NetModule NB3711 User Manual

NetModule Router NB3711

User Manual for Software Version 4.0

Manual Version 0.9 (Draft)

NetModule AG, Switzerland

August 3, 2016

NetModule Router NB3711

This manual covers all variants of the NB3711 product type.

The specifications and information regarding the products in this manual are subject to change without
notice. We would like to point out that NetModule makes no representation or warranties with respect
to the contents herein and shall not be responsible for any loss or damage caused to the user by the direct
or indirect use of this information This document may contain information about third party products
or processes. Such third party information is generally out of influence of NetModule and therefore
NetModule shall not be responsible for the correctness or legitimacy of this information. Users must
take full responsibility for their application of any products.

Copyright ©2016 NetModule AG, Switzerland All rights reserved

This document contains proprietary information of NetModule. No parts of the work described herein
may be reproduced. Reverse engineering of the hardware or software is prohibited and protected by
patent law. This material or any portion of it may not be copied in any form or by any means, stored
in a retrieval system, adopted or transmitted in any form or by any means (electronic, mechanical,
photographic, graphic, optic or otherwise), or translated in any language or computer language without
the prior written permission of NetModule.

A large amount of the source code to this product is available under licenses which are both free and
open source. Most of it is covered by the GNU General Public License which can be obtained from

www.gnu.org. The remainder of the open source software which is not under the GPL, is usually

available under one of a variety of more permissive licenses. A detailed license information for a
particular software package can be provided on request.

NetModule and NB3711 are trademarks and the logo is a service mark of NetModule AG, Switzerland.

All other products or company names mentioned herein are used for identification purposes only and
may be trademarks or registered trademarks of their respective owners. The following description of
software, hardware or process of NetModule or other third party provider may be included with your
product and will be subject to the software, hardware or other license agreements.

Contact

www.netmodule.com/support

NetModule AG Tel [phone]
Meriedweg 11 Fax [phone]
CH-3172 Niederwangen [e-mail]
Switzerland http://www.netmodule.com

2

NB3711 User Manual 4.0

Contents

1 Welcome to NetModule 4

2 Conformity 5

2.1 Safety Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2.2 Declaration of Conformity . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2.3 Waste Disposal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2.4 National Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2.5 Open Source Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3 Specifications 8

3.1 Operating Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

3.2 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.2.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.2.2 Mobile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3.2.3 WLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3.2.4 GPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.2.5 USB 2.0 Host Port . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.2.6 M12 Ethernet Connectors . . . . . . . . . . . . . . . . . . . . . . 13

3.2.7 Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3.2.8 Digital Inputs and Outputs . . . . . . . . . . . . . . . . . . . . . 15

3.2.9 Extension Connector . . . . . . . . . . . . . . . . . . . . . . . . . 16

3.3 Data Storage (Option Dx) . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4 Installation 22

4.1 Environmental Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . 22

4.2 Installation of the Router . . . . . . . . . . . . . . . . . . . . . . . . . . 22

4.3 Installation of the Mini-SIM Card . . . . . . . . . . . . . . . . . . . . . . 22

4.4 Installation of the GSM/UMTS/LTE Antenna . . . . . . . . . . . . . . . 23

4.5 Installation of the WLAN Antennas . . . . . . . . . . . . . . . . . . . . . 23

4.6 Installation of the GPS Antenna . . . . . . . . . . . . . . . . . . . . . . . 23

4.7 Installation of the Local Area Network . . . . . . . . . . . . . . . . . . . 24

4.8 Installation of the Power Supply . . . . . . . . . . . . . . . . . . . . . . . 24

3

NB3711 User Manual 4.0

5 Configuration 25

5.1 First Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

5.1.1 Initial Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

5.1.2 Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

5.2 HOME . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

5.3 INTERFACES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

5.3.1 WAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

5.3.2 Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

5.3.3 Mobile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

5.3.4 WLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

5.3.5 USB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

5.3.6 Serial Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

5.3.7 Digital I/O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

5.3.8 GNSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

5.4 ROUTING . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

5.4.1 Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

5.4.2 Extended Routing . . . . . . . . . . . . . . . . . . . . . . . . . . 67

5.4.3 Multipath Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

5.4.4 Mobile IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

5.4.5 Quality Of Service . . . . . . . . . . . . . . . . . . . . . . . . . . 73

5.4.6 Multicast . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

5.4.7 OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

5.4.8 BGP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

5.5 FIREWALL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

5.5.1 Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

5.5.2 Adress/Port Groups . . . . . . . . . . . . . . . . . . . . . . . . . 79

5.5.3 Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

5.5.4 NAPT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

5.6 VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

5.6.1 OpenVPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

5.6.2 IPsec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

5.6.3 PPTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

5.6.4 GRE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

5.6.5 Dial-In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

5.7 SERVICES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

5.7.1 SDK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

5.7.2 DHCP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

5.7.3 DNS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

5.7.4 NTP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

5.7.5 Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

5.7.6 E-Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

5.7.7 Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

4

NB3711 User Manual 4.0

5.7.8 SMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

5.7.9 SSH/Telnet Server . . . . . . . . . . . . . . . . . . . . . . . . . . 128

5.7.10 SNMP Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

5.7.11 Web Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

5.7.12 Redundancy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

5.7.13 Voice Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

5.8 SYSTEM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

5.8.1 System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

5.8.2 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

5.8.3 Software Update . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

5.8.4 Module Firmware Update . . . . . . . . . . . . . . . . . . . . . . 155

5.8.5 Software Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

5.8.6 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

5.8.7 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

5.8.8 Keys and Certificates . . . . . . . . . . . . . . . . . . . . . . . . . 163

5.8.9 Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

5.8.10 Legal Notice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

5.9 LOGOUT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

6 Command Line Interface 171

6.1 General Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

6.2 Print Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

6.3 Getting Config Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . 173

6.4 Setting Config Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . 173

6.5 Getting Status Information . . . . . . . . . . . . . . . . . . . . . . . . . . 174

6.6 Scanning Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

6.7 Sending E-Mail or SMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

6.8 Updating System Facilities . . . . . . . . . . . . . . . . . . . . . . . . . . 175

6.9 Manage keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . 176

6.10 Restarting Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

6.11 Debug System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

6.12 Resetting System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

6.13 Rebooting System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

6.14 Running Shell Commands . . . . . . . . . . . . . . . . . . . . . . . . . . 178

6.15 Working with History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

6.16 CLI-PHP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

A Appendix 185

A.1 Abbrevations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

A.2 System Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

A.3 Factory Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

A.4 SNMP VENDOR MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

5

A.5 SDK Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

List of Figures

5.1 Initial Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

5.2 Home . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

5.3 WAN Links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

5.4 WAN Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

5.5 Link Supervision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

5.6 Ethernet Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

5.7 Ethernet Link Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

5.8 VLAN Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

5.9 LAN IP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

5.10 SIMs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

5.11 WWAN Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

5.12 WLAN Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

5.13 WLAN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

5.14 WLAN IP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

5.15 USB Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

5.16 USB Device Management . . . . . . . . . . . . . . . . . . . . . . . . . . 56

5.17 Serial Port Administration . . . . . . . . . . . . . . . . . . . . . . . . . . 58

5.18 Serial Port Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

5.19 Digital I/O Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

5.20 Static Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

5.21 Extended Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

5.22 Multipath Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

5.23 Mobile IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

5.24 Firewall Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

5.25 Firewall Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

5.26 Masquerading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

5.27 Inbound NAPT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

5.28 OpenVPN Administration . . . . . . . . . . . . . . . . . . . . . . . . . . 86

5.29 OpenVPN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

5.30 OpenVPN Client Management . . . . . . . . . . . . . . . . . . . . . . . . 91

5.31 IPsec Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

5.32 IPsec Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

5.33 PPTP Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

6

5.34 PPTP Tunnel Configuration . . . . . . . . . . . . . . . . . . . . . . . . . 99

5.35 PPTP Client Management . . . . . . . . . . . . . . . . . . . . . . . . . . 100

5.36 Dial-in Server Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

5.37 SDK Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

5.38 SDK Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

5.39 DHCP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

5.40 DNS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

5.41 NTP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

5.42 Dynamic DNS Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

5.43 E-Mail Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

5.44 SMS Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

5.45 SSH and Telnet Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

5.46 SNMP Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

5.47 Web Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

5.48 VRRP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

5.49 Voice Gateway Administration . . . . . . . . . . . . . . . . . . . . . . . . 139

5.50 Voice Gateway Endpoint Configuration . . . . . . . . . . . . . . . . . . . 141

5.51 Voice Gateway Routing Configuration . . . . . . . . . . . . . . . . . . . . 144

5.52 System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

5.53 Regional settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

5.54 User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

5.55 Remote Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

5.56 Manual File Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 156

5.57 Automatic File Configuration . . . . . . . . . . . . . . . . . . . . . . . . 157

5.58 Factory Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

5.59 Log Viewer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

5.60 Tech Support File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

5.61 Keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

5.62 Certificate Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

5.63 Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

List of Tables

3.1 NB3711 Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . 9

3.2 NB3711 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.3 Mobile Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3.4 GSM-R Specification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

7

NB3711 User Manual 4.0

3.5 IEEE 802.11 Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.6 GPS Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.7 GNSS Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.8 USB 2.0 Host Port Specification . . . . . . . . . . . . . . . . . . . . . . . 13

3.9 Ethernet Port Specification . . . . . . . . . . . . . . . . . . . . . . . . . 13

3.10 Pin Assignments of Ethernet Connectors . . . . . . . . . . . . . . . . . . 13

3.11 Power Input Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3.12 Pin Assignments of Power Connector . . . . . . . . . . . . . . . . . . . . 14

3.13 Isolated Digital Outputs Specification . . . . . . . . . . . . . . . . . . . . 15

3.14 Isolated Digital Inputs Specification . . . . . . . . . . . . . . . . . . . . . 15

3.15 Pin Assignments of Digital Inputs and Outputs . . . . . . . . . . . . . . 16

3.16 Pin Assignments of Digital Inputs and Outputs . . . . . . . . . . . . . . 16

3.17 Audio Port Specification . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.18 Pin Assignments of Audio Port Signals (EP1 / EP2) . . . . . . . . . . . 17

3.19 CAN Port Specification . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.20 Pin Assignments of CAN Port Signals (EP1 / EP2) . . . . . . . . . . . . 18

3.21 IBIS Port Specification . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.22 Pin Assignments of IBIS Port Signals (EP1 / EP2) . . . . . . . . . . . . 18

3.23 Non-isolated RS-232 Port Specification . . . . . . . . . . . . . . . . . . . 19

3.24 Pin Assignments of RS-232 Port Signals (EP1 / EP2) . . . . . . . . . . . 19

3.25 Isolated RS-232 Port Specification . . . . . . . . . . . . . . . . . . . . . . 20

3.26 Pin Assignments of RS-232 Port Signals (EP1 / EP2) . . . . . . . . . . . 20

3.27 RS-485 Port Specification . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.28 Pin Assignments of RS-485 Port Signals (EP1 / EP2) . . . . . . . . . . . 21

3.29 Storage Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4.1 Operating Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

5.18 IEEE 802.11 Network Standards . . . . . . . . . . . . . . . . . . . . . . . 50

5.36 Static Route Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

5.79 SMS Control Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

5.88 SMS Number Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . 125

5.123Certificate Sections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

5.124Certificate Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

A.1 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

A.2 System Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

A.3 SDK Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208

8

1. Welcome to NetModule

Thank you for purchasing a NetModule Router. This document should give you an
introduction to the router and its features. The following chapters describe any aspects
of commissioning the device, installation procedure and provide helpful information
towards configuration and maintenance.

Please find further imformation such as sample SDK script or configuration samples in
our wiki on http://wiki.netmodule.com.

9

2. Conformity

This chapter provides general information for putting the router into operation.

2.1. Safety Instructions

NetModule routers must be used in compliance with any and all applicable national
and international laws and with any special restrictions regulating the utilization of the
communication module in prescribed applications and environments.

We would like to point out that only the original accessories, shipping with the router,
must be used in order to prevent possible injury to health or damage to appliances and
to ensure that all the relevant provisions have been complied with. Unauthorized mod-
ifications or utilization of unapproved accessories may void the warranty. The routers
must not be opened. However, it is possible to replace any pluggable SIM cards even
during operation.

All circuits connected to the interfaces of the router must comply with the requirements
of Safety Extra Low Voltage (SELV) circuits and have to be designed for indoor use only.
Interconnections must not leave the building nor penetrate the body shell of a vehicle.
Possible antenna circuits must be limited to over-voltage transient levels below 1 500 VDC
(according to IEC 60950-1, TNV-1 circuit levels) by using safety approved components.

NB3711 routers shall only be used with a certified (CE or equivalent) power supply
which must have a power limited and SELV circuit1output.

They are basically designed for indoor use. Do not expose the communication module
to extreme ambient conditions and protect the communication module against dust,
moisture and high temperature.

We remind the user of the duty to observe the restrictions concerning the utilization of
radio devices at petrol stations, in chemical facilities or in the course of blasting works
in which explosives are used. Switch off the communication module when traveling by
plane.

You need to pay increased attention when using the communication module close to
personal medical devices, such as cardiac pacemakers or hearing aids. NetModule routers
may also cause interference in the nearer distance of TV sets, radio receivers and personal
computers.

Avoid any installation of the antenna during a lightning. Always keep a distance of more

1

Note: Power supplies for routers with the Pb option (72-110 VDC) cannot be a SELV circuit, since

the voltage is greater than 60 VDC.

10

NB3711 User Manual 4.0

than 40 cm from the antenna in order to reduce exposure to electromagnetic fields below
the legal limits. This distance applies to

λ

4

- and

λ

2

-antennas. Larger distances may apply

to antennas with higher gain.
Any Ethernet cabling must be shielded, the Ethernet section of this manual provides

more information.
Devices with a WLAN interface may be operated only with applicable Regulatory Do-

main configured. Special attention must be paid to country, number of antennas and
the antenna gain (see also chapter 5.3.4). A misconfiguration will lead to loss of the
approval.

Cellular antennas attached to the router must have an antenna gain of equal or less than

2.5 dBi. If an extension cable is used to attach the antenna, the antenna gain may be
higher by the amount of cable attenuation. The user is responsible for the compliance
with the legal regulations.

We highly recommended creating a copy of a working system configuration. It can
be downloaded using the Web Manager and easily applied to a newer software release
afterwards as we generally guarantee backward compatibility.

2.2. Declaration of Conformity

NetModule hereby declares that under our own responsibility that the
routers comply with the relevant standards following the provisions of
the Council Directive 1999/5/EC. The signed version of the Declara-
tions of Conformity can be found on the NetModule web page.

2.3. Waste Disposal

In accordance with the requirements of the Council Directive
2002/96/EC regarding Waste Electrical and Electronic Equipment

(WEEE), you are urged to ensure that this product will be segregated
from other waste at end-of-life and delivered to the WEEE collection
system in your country for proper recycling.

2.4. National Restrictions

This product may be generally used in all EU countries (and other countries following the
EU directive 1999/5/EC) without any limitation. Please refer to our WLAN Regulatory
Database for getting further national radio interface regulations and requirements for a
particular country.

11

NB3711 User Manual 4.0

2.5. Open Source Software

We inform you that NetModule products may contain in part open-source software.
We are distributing such open-source software to you under the terms of GNU General
Public License (GPL)2, GNU Lesser General Public License (LGPL)3or other open-
source licenses4. These licenses allow you to run, copy, distribute, study, change and
improve any software covered by GPL, Lesser GPL, or other open-source licenses with-
out any restrictions from us or our end user license agreement on what you may do
with that software. Unless required by applicable law or agreed to in writing, software
distributed under open-source licenses is distributed on an "AS IS" basis, WITHOUT
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

To obtain the corresponding open source codes covered by these licenses, please contact
our technical support at [e-mail].

Acknowledgements

This product includes:

• PHP, freely available from http://www.php.net

• Software developed by the OpenSSL Project for use in the OpenSSL Toolkit

(http://www.openssl.org)

• Cryptographic software written by Eric Young (ea[email protected])

• Software written by Tim Hudson ([email protected])

• Software written Jean-loup Gailly and Mark Adler

• MD5 Message-Digest Algorithm by RSA Data Security, Inc.

• An implementation of the AES encryption algorithm based on code released by

Dr Brian Gladman

• Multiple-precision arithmetic code originally written by David Ireland

• Software from The FreeBSD Project (http://www.freebsd.org)

2

Please find the GPL text under http://www.gnu.org/licenses/gpl-2.0.txt

3

Please find the LGPL text under http://www.gnu.org/licenses/lgpl.txt

4

Please find the license texts of OSI licenses (ISC License, MIT License, PHP License v3.0, zlib License)

under http://opensource.org/licenses

12

3. Specifications

3.1. Operating Elements

The following table describes the NB3711 status indicators.

Label Color State Function

Status l blinking The device is busy due to startup, software or configu-

ration update.

l on The device is ready. The captions of the top bank apply.

l on The device is ready. The captions of the bottom bank

apply.

Mob1 lll

[1]

on Mobile connection 1 is up.

l blinking Mobile connection 1 is being established.

m off Mobile connection 1 is down.

Mob2 lll

[1]

on Mobile connection 2 is up.

l blinking Mobile connection 2 is being established.

m off Mobile connection 2 is down.

WLAN1 lll

[1]

on WLAN connection 1 is up.

l blinking WLAN connection 1 is being established.

m off WLAN connection 1 is down.

WLAN2 lll

[1]

on WLAN connection 2 is up.

l blinking WLAN connection 2 is being established.

m off WLAN conne ction 2 is down.

GNSS l on GNSS is turned on and a valid NMEA stream is avail-

able.

l blinking GNSS is searching for satellites.

m off GNSS is turned off or no valid NMEA stream is avail-

able.

13

NB3711 User Manual 4.0

Label Color State Function

Voice l on A voice call is currently active.

m off No voice call is active.

DO1 l on Normally open output port 1 is closed.

m off Normally open output port 1 is open.

DO2 l on Normally closed output port 2 is closed.

m off Normally closed output port 2 is open.

DI1 l on Input port 1 is set.

m off Input port 1 is not set.

DI2 l on Input port 2 is set.

m off Input port 2 is not set.

Ext1 l on Extension port 1 is on.

m off Extension port 1 is off.

Ext2 l on Extension port 2 is on.

m off Extension port 2 is off.

[1]

The color of the LED represents the signal quality for wireless links.

l red means low

l yellow means moderate

l green means good or excellent

Table 3.1.: NB3711 Status Indicators

14

NB3711 User Manual 4.0

3.2. Interfaces

3.2.1. Overview

Label Panel Function

SIM 1 Front SIM 1, it can be assigned dynamically to any modem by

configuration.

SIM 2 Front SIM 2, it can be assigned dynamically to any modem by

configuration.

SIM 3 Front SIM 3, it can be assigned dynamically to any modem by

configuration.

SIM 4 Front SIM 4, it can be assigned dynamically to any modem by

configuration.

USB Front USB 2.0 host port, can be used as USB device server or for

software/configuration updates.

Ethernet 1-5 Front Ethernet switch ports, can be used as LAN or WAN inter-

face.

Front Earth protection connector, connected to the ground of the

power supply VGND. If used, connect a yellow-green marked
cable with at least 6mm2copper area. Avoid corrosion and
protect the screws against loosening.

Power Front Power supply (galvanically isolated)

Digital I/O Front Galvanically isolated digital I/O M12 connector

Extension Front Galvanically isolated extension ports M12 connector

Mob 1 Front TNC female connectors for MIMO mobile antenna 1

Mob 2 Front TNC female connectors for MIMO mobile antenna 2

WLAN 1 Front TNC female connectors for MIMO WLAN antenna

WLAN 2 Front TNC female connectors for MIMO WLAN antenna

GNSS Front TNC female connector for GPS/GLONASS antenna

Reset Front Reset button, press at least 3 seconds for reboot and at least

10 second for a factory reset. The start of the factory reset is
confirmed by all LEDs lighting up for a second. The button
can be released then again.

Table 3.2.: NB3711 Interfaces

15

NB3711 User Manual 4.0

3.2.2. Mobile

The various variants of the NB3711support up to three multimode modules for mobile
communication.

Standard Bands

4G (LTE/FDD) B1(2100), B2(1900), B3(1800), B5(850), B7(2600),

B8(900), B20(800)

3G (DC-HSPA+/UMTS) B5(850), B8(900), B2(1900), B1(2100)

2G (EDGE/GPRS/GSM) B9(900), B3(1800), B2(1900)

Table 3.3.: Mobile Interface

The LTE modules support 2x2 MIMO.
Data rates: LTE max. 100 Mbps downlink / 50 Mbps uplink (DC-HSPA+ 42/5.76)

GSM-R (Option Gr)

Feature Specification

Frequency bands GSM-R, EGSM900, GSM1800

Mode Data only

Data rate GPRS class 10 up to 85.6 kbps (DL) and

42.8 kbps (UL)

Table 3.4.: GSM-R Specification

3.2.3. WLAN

The variants of the NB3711support 1-2 IEEE 802.11 a/b/g/n/ac WLAN modules. They
can operate either as client or access point.

Standard Frequencies Bandwidth Data Rate

802.11a 5 GHz 20 MHz 54 Mbit/s

802.11b 2.4 GHz 20 MHz 11 Mbit/s

802.11g 2.4 GHz 20 MHz 54 Mbit/s

802.11n 2.4/5 GHz 20/40 MHz 300 Mbit/s

802.11ac 5 GHz 20/40/80 MHz 866.7 Mbit/s

16

NB3711 User Manual 4.0

Standard Frequencies Bandwidth Data Rate

Table 3.5.: IEEE 802.11 Standards

Note: 802.11n and 802.11ac support 2x2 MIMO

3.2.4. GPS

Feature Specification

Systems GPS/GLONASS

Data stream JSON or NMEA

Tracking sensitivity -154 dBm

Supported antennas Active and passive

Table 3.6.: GPS Specifications

GNSS (Option Ge)

The GNSS module supports Dead Reckoning with onboard 3D accelerometer and 3D

gyroscope.

Feature Specification

Systems GPS/GLONASS/BeiDu/Galileo ready

Data stream NMEA or UBX

Tracking sensitivity -160 dBm

Channels 72

Accuracy 2m

Supported antennas Active and passive

Table 3.7.: GNSS Specifications

3.2.5. USB 2.0 Host Port

The USB 2.0 host port has the following specification:

Feature Specification

Speed Low, Full & Hi-Speed

17

NB3711 User Manual 4.0

Feature Specification

Current max. 500mA

Table 3.8.: USB 2.0 Host Port Specification

3.2.6. M12 Ethernet Connectors

Specification

The five Ethernet ports have following specification:

Feature Specification

Isolation 1500 Vrms

Speed 10/100 Mbps

Mode Half- & Full-Duplex

Crossover Automatic MDI/MDI-X

Table 3.9.: Ethernet Port Specification

Pin Assignment on M12, 4 poles, D-coded female

Pin Signal Pinning

1 Tx+

2 Rx+

3 Tx−

4 Rx−

Table 3.10.: Pin Assignments of Ethernet Connectors

18

NB3711 User Manual 4.0

3.2.7. Power Supply

The power input has the following specifications:

Feature Specification

Power supply nominal voltages 24 VDC, 36 VDC and 48 VDC

(according to EN 50155)

Voltage range 12 VDC to 60 VDC (−15% / +5%)

Max. power consumption 15 W

Galvanic isolation yes, 1500 VDC

(according to EN 50155 & EN 60950)

Power Interruption Class S2 Sustains interruptions up to 10 ms, there

are no batteries included

Connector type M12, 4 poles, A-coded male

Table 3.11.: Power Input Specifications

Pin Assignment M12, 4 poles, A-coded male

Pin Signal Pinning

1 V+ (12−60 VDC)

2 Not connected

3 VGND

4 Not connected

Table 3.12.: Pin Assignments of Power Connector

19

NB3711 User Manual 4.0

3.2.8. Digital Inputs and Outputs

Isolated Outputs

The isolated digital output ports have the following specification:

Feature Specification

Number of output ports 2

Limiting continuous current 1 A

Maximum switching voltage 60 VDC, 42 VAC ( Vrms)

Maximum switching capacity 60 W

Table 3.13.: Isolated Digital Outputs Specification

Isolated Inputs

The isolated digital input ports have the following specification:

Feature Specification

Number of inputs 2

Maximum input voltage 40 VDC

Minimum voltage for level 1

(set) 7.2 VDC

Maximum voltage for level 0

(not set) 5.0 VDC

Table 3.14.: Isolated Digital Inputs Specification

Note: A negative input voltage is not recognized.

Pin Assignment M12 8-pole A-coded female

Pin Signal Pinning

1 DI1+

2 DI1−

3 DI2+

4 DI2−

5 DO1: Dry contact relay normally open

20

NB3711 User Manual 4.0

Pin Signal Pinning

6 DO1: Dry contact relay normally open

7 DO2: Dry contact relay normally closed

8 DO2: Dry contact relay normally closed

Table 3.15.: Pin Assignments of Digital Inputs and Outputs

3.2.9. Extension Connector

Available Options

The NB3711 has an M12 extension connector with 8 pins. The 8 pins are split into two
logical ports: Pins 1 to 4 represent Extension Port 1 (EP1) and pin 5 to 8 represent
Extension Port 2 (EP2). On both EP1 and EP2 the following interfaces may be present:

• Non-isolated RS-232 (Default configuration on EP1)

• Audio (Option A)

• CAN (Option C)

• IBIS (Option I)

• Isolated RS-485 (Option Sa)

• Isolated RS-232 (Option Sb)

Pin Signal Pinning

1 EP1 - Pin 1

2 EP1 - Pin 2

3 EP1 - Pin 3

4 EP1 - Pin 4

5 EP2 - Pin 1

6 EP2 - Pin 2

7 EP2 - Pin 3

8 EP2 - Pin 4

Table 3.16.: Pin Assignments of Digital Inputs and Outputs

Audio Port Specification (Option A)

The Audio port has the following specification:

21

NB3711 User Manual 4.0

Feature Specification

Protocol Audio Line In/Out

Input impedance 44 kΩ, signal level 2 Vpp

Input bandwidth 100 Hz- 15 kHz

Input galvanic isolation functional (max. 250 VDC)

Output impedance 100 Ω, signal level 2 Vpp

Output bandwidth 300 Hz- 4 kHz

Output galvanic isolation functional (max. 250 VDC)

Table 3.17.: Audio Port Specification

EP Pins Signal

1 / 5 Input Channel +

2 / 6 Input Channel −

3 / 7 Output Channel −

4 / 8 Output Channel +

Table 3.18.: Pin Assignments of Audio Port Signals (EP1 / EP2)

CAN Port Specification (Option C)

The CAN port has the following specification:

Feature Specification

Protocol CAN V2.0B

Speed up to 1 Mbps

Galvanic isolation 1500 VDC

Internal bus termination none

Table 3.19.: CAN Port Specification

EP Pins Signal

1 / 5 GND

22

NB3711 User Manual 4.0

EP Pins Signal

2 / 6 H

3 / 7 L

4 / 8 −

Table 3.20.: Pin Assignments of CAN Port Signals (EP1 / EP2)

IBIS Port Specification (Option I)

The IBIS port has the following specification:

Feature Specification

Protocol ’IBIS Wagenbus’, according to VDV300

and VDV301

Device type ’IBIS Peripheriegerät’, according to

VDV300 and VDV301

Speed 1200 Baud

Galvanic isolation 1500 VDC

Table 3.21.: IBIS Port Specification

EP Pins Signal

1 / 5 Call Signal

2 / 6 Call GND (’Aufrufbus’)

3 / 7 Reply GND (’Antwortbus’)

4 / 8 Reply Signal

Table 3.22.: Pin Assignments of IBIS Port Signals (EP1 / EP2)

Non-isolated 3-wire RS-232 Port Specification

The non-isolated 3-wire RS-232 port has the following specification (Option S):

Feature Specification

Protocol 3-wire RS-232: GND, TXD, RXD

23

NB3711 User Manual 4.0

Feature Specification

Baud rate 300, 1 200, 2 400, 4 800, 9 600, 19 200,

38 400, 57 600, 115 200, 230 400, 460 800

Data bits 7bit, 8 bit

Parity none, odd, even

Stop bits 1, 2

Software flow control None, XON/XOFF

Hardware flow control None

Galvanic isolation None

Table 3.23.: Non-isolated RS-232 Port Specification

EP Pins Signal

1 / 5 GND

2 / 6 TxD

3 / 7 RxD

4 / 8 −

Table 3.24.: Pin Assignments of RS-232 Port Signals (EP1 / EP2)

24

NB3711 User Manual 4.0

Isolated 3-wire RS-232 Port Specification (Option Sb)

The isolated 3-wire RS-232 port has the following specification:

Feature Specification

Protocol 3-wire RS-232: GND, TXD, RXD

Baud rate 600, 1 200, 2 400, 4 800, 9 600, 19 200,

38 400, 57 600, 115 200, 230 400, 460 800,
921 600

Data bits 7bit, 8 bit

Parity none, odd, even

Stop bits 1, 2

Software flow control None, XON/XOFF

Hardware flow control None

Galvanic isolation 1500 VDC

Table 3.25.: Isolated RS-232 Port Specification

EP Pins Signal

1 / 5 GND

2 / 6 TxD

3 / 7 RxD

4 / 8 −

Table 3.26.: Pin Assignments of RS-232 Port Signals (EP1 / EP2)

RS-485 Port Specification (Option Sa)

The RS-485 port has the following specification:

Feature Specification

Protocol 3-wire RS-485 (GND, A, B)

Baud rate 600, 1 200, 2 400, 4 800, 9 600, 19 200,

38 400, 57 600, 115 200, 230 400, 460 800

Data bits 7bit, 8 bit

25

NB3711 User Manual 4.0

Feature Specification

Parity none, odd, even

Stop bits 1, 2

Software flow control None, XON/XOFF

Hardware flow control None

Galvanic isolation 1500 VDC

Internal bus termination none

Table 3.27.: RS-485 Port Specification

EP Pins Signal

1 / 5 GND

2 / 6 TxD−/RxD− (A)

3 / 7 TxD+/RxD+ (B)

4 / 8 −

Table 3.28.: Pin Assignments of RS-485 Port Signals (EP1 / EP2)

3.3. Data Storage (Option Dx)

The integrated mass storage works independently of any router functionalities and is
dedicated for customer applications such as data collection. The storage can be accessed
via the SDK. Please refer to SDK API Manual for further details, section 2.2 Media
Mount.

The following options are available:

Option Capacity

Da 32 GB Flash

Db 64 GB Flash

Table 3.29.: Storage Specifications

26

4. Installation

4.1. Environmental Conditions

The following precautions must be taken before installing a NB3711 router:

• Avoid direct solar radiation

• Protect the device from humidity, steam and aggressive fluids

• Guarantee sufficient circulation of air around the device

• The device is for indoor use only

Parameter Rating

Input Voltage 12 VDC to 48 VDC (−15% / +20%)

Operating Temperature Range −25◦C to +70◦C

Humidity 0 to 95% (non-condensing)

Altitude up to 4000m

Over-Voltage Category II

Pollution Degree 2

Ingress Protection Rating IP40 (with SIM and USB covers mounted)

Table 4.1.: Operating Conditions

Important: When using the Pb variant with an input voltage greather than
60 VDC, the router MUST be connected to an earth protection.

4.2. Installation of the Router

The NB3711 is designed for mounting it on a worktop or wall. Please consider the safety
instructions and the environmental conditions in chapter 2.

4.3. Installation of the Mini-SIM Card

Up to four Mini-SIM cards can be inserted in a NB3711 router.
SIM cards can be inserted by sliding it into one of the designated slots on the front

panel. You have to push the SIM card using a small paper clip (or similar) until it snaps

27

NB3711 User Manual 4.0

into place. To remove the SIM, you will need to push it again in the same manner. The
SIM card will then rebounce and can be pulled out.

SIMs can be assigned flexibly to any modem in the system. It is also possible to switch
a SIM to a different modem during operation, for instance if you want to use another
provider upon a certain condition. However, a SIM switch usually takes about 10-20
seconds which can be bypassed (e.g. at bootup) if SIMs are installed reasonably. Using
only a single SIM with one modem, it should be preferably placed into the SIM 1 holder.
For systems which should operate two modems with two SIMs in parallel, we recommend
to assign Mobile 1 to SIM 1 and Mobile 2 to SIM 2.

Further information about SIM configuration can be found in chapter 5.3.3.

4.4. Installation of the GSM/UMTS/LTE Antenna

NetModule routers will only operate efficiently in the cellular network if there is a good
signal. A stub antenna will be suitable for most applications. However, in some circum-
stances it might be necessary to use remote antennas together with an extended cable
to reach a better location offering an adequate signal. In doubt, please contact us and
we would be pleased to assist you in figuring out the best matching antenna setup for
your application.

Keep in mind that effects caused by Faraday cages such as large metal surfaces (elevators,
machine housings, etc.), close meshed iron constructions and others may reduce signal
reception significantly.

The antenna or antenna cable has to be mounted to the Mobile 1 connector and should
be fixed with a wrench. The antenna for the second modem (if present) should be
connected to Mobile 2.

4.5. Installation of the WLAN Antennas

Any WLAN antennas must be mounted to the connectors WLAN1 and WLAN2. The
number of attached antennas can be configured in the software. If only one antenna is
used, it must be attached to WLAN1. However, for better diversity and thus better
throughput and coverage, we highly recommend using two antennas.

4.6. Installation of the GPS Antenna

The GNSS antenna must be mounted to the connector GPS. Whether the antenna is
an active or passive GPS antenna has to be configured in the software. We recommend
active GPS antennas for highly accurate GPS tracking.

28

NB3711 User Manual 4.0

4.7. Installation of the Local Area Network

Up to five 10/100 Mbps Ethernet devices can be directly connected to the router, fur-
ther devices can be attached via an addtional Ethernet switch. Please ensure that the
connector has been plugged in properly and remains in a fixed state, you might other-
wise experience sporadical link loss during operation. The Link/Act LED will lit up as
soon as the device has synced. If not, it might be necessary to configure a different link
setting as described in chapter 5.3.2.

4.8. Installation of the Power Supply

The router can be powered with an external source supplying between 12 VDC and 48 VDC.
It is to be used with a certified (CE or equivalent) power supply, which must have a
limited and SELV circuit output. The router is now ready for getting engaged.

29

5. Configuration

The following chapters give information about setting up the router and configuring its
features as provided with system software 4.0.

5.1. First Steps

NetModule routers can be easily set up by using the HTTP-based configuration interface,
called the Web Manager. It is supported by the latest web browsers (e.g. Microsoft
Internet Explorer 11, Mozilla Firefox 28.0, Safari 7 and many others). Please ensure to
have JavaScript turned on.

Any submitted configuration via the Web Manager will be applied immediately to the
system when pressing the Apply button. When configuring subsystems which require
multiple steps (for instance WLAN) you can use the Continue button to store any
settings temporarily and apply them at a later time. Please note, that those settings
will be neglected at logout unless applied.

You may also upload configuration files via SNMP, SSH, HTTP or USB in case you
intend to deploy a larger numbers of routers. Advanced users may also use the Command
Line Interface (CLI) and set configuration parameters directly.

The IP address of Ethernet1 is 192.168.1.1 and the Dynamic Host Configuration Pro-
tocol (DHCP) is activated on the interface by default. The following steps need to be
taken to establish your first Web Manager session:

1. Connect the Ethernet port of your computer to the Ethernet1 port of the router
using a standard CAT5 cable with RJ45 (or M12) connectors.

2. If not yet activated, enable DHCP on your computer’s Ethernet interface so that
an IP address can be obtained automatically from the router. This usually takes a
short amount of time until your PC has received the corresponding parameters (IP
address, subnet mask, default gateway, name server). You may track the progress
by having a look to your network control panel and check whether your PC has
correctly retrieved an IP address of the range 192.168.1.100 to 192.168.1.199.

3. Launch your favorite web browser and point it to the IP address of the router (the
URL is http://192.168.1.1).

4. Please follow the instructions of the Web Manager for configuring the router. Most
of the menus are self-explanatory, further details are given in the following chapters.

30

NB3711 User Manual 4.0

5.1.1. Initial Access

In factory state you will be prompted for a new administrator password. Please choose
a password which is both, easy to remember but also robust against dictionary attacks
(such as one that contains numbers, letters and punctuation characters). The password
shall have a minimum length of 6 characters. It shall contain a minimum of 2 numbers
and 2 letters.

Figure 5.1.: Initial Login

Please note that the admin password will be also applied for the root user which can be
used to access the device via the serial console, telnet, SSH or to enter the bootloader.
You may also configure additional users which will only be granted to access the summary
page or retrieve status information but not to set any configuration parameters.

A set of services (USB Autorun, CLI-PHP) are by default activated in factory state
and will be disabled as soon as the admin password has been set. They can be enabled
again afterwards in the relevant sections. Other services (SSH, Telnet, Console) can be
accessed in factory state by providing an empty or no password.

31

NB3711 User Manual 4.0

5.1.2. Recovery

Following actions might be taken in case the router has been misconfigured and cannot
be reached anymore:

1. Factory Reset: You can initiate a reset back to factory settings via the Web Man-
ager, by running the command factory-reset or by pressing the reset button.
The latter would require a slim needle or paper clip which must be inserted into
the hole . The button must be hold pressed for up to 5 seconds until all LEDs
flash up.

2. Serial Console Login: It is also possible to log into the system via the serial port.
This would require a terminal emulator (such as PuTTY or HyperTerminal) and an
RS232 connection (115200 8N1) attached to the serial port of your local computer.
You will also see the kernel messages at bootup there.

3. Recovery Image: In severe cases we can provide a recovery image on demand which
can be loaded into RAM via TFTP and executed. It offers a minimal system image
for running a software update or doing other modifications. You will be provided
with two files, recovery-image and recovery-dtb, which must be placed in the root
directory of a TFTP server (connected via LAN1 and address 192.168.1.254). The
recovery image can be launched from the boot-loader using a serial connection. You
will have to stop the boot process by pressing s and enter the bootloader. You
can then issue run recovery to load the image and start the system which can be
accessed via HTTP/SSH/Telnet and its IP address 192.168.1.1 afterwards. This
procedure can be also initiated by holding the factory reset button longer than 15
seconds.

32

NB3711 User Manual 4.0

5.2. HOME

This page provides a status overview of enabled features and connections.

Figure 5.2.: Home

Summary

This page offers a short summary about the administrative and operational status of
the router’s interfaces.

WAN

This page offers details about any enabled Wide Area Network (WAN) links (such as
the IP addresses, network information, signal strength, etc.) The information about the
amount of downloaded/uploaded data is stored in non-volatile memory, thus survive a
reboot of the system.
The counters can be reset by pressing the Reset button.

WWAN

This page shows information about modems and their network status.

33

NB3711 User Manual 4.0

WLAN

The WLAN page offers details about the enabled WLAN interfaces when operating in
access-point mode. This includes the SSID, IP and MAC address and the currently used
frequency and transmit power of the interface as well as the list of associated stations.

GNSS

This page displays the position status values, such as latitude/longitude, the satellites
in view and more details about the used satellites.

Ethernet

This page shows information about the Ethernet interfaces and packet statistics infor-
mation.

LAN

This page shows information about the LAN interfaces plus the neighborhood informa-
tion.

DHCP

This page offers details about any activated DHCP service, including a list of issued
DHCP leases.

OpenVPN

This page provides information about the OpenVPN tunnel status.

IPSec

This page provides information about the IPsec tunnel status.

PPTP

This page provides information about the PPTP tunnel status.

GRE

This page provides information about the GRE tunnel status.

MobileIP

This page provides information about Mobile IP connections.

Firewall

This page offers information about any firewall rules and their matching statistics. It
can be used to debug the firewall.

QoS

This page provides information about the used QoS queues.

34

NB3711 User Manual 4.0

BGP

This page provides information about the Border Gateway Protocol.

OSPF

This page provides information about the Open Shortest Path First routing protocol.

DynDNS

This page provides information about Dynamic DNS.

System Status

The system status page displays various details of your NB3711 router, including system
details, information about mounted modules and software release information.

SDK

This section will list all webpages generated by SDK scripts.

35

NB3711 User Manual 4.0

5.3. INTERFACES

5.3.1. WAN

Link Management

Depending on your hardware model, WAN links can be made up of either Wireless
Wide Area Network (WWAN), Wireless LAN (WLAN), Ethernet or PPP over Ethernet
(PPPoE) connections. Please note that each WAN link has to be configured and enabled
in order to appear on this page.

Figure 5.3.: WAN Links

36

NB3711 User Manual 4.0

In general, a link will be only dialed or declared as up if the following prerequisites are
met:

Condition WWAN WLAN ETH PPPoE

Modem is registered X

Registered with valid service type X

Valid SIM state X

Sufficient signal strength X X

Client is associated X

Client is authenticated X

Valid DHCP address retrieved X X X X

Link is up and holds address X X X X

Ping check succeeded X X X X

The menu can be used further to prioritize your WAN links. The highest priority link
which has been established successfully will become the so-called hotlink which holds
the default route for outgoing packets.

In case a link goes down, the system will automatically switch over to the next link in
the priority list. You can configure each link to be either established when the switch
occurs or permanently in order to minimize link downtime.

Parameter WAN Link Priorities

1st priority The primary link which will be used whenever possible.

2nd priority The first fallback link, it can be enabled permanently or

being dialed as soon as Link 1 goes down.

3rd priority The second fallback link, it can be enabled permanently or

being dialed as soon as Link 2 goes down.

4th priority The third fallback link, it can be enabled permanently or

being dialed as soon as Link 3 goes down.

Links are being triggered periodically and put to sleep in case it was not possible to
establish them within a certain amount of time. Hence it might happen that permanent
links will be dialed in background and replace links with lower priority again as soon as
they got established. In case of interfering links sharing the same resources (for instance
in dual-SIM operation) you may define a switch-back interval after which an active
hotlink is forced to go down in order to let the higher-prio link getting dialed again.

37

NB3711 User Manual 4.0

We recommend to use the permanent operation mode for WAN links in general. How-
ever, in case of time-limited mobile tariffs for instance, the switchover mode might be
applicable. By using the distributed mode, it is possible to distribute outgoing traffic
over multiple WAN links based on their weight ratio.

For mobile links, it is further possible to pass through the WAN address towards a local
host (also called Drop-In or IP Pass-through). In particular, the first DHCP client will
receive the public IP address. More or less, the system acts like a modem in such case
which can be helpful in case of firewall issues. Once established, the Web Manager can
be reached over port 8080 using the WAN address but still over the LAN1 interface
using port 80.

Parameter WAN Link Operation Modes

disabled Link is disabled

permanent Link is being established permanently

on switchover Link is being established on switchover, it will be dialled if

previous links failed

distributed Link is member of a load distribution group

Parameter WAN Link Settings

Operation mode The operation mode of the link

Weight The weight ratio of a distributed link

Switch-back Specifies the switch-back condition of a switchover link and

the time after an active hotlink will be teared down

IP Pass-through Specifies whether the IP address of the WAN link should

be passed-through to the first DHCP client of the specified
LAN interface

38

NB3711 User Manual 4.0

WAN Settings

This page can be used to configure WAN specific settings like the Maximum Segment Size
(MSS). The MSS corresponds to the largest amount of data (in bytes) that the router
can handle in a single, unfragmented TCP segment. In order to avoid any negative side
effects the number of bytes in the data segment and the headers must not add up to
more than the number of bytes in the Maximum Transmission Unit (MTU). The MTU
can be configured per each interface and corresponds to the largest packet size that can
be transmitted.

Figure 5.4.: WAN Settings

Parameter TCP MSS Settings

MSS adjustment Enable or disable MSS adjustment on WAN interfaces.

Maximum segment size Maximum number of bytes in a TCP data segment.

39

NB3711 User Manual 4.0

Supervision

Network outage detection on a per-link basis can be performed by sending pings on each
link to some authoritative hosts. A link will be declared as down in case all trials have
failed and only as up if at least one host can be reached.

Figure 5.5.: Link Supervision

Parameter Supervision Settings

Link The WAN link to be monitored (can be ANY)

Mode Specifies whether the link shall only be monitored if being

up (e.g. for using a VPN tunnel) or if connectivity shall be
also validated at connection establishment (default)

Primary host The primary host to be monitored

Secondary host The secondary host to be monitored (optional)

Ping timeout The amount of time in milliseconds a response for a single

ping can take, consider to increase this value in case of slow
and tardy links (such as 2G connections)

40

NB3711 User Manual 4.0

Parameter Supervision Settings

Ping interval The interval in seconds at which pings are transmitted on

each interface

Retry interval The interval in seconds at which pings are re-transmitted in

case a first ping failed

Max. number of failed
trials

The maximum number of failed ping trials until the link will
be declared as down

Emergency action The emergency action which should be taken after a max-

imum downtime has been reached. Using reboot would
perform a reboot of the system, restart link services
will restart all link-related applications including a reset of
the modem.

41

NB3711 User Manual 4.0

5.3.2. Ethernet

ETH1 usually forms the LAN1 interface which should be used for LAN purposes. Other
interfaces can be used to connect other LAN segments or for configuring a WAN link.
The LAN10 interface will be available as soon as a pre-configured USB Ethernet device
has been plugged in.

Ethernet Port Assignment

Figure 5.6.: Ethernet Ports

This menu can be used to individually assign each Ethernet port to a LAN interface, just
in case you want to have different subnets per port or use one port as WAN interface.
You may assign multiple ports to the same interface.

42

NB3711 User Manual 4.0

Ethernet Link Settings

Figure 5.7.: Ethernet Link Settings

Link negotiation can be set for each Ethernet port individually. Most devices support
auto-negotiation which will configure the link speed automatically to comply with other
devices in the network. In case of negotiation problems, you may assign the modes
manually but it has to be ensured that all devices in the network utilize the same
settings then.

43

NB3711 User Manual 4.0

VLAN Management

NetModule routers support Virtual LAN according to IEEE 802.1Q which can be used
to create virtual interfaces on top of an Ethernet interface. The VLAN protocol inserts
an additional header to Ethernet frames carrying a VLAN Identifier (VLAN ID) which
is used for distributing the packets to the associated virtual interface. Any untagged
packets, as well as packets with an unassigned ID, will be distributed to the native
interface.

Figure 5.8.: VLAN Management

In order to form a distinctive subnet, the network interface of a remote LAN host must be
configured with the same VLAN ID as defined on the router. Further, 802.1P introduces
a priority field which influences packet scheduling in the TCP/IP stack.

The following priority levels (from lowest to highest) exist:

Parameter VLAN Priority Levels

0 Background

1 Best Effort

2 Excellent Effort

44

NB3711 User Manual 4.0

Parameter VLAN Priority Levels

3 Critical Applications

4 Video (< 100 ms latency and jitter)

5 Voice (< 10 ms latency and jitter)

6 Internetwork Control

7 Network Control

45

NB3711 User Manual 4.0

IP Settings

This page can be used to configure IP addressing for your LAN/WAN Ethernet inter-
faces. In addition to the primary IP address/subnet mask you may define an additional
IP address alias on the interface.

Please keep in mind that the DNS servers can be set globally in the DNS server config-
uration menu. But as soon as a link comes up it will use the interface-specific name-
servers (e.g. the ones being retrieved over DHCP) and update the resolver configuration
accordingly.

Figure 5.9.: LAN IP Configuration

Parameter LAN IP Settings

Mode Defines whether this interface is being used as LAN or WAN

interface

When running in LAN mode, the interface may be configured with the following settings:

Parameter LAN IP Settings

IP address The IP interface address

46

NB3711 User Manual 4.0

Parameter LAN IP Settings

Subnet mask The subnet mask for this interface

Alias IP address The alias IP interface address

Alias subnet mask The alias subnet mask for this interface

When running in WAN mode, the interface may be configured with the following settings:

Parameter WAN IP Settings

WAN mode The WAN operation mode, defines whether the interface

should run as DHCP client, statically configured or over
PPPoE.

MTU The Maximum Transmission Unit for the interface, if pro-

vided it will specify the largest size of a packet transmitted
on the interface.

When running as DHCP client, no further configuration is required because all IP-related
settings (address, subnet, gateway, DNS server) will be retrieved from a DHCP server
in the network. You may also define static values but caution has to be taken to assign
an unique IP address as it would otherwise raise IP conflicts in the network.

PPPoE is commonly used when communicating with another WAN access device (like
a DSL modem). The following settings can be applied:

Parameter PPPoE Configuration

User name PPPoE user name for authenticating at the access device

Password PPPoE password for authenticating at the access device

Service name Specifies the service name set of the access concentrator and

can be left blank unless you have multiple services on the
same physical network and need to specify the one you want
to connect to.

Access concentrator
name

The name of the concentrator (the PPPoE client will con-
nect to any access concentrator if left blank)

47

NB3711 User Manual 4.0

5.3.3. Mobile

SIMs

Figure 5.10.: SIMs

The SIM page gives an overview about the available SIM cards, their assigned modems
and the current state. Once a SIM card has been inserted, assigned to a modem and
successfully unlocked, the card should remain in state ready and the network registration
status should have turned to registered. If not, please double-check your PIN.

Please keep in mind that registering to a network usually takes some time and depends
on signal strength and possible radio interferences. You may hit the Update button
at any time in order to restart PIN unlocking and trigger another network registration
attempt.

Under some circumstances (e.g. in case the modem flaps between base stations) it
might be necessary to set a specific service type or assign a fixed operator. The list
of operators around can be obtained by initiating a network scan (may take up to 60
seconds). Further details can be retrieved by querying the modem directly, a set of
suitable commands can be provided on request.

48

NB3711 User Manual 4.0

Configuration

A SIM card is generally assigned to a default modem but might be switched, for instance
if you set up two WWAN interfaces with one modem but different SIM cards.

Close attention has to be paid when other services (such as SMS or Voice) are operating
on that modem, as a SIM switch will naturally affect their operation.

The following settings can be applied:

Parameter WWAN SIM Configuration

Default modem The default modem assigned to this SIM card

Service type The service type to be used by default with this SIM card.

Remember that the link manager might change this in case
of different settings. The default is to use automatic, in
areas with interfering base stations you can force a specific
type (e.g. 3G-only) in order to prevent any flapping between
the stations around.

PIN protection Depending on the used card, it can be necessary to unlock

the SIM with a PIN code. Please check the account details
associated with your purchased SIM and figure out whether
it is protected with a PIN.

PIN code The PIN code for unlocking the SIM card

SMS gateway The service center number for sending short messages. It is

generally retrieved automatically from your SIM card but
you may define a fix number here.

Network

This page provides information about the current network status, signal strength and
the Local Area Identifier (LAI) to which the modem has been registered. An LAI is
a globally unique number that identifies the country, network provider and Local Area
Code (LAC, group of base stations) of any given location area. It can be used to force
the modem to register to a particular mobile cell in case of competing stations.

You may further initiate a mobile network scan for getting networks in range and assign
an LAI manually.

Query

This page allows you to send Hayes AT commands to the modem. Besides the 3GPP-
conforming AT command-set further modem-specific commands can be applicable which
we can provide on demand. Some modems also support running Unstructured Supple-

49

NB3711 User Manual 4.0

mentary Service Data (USSD) requests, e.g. for querying the available balance of a
prepaid account.

50

NB3711 User Manual 4.0

WWAN Interfaces

This page can be used to manage your WWAN interfaces. The resulting link will pop
up automatically as WAN link once an interface has been added. Please refer to chap-
ter 5.3.1 for how to manage them.

The Mobile LED will be blinking during the connection establishment process and goes
on as soon as the connection is up. Refer to section 5.8.7 or consult the system log files
for troubleshooting the problem in case the connection did not come up.

Figure 5.11.: WWAN Interfaces

The following mobile settings are required:

Parameter WWAN Mobile Parameters

Modem The modem to be used for this WWAN interface

SIM The SIM card to be used for this WWAN interface

Service type The required service type

Please note that these settings supersede the general SIM based settings as soon as the
link is being dialed.

Generally, the connection settings are derived automatically as soon as the modem has

51

NB3711 User Manual 4.0

registered and the network provider has been found in our database. Otherwise, it will
be required to configure the following settings manually:

Parameter WWAN Connection Parameters

Phone number The phone number to be dialed, for 3G+ connections this

commonly refers to be *99***1#. For circuit-switched 2G
connections you can enter the fixed phone number to be
dialed in international format (e.g. +41xx).

Access point name The access point name (APN) being used

Authentication The authentication scheme being used, if required this can

be PAP or/and CHAP

Username The user-name used for authentication

Password The password used for authentication

Furtheron, you may configure the following advanced settings:

Parameter WAN Advanced Parameters

Required signal strength Sets a minimum required signal strength before the connec-

tion is dialed

Home network only Determines whether the connection should only be dialed

when registered to a home network

Negotiate DNS Specifies whether the DNS negotiation should be performed

and the retrieved name-servers should be applied to the sys-
tem

Call to ISDN Has to be enabled in case of 2G connections talking to an

ISDN modem

Header compression Enables or disables 3GPP header compression which may

improve TCP/IP performance over slow serial links. Has to
be supported by your provider.

Data compression Enables or disables 3GPP data compression which shrinks

the size of packets to improve throughput. Has to be sup-
ported by your provider.

Client address Specifies a fixed client IP address if assigned by the provider

MTU The Maximum Transmission Unit for this interface

52

NB3711 User Manual 4.0

5.3.4. WLAN

WLAN Management

In case your router is shipping with a WLAN (or Wi-Fi) module you can operate it either
as client, access point or managed mode. As a client it can create an additional
WAN link which for instance can be used as backup link. As access point, it can form
another LAN interface which can be either bridged to an Ethernet-based LAN interface
or create a self-contained IP interface which can be used for routing and to provide
services (such as DHCP/DNS/NTP) in the same way like an Ethernet LAN interface
does.

Figure 5.12.: WLAN Management

If the administrative status is set to disabled, the module will be powered off in order
to reduce the overall power consumption. Regarding antennas, we generally recommend
using two antennas for better coverage and throughput. A second antenna is definitely
mandatory if you want to achieve higher throughput rates as in 802.11n.

A WLAN client will automatically became a WAN link and can be managed as de-
scribed in chapter 5.3.1.

53

NB3711 User Manual 4.0

Configurable parameters for access-point and client mode:

Parameter WLAN Management

Regulatory Domain Select the country the Router operates in

Number of antennas Set the number of connected antennas

Antenna gain Specify the antenna gain for the connected antennas. Please

refer to the antennas datasheet for the correct gain value.

Warning

Please be aware that any inappropriate parameters can lead to an infringe-
ment of conformity regulations.

54

NB3711 User Manual 4.0

Running as access point, you can further configure the following settings:

Parameter WLAN Management

Operation type Specifies the desired IEEE 802.11 operation mode

Radio band Selects the radio band to be used for connections, depending

on your module it could be 2.4 or 5 GHz

Bandwidth Specify the channel bandwidth operation mode

Channel Specifies the channel to be used

Available operation modes are:

Standard Frequencies Bandwidth Data Rate

802.11a 5 GHz 20 MHz 54 Mbit/s

802.11b 2.4 GHz 20 MHz 11 Mbit/s

802.11g 2.4 GHz 20 MHz 54 Mbit/s

802.11n 2.4/5 GHz 20/40 MHz 300 Mbit/s

802.11ac 5 GHz 20/40/80 MHz 866.7 Mbit/s

Table 5.18.: IEEE 802.11 Network Standards

Note: NetModule Routers with 802.11n and 802.11ac support 2x2 MIMO
Prior to setting up an access point, it is always a good idea to run a network scan for

getting a list of neighboring WLAN networks and then choose the less interfering channel.
Please note that two adequate channels are required for getting good throughputs with

802.11n and a bandwidth of 40 MHz.
Running in managed mode, the access-point can be controlled over CAPWAP (RFC

5415). It establishes a layer-2 tunneling protocol to encrypt transmission of user data
from connected stations. You can configure the following settings:

Parameter WLAN Management

Primary Access Con-
troller

Specifies the primary access controller

Secondary Access Con-
troller

Specifies the secondary access controller

55

NB3711 User Manual 4.0

WLAN Configuration

Running in client mode, it is possible to connect to one ore more remote access-points.
The system will switch to the next network in the list in case one goes down and
return to the highest-prioritized network as soon as it comes back. You can perform
a WLAN network scan and pick the settings from the discovered information directly.
The authentication credentials have to be obtained by the operator of the remote access
point.

Parameter WLAN Client Configuration

SSID The network name (called SSID)

Security mode The desired security mode

WPA/WPA2 mixed
mode

WPA2 should be preferred over WPA1, running
WPA/WPA2 mixed-mode offers both.

WPA cipher The WPA cipher to be used, the default is to run both

(TKIP and CCMP)

Identity The identity used for WPA-RADIUS and WPA-EAP-TLS

Passphrase The passphrase used for authentication with WPA-PSK,

otherwise the key passphrase for WPA-EAP-TLS

Force PMF Enables Protected Management Frames

Required signal strength Required signal strength to esablish the connection

56

NB3711 User Manual 4.0

Running in access-point mode you can create up to 4 SSIDs with each running their
own network configuration. The networks can be individually bridged to a LAN interface
or operate as dedicated interface in routing-mode.

Figure 5.13.: WLAN Configuration

57

NB3711 User Manual 4.0

This section can be used to configure security-related settings.

Parameter WLAN Access-Point Configuration

SSID The network name (called SSID)

Security mode The desired security mode

WPA/WPA2 mixed
mode

WPA2 should be preferred over WPA1, running
WPA/WPA2 mixed-mode offers both.

WPA cipher The WPA cipher to be used, the default is to run both

(TKIP and CCMP)

Identity The identity used for WPA-RADIUS and WPA-EAP-TLS

Passphrase The passphrase used for authentication with WPA-PSK,

otherwise the key passphrase for WPA-EAP-TLS

Force PMF Enables Protected Management Frames

Hide SSID Hides the SSID

Isolate clients Disables client-to-client communication

Accounting Sets accounting profile

The following security modes can be configured:

Parameter WLAN Security Modes

Off SSID is disabled

None No authentication, provides an open network

WEP WEP (is nowadays discouraged)

WPA-PSK WPA-PSK (TKIP, CCMP) aka WPA-Personal/Enterprise,

provides password-based authentication

WPA-RADIUS EAP-PEAP/MSCHAPv2, can be used to authenticate

against a remote RADIUS server which can be configured
in chapter 5.8.2

WPA-TLS EAP-TLS, performs authentication using certificates which

can be configured in chapter 5.8.8

58

NB3711 User Manual 4.0

WLAN IP Settings

This section lets you configure the TCP/IP settings of your WLAN network. A client
interface can be run over DHCP or with a statically configured address and default
gateway.

Figure 5.14.: WLAN IP Configuration

The access point networks can be bridged to any LAN interface for letting WLAN clients
and Ethernet hosts operate in the same subnet. However, for multiple SSIDs we strongly
recommend to set up separated interfaces in routing-mode in order to avoid unwanted
access and traffic between the interfaces. The corresponding DHCP server for each
network can be configured in afterwards as described in chapter 5.7.2.

Parameter WLAN IP Settings

Network mode Choose whether the interface shall be operated bridged or

in routing-mode

Bridge interface If bridged, the LAN interface to which the WLAN network

should be bridged

IP address / netmask In routing-mode, the IP address and netmask for this

WLAN network

59

NB3711 User Manual 4.0

5.3.5. USB

NetModule routers ship with a standard USB host port which can be used to connect a
storage, network or serial USB device. Please contact our support in order to get a list
of supported devices.

Figure 5.15.: USB Administration

USB Administration

Parameter USB Administration

Administrative status Specifies whether devices shall be recognized

Enable hotplug Specifies whether device shall be recognized if plugged in

during runtime or only at bootup

Enable USB/IP device
server

Specifies if devices shall be exported over IP

If the USB/IP device server has been enabled you can discover the mounted USB devices
and attach them to the USB/IP server. Enabled devices can now be exported to a remote
host. You will need an additional driver on the client for which we provide Windows or

60

NB3711 User Manual 4.0

Linux drivers. Further installation instructions can be provided on demand.
Please note that some USB devices behave latency-sensitive which may raise problems

when operating over a slow IP connection. Some devices may generally not work with
the USB/IP driver. Please contact our support in case of compatibility issues.

USB Devices

This page show the currently connected devices and it can be used to enable a specific
device based on its Vendor and Product ID. Only enabled devices will be recognized by
the system and raise additional ports and interfaces.

Figure 5.16.: USB Device Management

Parameter USB Devices

Vendor ID The USB Vendor ID of the device

Product ID The USB Product ID of the device

Module The USB module and type of driver to be applied for this

device

Any ID must be specified in hexadecimal notation, wildcards are supported (e.g. AB[0-1][2-3]

61

NB3711 User Manual 4.0

or AB*) A USB network device will be referenced as LAN10.

USB Autorun

This feature can be used to automatically launch a shell script or perform a software/-
config update as soon as an USB storage stick has been plugged in. For authentication, a
file called autorun.key must exist in the root directory of a FAT16/32 formatted stick.
It can be downloaded from that page and holds the SHA256 hash key of the admin
password. The file can hold multiple hashes which will be processed line-by-line dur-
ing authentication which can be used for setting up more systems with different admin
passwords.

For new devices with an empty password the hash key

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

can be used.
The hash keys can be generated by running the command echo -n "<admin-password>"

| sha256sum on a Linux system or an Internet hash key generator (search for "sha-256
hash calculator").

Once authentication has succeeded, the system scans for other files in the root directory
which can perform the following actions:

1. For running a script: autorun.sh

2. For a configuration update: cfg-<SERIALNO>.zip (e.g. cfg-00112B000815.zip),
or if not available cfg.zip

3. For a software update: sw-update.img

62

NB3711 User Manual 4.0

5.3.6. Serial Port

This page can be used to manage your serial ports. A serial port can be used by:

Parameter Serial Port Usage

none The serial port is not used

login console The serial port is used to open a console which can be ac-

cessed with a serial terminal client from the other side. It
will provide helpful bootup and kernel messages and spawns
a login shell, so that users can login to the system.

device server The serial port will be exposed over a TCP/IP port and can

be used to implement a Serial/IP gateway.

SDK The serial port will be reserved for SDK scripts.

Figure 5.17.: Serial Port Administration

63

NB3711 User Manual 4.0

Running a device server, the following settings can be applied:

Figure 5.18.: Serial Port Settings

Parameter Serial Settings

Physical protocol Selects the desired physical protocol on the serial port

Baud rate Specifies the baud rate run on the serial port

Data bits Specifies the number of data bits contained in each frame

Parity Specifies the parity used for every frame that is transmitted

or received

Stop bits Specifies the number of stop bits used to indicate the end

of a frame

Software flow control Defines the software flow control for the serial port, XOFF

will send a stop, XON a start character to the other end to
control the rate of any incoming data

Hardware flow control You may enable RTS/CTS hardware flow control, so that

the RTS and CTS lines are used to control the flow of data

64

NB3711 User Manual 4.0

Parameter Serial Settings

Protocol on TCP/IP You may choose the IP protocols Telnet or TCP raw for the

device server

Port The TCP port for the device server

Timeout The timeout until a client is declared as disconnected

Parameter Server Settings

Protocol on IP port Selects the desired IP protocol (TCP or Telnet)

Port Specifies the TCP port on which the server will be available

Timeout The time in seconds before the port will be disconnected if

there is no activity on it. A zero value disables this function.

Allow remote control Allow remote control (ala RFC 2217) of the serial port

Show banner Show a banner when clients connect

Stop bits Specifies the number of stop bits used to indicate the end

of a frame

Allow clients from Specifies which clients are allowed to connect to the server

Please note that the device server does not provide authentication or encryption and
clients will be able connect from everywhere. Please consider to restrict access to a
limited network/host or block packets by using the firewall.

65

NB3711 User Manual 4.0

5.3.7. Digital I/O

The Digital I/O page displays the current status of the I/O ports and can be used to
turn output ports on or off.

Figure 5.19.: Digital I/O Ports

You can apply the following settings:

Parameter Digital I/O Settings

DO1 after reboot Initial status of DO1 after system has booted

DO2 after reboot Initial status of DO2 after system has booted

Besides on and off you may keep the default status as the hardware has initialized it
after power-up.

The digital inputs and outputs can also be monitored and controlled by SDK scripts.

66

NB3711 User Manual 4.0

5.3.8. GNSS

Administration

The GNSS page lets you enable or disable the GNSS modules present in the system and
can be used to configure the daemon that can be used to share access to receivers without
contention or loss of data and to respond to queries with a format that is substantially
easier to parse than the NMEA 0183 emitted directly by the GNSS device.

We are currently running the Berlios GPS daemon (version 3.15), supporting the new
JSON format. Please navigate to http://gpsd.berlios.de for getting more informa-
tion about how to connect any clients to the daemon remotely. The position values can
also be queried by the CLI and used in SDK scripts.

Parameter GNNS Module Configuration

Administrative status Enable or disable the GNSS module

Operation mode The mode of operation, either standalone or assisted (for

A-GPS)

Antenna type The type of the connected GPS antenna, either passive or

actively 3 volt powered

Accuracy The desired accuracy in meters

Fix frame interval The amount of time to wait between fix attempts

Parameter GNNS Server Configuration

Server port The TCP port on which the daemon is listening for incoming

connections

Allow clients from Specifies where clients can connect from, can be either

everywhere or from a specific network

Clients start mode Specifies how data transferal is accomplished when a client

connects. You can specify on request which typically re-
quires an R to be sent. Data will be sent instantly in case of
raw mode which will provide NMEA frames or super-raw
which includes the original data of the GPS receiver. If the
client supports the JSON format (i.e. newer libgps is used)
the json mode can be specified.

Please consider to restrict access to the server port, either by a specifying a dedicated
client network or by using a firewall rule.

67

NB3711 User Manual 4.0

Position

This pages provides further information about the satellites in view and values derived
from them:

Parameter GNSS Information

Latitude The geographic coordinate specifying the north-south posi-

tion

Longitude The geographic coordinate specifying the east-west position

Altitude The height above sea level of the current location

Satellites in view The number of satellites in view as stated in GPGSV frames

Speed The horizontal and vertical speed in meter per second as

stated in GPRMC frames

Satellites used The number of satellites used for calculating the position as

stated in GPGGA frames

Dilution of precision The dilution of precision as stated in GPGSA frames

Furtheron, each satellite also comes with the following details:

Parameter GNSS Satellite Information

PRN The PRN code of the satelitte (also referred as satellite ID)

as stated in GPGSA frames

Elevation The elevation (up-down angle between the dish pointing di-

rection) in degrees as stated in GPGSV frames

Azimuth The azimuth (rotation around the vertical axis) in degrees

as stated in GPGSV frames

SNR The SNR (Signal to Noise Ratio), often referred as signal

strength

Please note that the values are shown as calculated by the daemon, their accuracy might
be suggestive.

Supervision

Parameter GNNS Supervision

Administrative status Enable or disable GNSS supervision

68

NB3711 User Manual 4.0

Parameter GNNS Supervision

Max. downtime The period of time without valid NMEA information after

which an emergency action will be taken

Emergency action The corresponding emergency action. You can either let

just restart the server which also re-initializes GPS on the
module or also reset the module in severe cases. Please note
that this might also have effect any running WWAN/SMS
services.

69

NB3711 User Manual 4.0

5.4. ROUTING

5.4.1. Static Routes

This menu shows all routing entries of the system. They are typically formed by an
address/netmask couple (represented in IPv4 dotted decimal notation) which specify
the destination of a packet. The packets can be directed to either a gateway or an
interface or both. If interface is set to ANY, the system will choose the route interface
automatically, depending on the best matching network configured for an interface.

Figure 5.20.: Static Routing

In general, host routes precede network routes and network routes precede default routes.
Additionally, a metric can be used to determine the priority of a route, a packet will go
in the direction with the lowest metric in case a destination matches multiple routes.

Netmasks can be specified in CIDR notation (i.e. /24 expands to 255.255.255.0).

Parameter Static Route Configuration

Destination The destination address of a packet

70

NB3711 User Manual 4.0

Parameter Static Route Configuration

Netmask The subnet mask which forms, in combination with the des-

tination, the network to be addressed. A single host can be
specified by a netmask of 255.255.255.255, a default route
corresponds to 0.0.0.0.

Gateway The next hop which operates as gateway for this network

(can be omitted on peer-to-peer links)

Interface The network interface on which a packet will be transmitted

in order to reach the gateway or network behind it

Metric The routing metric of the interface (default 0), higher met-

rics have the effect of making a route less favorable

Flags (A)ctive, (P)ersistent, (H)ost Route, (N)etwork Route,

(D)efault Route

The flags obtain the following meanings:

Flag Description

A The route is considered active, it might be inactive if the interface for this

route is not yet up.

P The route is persistent, which means it is a configured route, otherwise it

corresponds to an interface route.

H The route is a host route, typically the netmask is set to 255.255.255.255.

N The route is a network route, consisting of an address and netmask which

forms the subnet to be addressed.

D The route is a default route, address and netmask are set to 0.0.0.0, thus

matching any packet.

Table 5.36.: Static Route Flags

71

NB3711 User Manual 4.0

5.4.2. Extended Routing

Extended routes can be used to perform policy-based routing, they generally precede
static routes.

Figure 5.21.: Extended Routing

In contrast to statis routes, extended routes can be made up, not only of a destination
address/netmask, but also a source address/netmask, incoming interface and the type
of service (TOS) of packets.

Parameter Extended Route Configuration

Source address The source address of a packet

Source netmask The source address of a packet

Destination address The destination address of a packet

Destination netmask The destination address of a packet

Incoming interface The interface on which the packet enters the system

Type of service The TOS value within the header of the packet

72

NB3711 User Manual 4.0

Parameter Extended Route Configuration

Route to Specifies the target interface or gateway to where the packet

should get routed to

discard if down Discard packets if the specified interface is down

73

NB3711 User Manual 4.0

5.4.3. Multipath Routes

Multipath routes will perform weighted IP-session distribution for particular subnets
across multiple interfaces.

Figure 5.22.: Multipath Routes

At least two interfaces have to be defined to establish multipath routing. Additional
interfaces can be added by pressing the plus sign.

Parameter Add Multipath Routes

Target network/net-
mask

Defines the target network for which multipath routing shall
be applied

Interface Selects the interface for one path

Weight Weight of the interface in relation to the others

NextHop Overrides the default gateway of this interface

74

NB3711 User Manual 4.0

5.4.4. Mobile IP

Mobile IP (MIP) can be used to enable seamless switching between different kinds of
WAN links (e.g. WWAN/WLAN). The mobile node hereby remains reachable via the
same IP address (home address) at any time, independently of the WAN link being
used. Effectively, any WAN link switch causes very small outages during switchover
while keeping all IP connections alive.

Moreover, NetModule routers also support NAT-Traversal for mobile nodes running
behind a firewall (performing NAT), which makes mobile nodes even there accessible
from a central office via their home address, and thus, bypassing any complicated VPN
setups.

The home agent accomplishes this by establishing a tunnel (similar to a VPN tunnel)
between itself and the mobile node. WAN link switching works by telling the home

agent that the WAN IP address (called the care-of address in MIP terms) of the
mobile node has changed. The home agent will then encapsulate packets destined to
a mobile node’s home address into a tunnel packet containing the current care-of
address of the mobile node as its destination address.

To prevent problems with firewalls and private IP addressing, the MIP implementation
always employs reverse tunneling, which means that all traffic sent by a mobile node is
relayed via the tunnel to the home agent instead of directly being conveyed to the final
destination. This fact also empowers MIP to be used as a lightweight VPN replacement
(without payload secrecy).

The MIP implementation supports RFCs 3344, 5177, 3024 and 3519. For applications
requiring vast numbers of mobile nodes, interoperability with the Cisco 2900 Series home
agent implementation has been verified. However, since NetModule routers implement
a mobile node as well as a home agent, a MIP network with up to 10 mobile nodes
can be implemented without requiring expensive third party routers.

75

NB3711 User Manual 4.0

If MIP is run as a mobile node, the following settings can be configured:

Parameter Mobile IP Configuration

Primary home agent ad-
dress

The address of the primary home agent

Secondary home agent
address

The address of the secondary home agent. The mobile node
will try to register with this home agent, if the primary home
agent is not reachable.

Home address The permanent home address of the mobile node which can

be used to reach the mobile router at any time

SPI The Security Parameter Index (SPI) identifying the security

context for the mobile IP tunnel between the mobile node
and the home agent. This is used to distinguish mobile
nodes from each other. Therefore each mobile node needs
to be assigned a unique SPI. This is a 32-bit hexadecimal
value.

Authentication type The used authentication algorithm. This can be prefix-

suffix-md5 (default for MIP) or hmac-md5.

Shared secret The shared secret used for authentication of the mobile

node at the home agent. This can be either a 128-bit hex-
adecimal value or a random length ASCII string.

Life time The lifetime of security associations in seconds

UDP encapsulation Specifies whether UDP encapsulation shall be used or not.

To allow NAT traversal, UDP encapsulation must be en-
abled.

Mobile network address Optionally specifies a subnet which should be routed to the

mobile node. This information is forwarded via Network
Mobility (NEMO) extensions to the home agent. The home
agent can then automatically add IP routes to the subnet
via the mobile node. Note that this feature is not sup-
ported by all third party home agent implementations.

Mobile network mask The network mask for the optional routed network

76

NB3711 User Manual 4.0

If MIP is run as a home agent, you will have to set up a home address and network
mask for the home agent first. Then you will need to add the configuration for all mobile
nodes which is made up of the following settings:

Figure 5.23.: Mobile IP

Parameter Mobile IP Node Configuration

SPI The Security Parameter Index (SPI) identifying the secu-

rity context for the tunnel between the mobile node and
the home agent. This is used to distinguish mobile nodes
from each other. Therefore each mobile node needs to be
assigned a unique SPI. This is a 32-bit hexadecimal value.

Authentication type The used authentication algorithm. This can be prefix-

suffix-md5 (default for mobile IP) or hmac-md5.

Shared secret The shared secret used for authentication of the mobile

node at the home agent. This can be either a 128-bit hex-
adecimal value or a random length ASCII string.

77

NB3711 User Manual 4.0

5.4.5. Quality Of Service

NetModule routers are able to prioritize and shape certain kinds of IP traffic. This is
currently limited on egress, which means that only outgoing traffic can be stipulated.

The current QoS solution is using Stochastic Fairness Queueing (SFQ) classes in com-
bination with Hierarchy Token Bucket (HTB) qdiscs. Its principle of operation can be
summarized as ceiling the max. throughput per link and shaping traffic by reflecting the
specified queue priorities. In general, the lowest priority number of a queue gets most
out of the available bandwidth.

In case of demands for other class or qdisc algorithms please contact our support team
in order to evaluate the best approach for your application.

QoS Administration

The administration page can be used to enable and disable QoS.

QoS Classification

The classification section can be used to define the WAN interfaces on which QoS should
be active.

Parameter QoS Interface Parameters

Interface The WAN interface on which QoS should be active

Bandwidth congestion The bandwidth congestion method. In case of auto the

system will try to apply limits in a best-effort way. However,
it is suggested to set fixed bandwidth limits as they also offer
a way of tuning the QoS behaviour.

Downstream bandwidth The available bandwidth for incoming traffic

Upstream bandwidth The available bandwidth for outgoing traffic

IP to ping (primary) An IP, which answers ICMP echo requests to determine the

bandwidth of the link

IP to ping (secondary) An IP, which answers ICMP echo requests to determine the

bandwidth of the link

When defining limits, you should consider bandwidth limits which are at least possible as
most shaping and queues algorithms will not work correctly if the specified limits cannot
be achieved. In particular, any WWAN interfaces operating in a mobile environment
are suffering variable bandwidths, thus rather lower values should be used.

In case an interface has been activated, the system will automatically create the following
queues:

78

NB3711 User Manual 4.0

Parameter QoS Default Queues

high A high priority queue which may hold any latency-critical

services (such as VoIP)

default A default queue which will handle all other services

low A low priority queue which may hold less-critical services

for which shaping is intended

Each queue can be configured as follows:

Parameter QoS Queue Parameters

Name The name of the QoS queue

Priority A numerical priority for the queue, lower values indicate

higher priorities

Bandwidth The maximum possible bandwidth for this queue in case

the total bandwidth of all queues exceeds the set upstream
bandwidth of "QoS Interface Parameters"

Set TOS The TOS/DiffServ value to set on matching packets

You can now configure and assign any services to each queue. The following parameters
apply:

Parameter QoS Service Parameters

Interface The QoS interface of the queue

Queue The QoS queue to which this service shall be assigned

Source Specifies a network address and netmask used to match the

source address of packets

Destination Specifies a network address and netmask used to match the

destination (target) address of packets

Protocol Specifies the protocol for packets to be matched

Source Port Specifies the source port for packets to be matched

Destination Port Specifies the destination port for packets to be matched

Type of Service Specifies the TOS/DiffServ for packets to be matched

79

NB3711 User Manual 4.0

5.4.6. Multicast

NetModule routers ship with an IGMP proxy which is able to maintain multicast groups
on a particular interface and distribute incoming multicast packets towards the down-
stream interfaces on which hosts have joined the groups.

Parameter Multicast Routing Settings

Administrative status Specifies whether multicast routing is active

Incoming interface The upstream interface on which multicast groups are joined

and on which multicast packets come in

Distribute to Specifies the downstream interfaces to which multicast pack-

ets will be forwarded

80

NB3711 User Manual 4.0

5.4.7. OSPF

The OSPF tab allows the NetModule router to be added to a network of OSPF routers.

Parameter OSPF General Settings

OSPF status Specifies whether the OSPF routing protocol is active

Redistribute connected
routes

Redistribute routes to networks which are directly con-
nected to the NetModule router

Redistribute local routes Redistribute routes from the NetModule router’s own rout-

ing table

Redistribute BGP
routes

Redistribute routes learned via the BGP routing protocol

Redistribute default
route

Redistribute the routers default route

Disable BGP when
VRRP slave

Disables the OSPF protocol when the router is set to slave
mode by the VRRP redundancy protocol

The interfaces tab is used to define OSPF specific settings for the IP interfaces of the
router. If no settings are defined for a specific interface, default settings will be used.

Parameter OSPF Interfaces

Interface The name of the interface for which settings shall be defined

Authentication The authentication protocol to be used on the interface to

authenticate OSPF packets

Key The key to be used for authentication

Key ID The ID of the key to be used for authentication (1-255)

Cost The cost for sending packets via this interface. If not spec-

ified or set to 0 OSPF defaults are used.

Passive Do not send out OSPF packets on this interface

The networks tab defines the IP networks to be handled in OSPF as well as to which
routing area they belong.

Parameter OSPF Networks

Prefix Prefix of the network

Prefix length Length of the prefix

81

NB3711 User Manual 4.0

Parameter OSPF Networks

Area Routing area to which this interface belongs (0-65535, 0

means backbone)

82

NB3711 User Manual 4.0

5.4.8. BGP

The BGP tab allows to set up peerings of the NetModule router with other Border
Gateway Protocol enabled routers.

Parameter BGP General Settings

BGP status Specifies whether the BGP routing protocol is active

AS number The number of the autonomous system to which the Net-

Module router belongs (1-4294967295)

Redistribute connected
routes

Redistribute routes to networks which are directly con-
nected to the NetModule router

Redistribute local routes Redistribute routes from the NetModule router’s own rout-

ing table

Redistribute OSPF
routes

Redistribute routes learned via the OSPF routing protocol

Disable BGP when
VRRP slave

Disables the BGP protocol when the router is set to slave
mode by the VRRP redundancy protocol

The neighbors tab is used to configure all the BGP routers to peer with.

Parameter BGP Neighbors

IP address IP address of the peer router

As number Autonomous system number of the peer router (1-

4294967295)

Password Password for authentication with the peer router. If left

blank authentication is disabled.

Multihop Allow multiple hops between this router and the peer router

instead of requiring the peer to be directly connected.

The Networks tab allows to add IP network prefixes that shall be distributed via BGP
in addition to the networks that are redistributed from other sources as defined on the
general tab.

Parameter BGP Networks

Prefix Prefix of the network to be distributed

Prefix length Length of the prefix to be distributed

83

NB3711 User Manual 4.0

5.5. FIREWALL

5.5.1. Administration

NetModule routers use Linux’s netfilter/iptables firewall framework (see http://www.

netfilter.org for more information) which supports stateful inspection, that is, grant-

ing the same permissions for inherited connections within an IP session (e.g. FTP which
builds up a control and data connection).

The administration page can be used to enable and disable firewalling. When turning it
on, a shortcut can be used to generate a predefined set of rules which allow administration
(over HTTP, HTTPS, SSH or TELNET) by default but block any other packets coming
from the WAN interface.

5.5.2. Adress/Port Groups

This menu can be used to form address or port groups which can be later used for
firewall rules in order to reduce the number of rules. If address or port groups have been
referenced, packets will match if one of the configured entities apply to the packet.

Figure 5.24.: Firewall Groups

84

NB3711 User Manual 4.0

5.5.3. Rules

In general, the firewall is set up of a range of rules which control each packet’s permis-
sion to pass the router. Please note that the rules are processed by order, that means
traversing the list from top to bottom until a matching rule is found. Packets which are
not matching any of the rules configured will be ALLOWED.

Figure 5.25.: Firewall Rules

Parameter Firewall Rule Configuration

Description A meaningful description about the purpose of this rule

Action Specifies whether the packets of this rule should be allowed

or denied

log matches Throw a syslog message if rule matches

Source The source address of matching packets, can be any or speci-

fied by address/network. Selecting on source MAC addreses
is possible as well.

85

NB3711 User Manual 4.0

Parameter Firewall Rule Configuration

Destination The destination address of matching packets, can be any,

local (addressed to the system itself) or specified by ad-
dress/network

Incoming interface The interface on which matching packets are received

Protocol The used IP protocol of matching packets (UDP, TCP or

ICMP)

Destination port(s) The destination port of matching packets, which can be

specified by a single port or a range of ports (only UD-
P/TCP).

The statistics page can be used to figure out if rules have matched any packets and
provides a convenient way to debug your firewall setup.

86

NB3711 User Manual 4.0

5.5.4. NAPT

This page can be used to configure Network Address and Port Translation (NAPT) for
packets traversing the system. NAPT hereby modifies IP addresses or/and TCP/UDP
ports in matching IP packets. By tracking those connections, it will also automatically
adjust the returning packets of an IP session.

Figure 5.26.: Masquerading

The administration page lets you specify the interfaces on which masquerading will be
performed. NAT will hereby use the address of the selected interface and choose a
random source port for outgoing connections and thus enables communication between
hosts from a private local area network towards hosts on the public network.

Parameter Masqerading Rules

Interface The outgoing interface on which connections will be mas-

queraded

Source address The source address or network from which matching packets

are masqueraded

87

NB3711 User Manual 4.0

Parameter Masqerading Rules

Source netmask The source netmask of the network from which matching

packets are masqueraded

NAPT Inbound Rules

Inbound rules can be used to modify the target section of IP packets and, for instance,
forward a service or port to an internal host. By doing so, you can expose that service
and make it available from the Internet. You may also establish 1:1 NAT mapping for
a single host using additional outbound rules.

Please note that the specified rules are processed by order, that means, traversing the
list from top to bottom until a matching rule is found. If there is no matching rule
found, the packet will pass as is.

Parameter Inbound NAPT Rules

Description A meaningful description of this rule

Incoming interface The interface from which matching packets are received

Source The source address or network from which matching packets

are received

Target address The destination address of matching packets (optional)

Protocol The used protocol of matching packets

Ports The used UDP/TCP port of matching packets

Redirect to The address to which matching packets shall be redirected

Redirect port The port to which matching packets will be redirected

NAPT Outbound Rules

Outbound rules will modify the source section of IP packets and can be used to establish
1:1 NAT mappings but also to redirect packets to a specific service.

Parameter Outbound NAPT Rules

Description A meaningful description of this rule

Outgoing interface The outgoing interface on which matching packets are leav-

ing the router

Target The target address or network to which matching packets

are destined

88

NB3711 User Manual 4.0

Parameter Outbound NAPT Rules

Source address The source address of matching packets (optional)

Protocol The used protocol of matching packets

Ports The used UDP/TCP port of matching packets

Rewrite source address The address to which the source address of matching packets

shall be rewritten

Rewrite source port The port to which the source port of matching packets shall

be rewritten

89

NB3711 User Manual 4.0

Figure 5.27.: Inbound NAPT

90

NB3711 User Manual 4.0

5.6. VPN

5.6.1. OpenVPN

OpenVPN Administration

Figure 5.28.: OpenVPN Administration

Tunnel Configuration

NetModule routers support one single server tunnel and up to four client tunnels. You
can specify tunnel parameters either in standard configuration or upload an expert mode
file which has been created in advance. Refer to chapter 5.6.1 to learn more about how
to manage clients and generate the files.

Parameter OpenVPN Configuration

Operation mode Specifies whether client or server mode should be used for

this tunnel, it further specifies if tunnel shall be configured
in a standard way or if an expert mode file shall be used.

Multipath TCP Enables OpenVPN mulipath TCP support

91

NB3711 User Manual 4.0

Figure 5.29.: OpenVPN Configuration

92

NB3711 User Manual 4.0

If the tunnel is operated in client mode, the following settings can be applied:

Parameter OpenVPN Client Configuration

Peer selection Specifies how the remote peer shall be selected, besides a

single server you may configure multiple servers which can,
in case of failures, either be selected sequently (i.e. failover)
or randomly (i.e. load balancing)

Server The address or hostname of the remote server

Port The port of the remote server (1194 by default)

The following settings can be used to configure a tunnel:

Parameter OpenVPN Configuration

Interface type The device type for this tunnel which can be either TUN

(typically used for routed connections) or TAP (required for
bridged networks)

Protocol The tunnel protocol to be used for the transport connection

Network mode Defines how the packets should be forwarded, which can be

either routed or bridged from/to a particular LAN interface.
If required, you can also specify the maximum transfer unit
for the tunnel interface.

MTU The Maximum Transmission Unit of the tunnel interface

Encryption The required cipher mechanism used for encryption

Digest The digest algorithm used for authenticating

Authentication can be done in the following ways:

Parameter OpenVPN Authentication

certificate-based Certificates and keys for authenticating the tunnel. Please

take care that the proper keys/certificates have been either
uploaded or generated (see 5.8.8).

credential-based Username and password are used for authentication.

both Verifying the tunnel uses certificates and credentials.

none Tunnel is not authenticated (discouraged)

The following further options can be applied:

93

NB3711 User Manual 4.0

Parameter OpenVPN Options

use compression Enable or disable LZO packet compression

use keepalive Can be used to send a periodic keepalive packet in order to

keep the tunnel up despite of inactivity

redirect gateway By redirecting the gateway, all packets will be directed to

the VPN tunnel. Please ensure that essential services (such
as DNS or NTP servers) can be reached at the network
behind the tunnel. In doubt, create an extra static route
pointing to the correct interface.

allow duplicates Allow multiple clients with the same common name to con-

currently connect.

verify certs Check peer certificate against local CRL.

negotiate DNS If enabled, the system will use the nameservers which have

been negotiated over the tunnel.

OpenVPN Expert Configuration (Client)

The expert configuration mode offers a straightforward way to configure a tunnel by
simply uploading a zip package containing the required configuration and optionally
key/certificate files. A client tunnel usually consists of the following files:

Parameter Client Expert Files

client.conf OpenVPN configuration file (see http://www.openvpn.net

for available options)

ca.crt Root certificate authority file

client.crt Certificate file

client.key Private key file

client.p12 PKCS#12 file

ta.key TLS authentication key file

Please note that you may specify arbitrary file names, however, the configuration file
suffix must be .conf and all files referred in the configuration file must correspond to
relative path names.

OpenVPN Expert Configuration (Server)

A server tunnel typically requires the following files:

94

NB3711 User Manual 4.0

Parameter Server Expert Files

server.conf OpenVPN configuration file

ca.crt Root certificate authority file

server.crt Certificate file

server.key Private key file

dh1024.pem Diffie-Hellman parameters file

ccd A directory containing client-specific configuration files

Keep in mind that a certificate becomes valid once its validity time has been reached,
thus an accurate system has to be set prior to creating certificates and establishing a
tunnel connection. Please ensure that all NTP servers are reachable. Using host names
also requires a working DNS server.

Client Management

Once you have successfully set up an OpenVPN server tunnel, you can manage and
enable clients connecting to your service. Currently connected clients can be seen on
this page, including the connect time and IP address. You may kick connected clients
by disabling them.

In the Networking section you can specify a fixed tunnel endpoint address for each client.
Please note that, if you intend to use a fixed address for a particular client, you would
have to apply fixed addresses to the other ones as well.

You may specify the network behind the clients as well as the routes to be pushed to each
client. This can be useful for routing purposes, e.g. in case you want to redirect traffic
for particular networks towards the server. Routing between the clients is generally not
allowed but you can enable it if desired.

Finally, you can generate and download all expert mode files for enabled clients which
can be used to easily populate each client.

Operating in server mode with certificates, it is possible to block a specific client by
revoking a possibly stolen client certificate (see 5.8.8);

95

NB3711 User Manual 4.0

Figure 5.30.: OpenVPN Client Management

96

NB3711 User Manual 4.0

5.6.2. IPsec

IPsec is a protocol suite for securing IP communications by authenticating and encrypt-
ing each packet of a communication session and thus establishing a secure virtual private
network.

IPsec includes various cryptographic protocols and ciphers for key exchange and data
encryption and can be seen as one of the strongest VPN technologies in terms of security.
It uses the following mechanisms:

MechanismDescription

AH Authentication Headers (AH) provide connectionless integrity and data origin

authentication for IP datagrams and ensure protection against replay attacks.

ESP Encapsulating Security Payloads (ESP) provide confidentiality, data-origin

authentication, connectionless integrity, an anti-replay service and limited
traffic-flow confidentiality.

SA Security Associations (SA) provide a secure channel and a bundle of algo-

rithms that provide the parameters necessary to operate the AH and/or ESP
operations. The Internet Security Association Key Management Protocol
(ISAKMP) provides a framework for authenticated key exchange.

Negotating keys for encryption and authentication is generally done by the Internet Key
Exchange protocol (IKE) which consists of two phases:

Phase Description

IKE
phase
1

IKE authenticates the peer during this phase for setting up an ISAKMP se-
cure association. This can be carried out by either using main or aggressive
mode. The main mode approach utilizes the Diffie-Hellman key exchange and
authentication is always encrypted with the negotiated key.The aggressive
mode just uses hashes of the pre-shared key and therefore represents a less-
secure mechanism which should generally be avoided as it is prone to dictio-
nary attacks.

IKE
phase
2

IKE finally negotiates IPSec SA parameters and keys and sets up matching
IPSec SAs in the peers which is required for AH/ESP later on.

Administration

This page can be used to enable/disable IPsec, you may also specify whether NAT-
Traversal should be used.

NAT-Traversal is mainly used for connections which traverse a path where a router

97

NB3711 User Manual 4.0

Figure 5.31.: IPsec Administration

98

NB3711 User Manual 4.0

modifies the IP address/port of packets. It encapsulates packets in UDP and therefore
requires a slight overhead which has to be taken into account when running over small-
sized MTU interfaces.

Please note that running NAT-Traversal makes IKE using UDP port 4500 rather than
500 which has to be taken into account when setting up firewall rules.

Configuration

Figure 5.32.: IPsec Configuration

General

For setting up the tunnel you will have to configure the following parameters first:

Parameter IPsec General Settings

Remote peer IP address or host name of the remote IPsec peer. You may

specify 0.0.0.0 to act as a responder for roadwarrior clients.

99

NB3711 User Manual 4.0

Parameter IPsec General Settings

DPD Status Specifies whether Dead Peer Detection (see RFC 3706) shall

be used. DPD will detect any broken IPSec connections, in
particular the ISAKMP tunnel, and refresh the correspond-
ing SAs (Security Associations) and SPIs (Security Payload
Identifier) for a faster re-establishment of the tunnel.

Detection cycle The delay (in seconds) between DPD keepalives that are

sent for this connection (default 30 seconds)

Failure threshold The number of unanswered DPD requests until the IPsec

peer is considered dead (the router will then try to re-
establish a dead connection automatically)

Action The action to perform if a peer disconnects. Available

choices from the drop-down menu are to clear, hold or to
Restart the peer.

IKE Authentication

NetModule routers support IKE authentication through pre-shared keys (PSK) or certifi-
cates within a public key infrastructure. Extended Authentication (XAUTH) leverages
RADIUS-like authentication and can be used to apply user level access control over
IPSec.

Using PSK requires the following settings:

Parameter IPsec IKE Authentication Settings

PSK The pre-shared key used to authenticate at the peer

Local ID Type The type of identification for the local ID which can be a

FQDN, username@FQDN or IP address

Local ID The local ID value

Local ID Type The type of identification for the remote ID

Remote ID The remote ID value

When using certificates you would need to specify the operation mode. When run as PKI
client (initiator) you can create a Certificate Signing Request (CSR) in the certificates
section which needs to be submitted at your Certificate Authority and imported to
the router afterwards. In PKI server mode (concentrator), the router represents the
Certificate Authority and issues the certificates for remote peers. They are revokable.

Using XAUTH the following settings can be made:

100