
to the networks that are redistributed from other sources as defined on the general tab.
Parameter BGP Networks
Prefix Prefix of the network to be distributed
Prefix length Length of the prefix to be distributed
76
Page 77
NB2710 User Manual 4.0
5.5. FIREWALL
5.5.1. Administration
NetModule routers use Linux’s netfilter/iptables firewall framework
(see http://www.netfilter.org for more information) which supports stateful inspection, that
is, granting the same permissions for inherited connections within an IP session (e.g. FTP which
builds up a control and data connection).
The administration page can be used to enable and disable firewalling. When turning it on, a
shortcut can be used to generate a predefined set of rules which allow administration (over HTTP,
HTTPS, SSH or TELNET) by default but block any other packets coming from the WAN interface.
5.5.2. Adress/Port Groups
This menu can be used to form address or port groups which can be later used for firewall rules in
order to reduce the number of rules. If address or port groups have been referenced, packets will
match if one of the configured entities apply to the packet.
Figure 5.24.: Firewall Groups
77
Page 78
NB2710 User Manual 4.0
5.5.3. Rules
In general, the firewall is set up of a range of rules which control each packet’s permission to pass
the router. Please note that the rules are processed by order, that means traversing the list from
top to bottom until a matching rule is found. Packets which are not matching any of the rules
configured will be ALLOWED.
Figure 5.25.: Firewall Rules
Parameter Firewall Rule Configuration
Description A meaningful description about the purpose of this rule
Action Specifies whether the packets of this rule should be allowed or de-
nied
log matches Throw a syslog message if rule matches
Source The source address of matching packets, can be any or specified by
address/network. Selecting on source MAC addreses is possible as
well.
Destination The destination address of matching packets, can be any, local
(addressed to the system itself) or specified by address/network
Incoming interface The interface on which matching packets are received
Protocol The used IP protocol of matching packets (UDP, TCP or ICMP)
78
Page 79
NB2710 User Manual 4.0
Parameter Firewall Rule Configuration
Destination port(s) The destination port of matching packets, which can be specified
by a single port or a range of ports (only UDP/TCP).
The statistics page can be used to figure out if rules have matched any packets and provides a
convenient way to debug your firewall setup.
79
Page 80
NB2710 User Manual 4.0
5.5.4. NAPT
This page can be used to configure Network Address and Port Translation (NAPT) for packets
traversing the system. NAPT hereby modifies IP addresses or/and TCP/UDP ports in matching
IP packets. By tracking those connections, it will also automatically adjust the returning packets
of an IP session.
Figure 5.26.: Masquerading
The administration page lets you specify the interfaces on which masquerading will be performed.
NAT will hereby use the address of the selected interface and choose a random source port for
outgoing connections and thus enables communication between hosts from a private local area
network towards hosts on the public network.
Parameter Masqerading Rules
Interface The outgoing interface on which connections will be masqueraded
Source address The source address or network from which matching packets are
masqueraded
Source netmask The source netmask of the network from which matching packets
are masqueraded
80
Page 81
NB2710 User Manual 4.0
NAPT Inbound Rules
Inbound rules can be used to modify the target section of IP packets and, for instance, forward a
service or port to an internal host. By doing so, you can expose that service and make it available
from the Internet. You may also establish 1:1 NAT mapping for a single host using additional
outbound rules.
Figure 5.27.: Inbound NAPT
Please note that the specified rules are processed by order, that means, traversing the list from top
to bottom until a matching rule is found. If there is no matching rule found, the packet will pass
as is.
Parameter Inbound NAPT Rules
Description A meaningful description of this rule
Incoming interface The interface from which matching packets are received
Source The source address or network from which matching packets are
received
Target address The destination address of matching packets (optional)
Protocol The used protocol of matching packets
Ports The used UDP/TCP port of matching packets
Redirect to The address to which matching packets shall be redirected
81
Page 82
NB2710 User Manual 4.0
Parameter Inbound NAPT Rules
Redirect port The port to which matching packets will be redirected
NAPT Outbound Rules
Outbound rules will modify the source section of IP packets and can be used to establish 1:1 NAT
mappings but also to redirect packets to a specific service.
Parameter Outbound NAPT Rules
Description A meaningful description of this rule
Outgoing interface The outgoing interface on which matching packets are leaving the
router
Target The target address or network to which matching packets are des-
tined
Source address The source address of matching packets (optional)
Protocol The used protocol of matching packets
Ports The used UDP/TCP port of matching packets
Rewrite source address The address to which the source address of matching packets shall
be rewritten
Rewrite source port The port to which the source port of matching packets shall be
rewritten
82
Page 83
5.6. VPN
5.6.1. OpenVPN
OpenVPN Administration
NB2710 User Manual 4.0
Figure 5.28.: OpenVPN Administration
83
Page 84
NB2710 User Manual 4.0
Tunnel Configuration
NetModule routers support one single server tunnel and up to four client tunnels. You can specify
tunnel parameters either in standard configuration or upload an expert mode file which has been
created in advance. Refer to chapter 5.6.1 to learn more about how to manage clients and generate
the files.
Figure 5.29.: OpenVPN Configuration
Parameter OpenVPN Configuration
Operation mode Specifies whether client or server mode should be used for this
tunnel, it further specifies if tunnel shall be configured in a standard
way or if an expert mode file shall be used.
Multipath TCP Enables OpenVPN mulipath TCP support
84
Page 85
NB2710 User Manual 4.0
If the tunnel is operated in client mode, the following settings can be applied:
Parameter OpenVPN Client Configuration
Peer selection Specifies how the remote peer shall be selected, besides a single
server you may configure multiple servers which can, in case of
failures, either be selected sequently (i.e. failover) or randomly (i.e.
load balancing)
Server The address or hostname of the remote server
Port The port of the remote server (1194 by default)
The following settings can be used to configure a tunnel:
Parameter OpenVPN Configuration
Interface type The device type for this tunnel which can be either TUN (typically
used for routed connections) or TAP (required for bridged networks)
Protocol The tunnel protocol to be used for the transport connection
Network mode Defines how the packets should be forwarded, which can be either
routed or bridged from/to a particular LAN interface. If required,
you can also specify the maximum transfer unit for the tunnel interface.
MTU The Maximum Transmission Unit of the tunnel interface
Encryption The required cipher mechanism used for encryption
Digest The digest algorithm used for authenticating
Authentication can be done in the following ways:
Parameter OpenVPN Authentication
certificate-based Certificates and keys for authenticating the tunnel. Please take
care that the proper keys/certificates have been either uploaded or
generated (see 5.8.8).
credential-based Username and password are used for authentication.
both Verifying the tunnel uses certificates and credentials.
none Tunnel is not authenticated (discouraged)
85
Page 86
NB2710 User Manual 4.0
The following further options can be applied:
Parameter OpenVPN Options
use compression Enable or disable LZO packet compression
use keepalive Can be used to send a periodic keepalive packet in order to keep
the tunnel up despite of inactivity
redirect gateway By redirecting the gateway, all packets will be directed to the VPN
tunnel. Please ensure that essential services (such as DNS or NTP
servers) can be reached at the network behind the tunnel. In doubt,
create an extra static route pointing to the correct interface.
allow duplicates Allow multiple clients with the same common name to concurrently
connect.
verify certs Check peer certificate against local CRL.
negotiate DNS If enabled, the system will use the nameservers which have been
negotiated over the tunnel.
OpenVPN Expert Configuration (Client)
The expert configuration mode offers a straightforward way to configure a tunnel by simply uploading a zip package containing the required configuration and optionally key/certificate files. A
client tunnel usually consists of the following files:
Parameter Client Expert Files
client.conf OpenVPN configuration file (see http://www.openvpn.net for
available options)
ca.crt Root certificate authority file
client.crt Certificate file
client.key Private key file
client.p12 PKCS#12 file
ta.key TLS authentication key file
Please note that you may specify arbitrary file names, however, the configuration file suffix must
be .conf and all files referred in the configuration file must correspond to relative path names.
86
Page 87
NB2710 User Manual 4.0
OpenVPN Expert Configuration (Server)
A server tunnel typically requires the following files:
Parameter Server Expert Files
server.conf OpenVPN configuration file
ca.crt Root certificate authority file
server.crt Certificate file
server.key Private key file
dh1024.pem Diffie-Hellman parameters file
ccd A directory containing client-specific configuration files
Keep in mind that a certificate becomes valid once its validity time has been reached, thus an
accurate system has to be set prior to creating certificates and establishing a tunnel connection.
Please ensure that all NTP servers are reachable. Using host names also requires a working DNS
server.
87
Page 88
NB2710 User Manual 4.0
Client Management
Once you have successfully set up an OpenVPN server tunnel, you can manage and enable clients
connecting to your service. Currently connected clients can be seen on this page, including the
connect time and IP address. You may kick connected clients by disabling them.
Figure 5.30.: OpenVPN Client Management
In the Networking section you can specify a fixed tunnel endpoint address for each client. Please
note that, if you intend to use a fixed address for a particular client, you would have to apply fixed
addresses to the other ones as well.
You may specify the network behind the clients as well as the routes to be pushed to each client.
This can be useful for routing purposes, e.g. in case you want to redirect traffic for particular
networks towards the server. Routing between the clients is generally not allowed but you can
enable it if desired.
Finally, you can generate and download all expert mode files for enabled clients which can be used
to easily populate each client.
Operating in server mode with certificates, it is possible to block a specific client by revoking a
possibly stolen client certificate (see 5.8.8).
88
Page 89
NB2710 User Manual 4.0
5.6.2. IPsec
IPsec is a protocol suite for securing IP communications by authenticating and encrypting each
packet of a communication session and thus establishing a secure virtual private network.
IPsec includes various cryptographic protocols and ciphers for key exchange and data encryption
and can be seen as one of the strongest VPN technologies in terms of security. It uses the following
mechanisms:
MechanismDescription
AH Authentication Headers (AH) provide connectionless integrity and data origin authen-
tication for IP datagrams and ensure protection against replay attacks.
ESP Encapsulating Security Payloads (ESP) provide confidentiality, data-origin authentica-
tion, connectionless integrity, an anti-replay service and limited traffic-flow confidentiality.
SA Security Associations (SA) provide a secure channel and a bundle of algorithms that
provide the parameters necessary to operate the AH and/or ESP operations. The Internet Security Association Key Management Protocol (ISAKMP) provides a framework
for authenticated key exchange.
Negotating keys for encryption and authentication is generally done by the Internet Key Exchange
protocol (IKE) which consists of two phases:
Phase Description
IKE
phase 1
IKE
phase 2
IKE authenticates the peer during this phase for setting up an ISAKMP secure association. This can be carried out by either using main or aggressive mode. The main
mode approach utilizes the Diffie-Hellman key exchange and authentication is always
encrypted with the negotiated key.The aggressive mode just uses hashes of the preshared key and therefore represents a less-secure mechanism which should generally be
avoided as it is prone to dictionary attacks.
IKE finally negotiates IPSec SA parameters and keys and sets up matching IPSec SAs
in the peers which is required for AH/ESP later on.
89
Page 90
Administration
NB2710 User Manual 4.0
Figure 5.31.: IPsec Administration
This page can be used to enable/disable IPsec, you may also specify whether NAT-Traversal should
be used.
NAT-Traversal is mainly used for connections which traverse a path where a router modifies the IP
address/port of packets. It encapsulates packets in UDP and therefore requires a slight overhead
which has to be taken into account when running over small-sized MTU interfaces.
Please note that running NAT-Traversal makes IKE using UDP port 4500 rather than 500 which
has to be taken into account when setting up firewall rules.
90
Page 91
Configuration
NB2710 User Manual 4.0
Figure 5.32.: IPsec Configuration
General
For setting up the tunnel you will have to configure the following parameters first:
Parameter IPsec General Settings
Remote peer IP address or host name of the remote IPsec peer. You may specify
0.0.0.0 to act as a responder for roadwarrior clients.
DPD Status Specifies whether Dead Peer Detection (see RFC 3706) shall be
used. DPD will detect any broken IPSec connections, in particular
the ISAKMP tunnel, and refresh the corresponding SAs (Security
Associations) and SPIs (Security Payload Identifier) for a faster
re-establishment of the tunnel.
Detection cycle The delay (in seconds) between DPD keepalives that are sent for
this connection (default 30 seconds)
Failure threshold The number of unanswered DPD requests until the IPsec peer is
considered dead (the router will then try to re-establish a dead
connection automatically)
Action The action to perform if a peer disconnects. Available choices from
the drop-down menu are to clear, hold or to Restart the peer.
91
Page 92
NB2710 User Manual 4.0
IKE Authentication
NetModule routers support IKE authentication through pre-shared keys (PSK) or certificates within
a public key infrastructure. Extended Authentication (XAUTH) leverages RADIUS-like authentication and can be used to apply user level access control over IPSec.
Using PSK requires the following settings:
Parameter IPsec IKE Authentication Settings
PSK The pre-shared key used to authenticate at the peer
Local ID Type The type of identification for the local ID which can be a FQDN,
username@FQDN or IP address
Local ID The local ID value
Local ID Type The type of identification for the remote ID
Remote ID The remote ID value
When using certificates you would need to specify the operation mode. When run as PKI client
(initiator) you can create a Certificate Signing Request (CSR) in the certificates section which needs
to be submitted at your Certificate Authority and imported to the router afterwards. In PKI server
mode (concentrator), the router represents the Certificate Authority and issues the certificates for
remote peers. They are revokable.
Using XAUTH the following settings can be made:
Parameter IPsec XAUTH Settings
User name The name of the XAUTH user
User password The password of the XAUTH user
Group name The group ID
Group password The group secret
92
Page 93
NB2710 User Manual 4.0
IKE Proposal
This section can be used to configure the phase 1 settings:
Parameter IPsec IKE Proposal Settings
Negotiation mode Choose the desired negotiation mode. Preferably, main mode
should be used but aggressive mode might be applicable when
dealing with dynamic endpoint addresses.
Encryption algorithm The desired IKE encryption method (we recommend AES256)
Authentication algorithm The desired IKE authentication method (we prefer SHA1 over
MD5)
IKE Diffie-Hellman Group The IKE Diffie-Hellman Group
SA life time The lifetime of Security Associations
Perfect Forward Secrecy Specifies whether Perfect Forward Secrecy (PFS) should be used.
This feature increases security as PFS avoids penetration of the keyexchange protocol and prevents compromisation of previous keys.
Pseudo-random function PRF algorithms that can optionally be used.
IPsec Proposal
This section can be used to configure the phase 2 settings:
Parameter IPsec Proposal Settings
Encapsulation mode The desired encapsulation mode (Tunnel or Transport)
IPsec protocol The desired IPsec protocol (AH or ESP)
Encryption algorithm The desired IKE encryption method (we recommend AES256)
Authentication algorithm The desired IKE authentication method (we prefer SHA1 over
MD5)
SA life time The lifetime of Security Associations
Perfect forward secrecy
(PFS)
Force encapsulation Force UDP encapsulation for ESP packets even if no NAT situation
Specifies whether Perfect Forward Secrecy (PFS) should be used.
This feature increases security as PFS avoids penetration of the keyexchange protocol and prevents compromisation of previous keys.
is detected.
Networks
When creating Security Associations, IPsec will keep track of routed networks within the tunnel.
Packets will be only transmitted when a valid SA with matching source and destination network
93
Page 94
NB2710 User Manual 4.0
is present. Therefore, you may need to specify the networks right and left of the endpoints by
applying the following settings:
Parameter IPsec Network Settings
Local network The address of your local area network
Local netmask The netmask of your local area network
Peer network The address of the remote network behind the peer
Peer netmask The netmask of the remote network behind the peer
NAT address Optionally, you can apply NAT (masquerading) for packets coming
from a different local network. The NAT address must reside in the
network previously specified as local network.
Client Management
Once you have successfully set up an IPsec tunnel, you can manage and enable clients connecting
to your service. It is possible to generate and download expert mode files for enabled clients which
can be used to easily populate each client.
94
Page 95
NB2710 User Manual 4.0
5.6.3. PPTP
The Point-to-Point Tunneling Protocol (PPTP) is a method for implementing virtual private networks between two hosts. PPTP is easy to configure and widely deployed amongst Microsoft
Dial-up networking servers. However, due to its weak encryption algorithms, it is nowadays considered insecure but it still provides a straightforward way for establishing tunnels.
Figure 5.33.: PPTP Administration
When setting up a PPTP tunnel, you would need to choose between server or client. A client
tunnel requires the following parameters to be set:
Parameter PPTP Client Settings
Server address The address of the remote server
Username The user-name used for authentication
Password The password used for authentication
Please note that username and password are not used when setting up clients with fixed addresses.
95
Page 96
NB2710 User Manual 4.0
Figure 5.34.: PPTP Tunnel Configuration
Setting up a server requires the following settings:
Parameter PPTP Server Settings
Listen address Specifies on which IP address should be listened for incoming client
connections
Server address The server address within the tunnel
Client address range Specifies a range of IP addresses assigned to each client
96
Page 97
NB2710 User Manual 4.0
PPTP Client Management
PPTP clients for a server tunnel need to be configured here. They are made up of user-name and
password. A fixed IP address can be assigned to them which can be used to point any routes to a
dedicated tunnel.
Figure 5.35.: PPTP Client Management
97
Page 98
NB2710 User Manual 4.0
5.6.4. GRE
The Generic Routing Encapsulation (GRE) is a tunneling protocol that can encapsulate a wide
variety of network layer protocols inside virtual point-to-point links over IP. GRE is defined in RFC
1701, 1702 and 2784. It does not provide encryption nor authorization but can be used on an
address-basis on top of other VPN techniques (such as IPsec) for tunneling purposes.
The following parameters are required for setting up a tunnel:
Parameter GRE Configuration
Peer address The IP address of the remote peer
Interface The device type for this tunnel
Local tunnel address The local IP address of the tunnel
Local tunnel netmask The local subnet mask of the tunnel
Remote network The remote network address of the tunnel
Remote netmask The remote subnet mask of the tunnel
In general, the local tunnel address/netmask should not conflict with any other interface addresses.
The remote network/netmask will result in an additional route entry in order to control which
packets should be encapsulated and transferred over the tunnel.
98
Page 99
NB2710 User Manual 4.0
5.6.5. Dial-In
On this page you can configure the Dial-In server in order to establish a data connection over
GSM calls. Thus, one would generally apply a required service type of 2G-only, so that the modem
registers to GSM only. Naturally, a concurrent use of outgoing WWAN interfaces and Dial-In
connection is not possible.
Figure 5.36.: Dial-in Server Settings
The following settings can be set:
Parameter Dial-in Server Configuration
Administrative status Specifies whether incoming calls shall be answered or not
Modem Specifies the modem on which calls can come in
Address range start Start of the IP address range assigned to incoming clients
Address range size Number of addresses for client IP address range
Besides the admin account you can configure further users in the user accounts section which shall
be allowed to dial-in.
Please note that Dial-In connections are generally discouraged. As they are implemented as GSM
voice calls, they suffer from unreliability and poor bandwidth.
99
Page 100
NB2710 User Manual 4.0
5.7. SERVICES
5.7.1. SDK
NetModule routers are shipping with a Software Development Kit (SDK) which offers a simple and
fast way to implement customer-specific functions and applications. It consists of:
1. An SDK host which defines the runtime environment (a so-called sandbox), that is, controlling
access to system resources (such as memory, storage and CPU) and, by doing so, catering
for the right scalability
2. An interpreter language called arena, a light-weight scripting language optimized for embedded systems, which uses a syntax similar to ANSI-C but adds support for exceptions,
automatic memory management and runtime polymorphism on top of that
3. A NetModule-specific Application Programming Interface (API), which ships with a comprehensive set of functions for accessing hardware interfaces (e.g. digital IO ports, GPS, external
storage media, serial ports) but also for retrieving system status parameters, sending E-Mail
or SMS messages or simply just to configure the router
Anyone, reasonably experienced in the C language, will find an environment that is easy to dig in.
However, feel free to contact us via [email protected] and we will happily support
you in finding a programming solution to your specific problem.
The Language
The arena scripting language offers a broad range of POSIX functions (like printf or open) and
provides, together with tailor-made API functions, a simple platform for implementing any sort of
applications to interconnect your favourite device or service with the router.
Here comes a short example:
/* We ar e going t o eave s d r o p on t h e first se r i a l port
* a n d turn on li g h t s via a digital I /O o u t p u t por t ,
* o th er w is e we ' d have t o sen d a s h o r t m e s s a g e .
*/
f or ( a t t e m p t s = 0 ; attempts < 3; at t e m p t s + +) {
if ( nb_seria l _ r e a d ( " serial0 " ) == "Knock Kno c k !" ) {
nb_s e r i a l _ w rite ( " serial0 " , " W ho 's there ? " ) ;
if ( nb_seria l _ r e a d ( " serial0 " ) == "Santa " ) {
printf ( " Hurray ! \ n");
nb_dio_s e t (" o u t1 " , 1) ;
}
}
}
nb_sms _ s e n d (" + 12 34 5 6 78 9 " , " No p r e s e n t s this ye a r :(" )
A set of example scripts can be downloaded directly from the router, you can find a list of them in
the appendix. The manual which can be obtained from the NetModule support web page gives a
detailed introduction of the language, including a description of all available functions.
100
Loading...