RACOM M!DGE3, Руководство пользователя

Страница: 109 / 183

Note
Informational note.
7.3.3.3. Cooperation with other services
• MASQUERADE rule for Cellular connection has lower priority that user NAT (it is tested after the
NAT), thus it is possible to create exceptions in NAT settings.
• By using DNAT it is possible to intercept a passing connection and redirect it into the RipEX (similar
to a proxy behavior).
• For redirection
○ Local IP address will be filled into “ Rewrite destination IP ” parameter.
○ Service port, to which is the local address being redirected will be filled into “ Rewrite destination
port ” parameter.
NAT and IPsec
• DNAT can be used before packing a packet into the IPsec.
• SNAT works on packets unpacked from IPsec.
• SNAT can be used before packing a packet into the IPsec (parameter “ Output interface ” must be
set to “All”)
• Rules of SNAT and MASQUERADE (from Cellular) changes packets addresses before capturing by
IPsec traffic selector.
7.4. VPN
VPN (Virtual Private Network) extends a private network across a public network, and enables users
to send and receive data across shared or public networks as if their computing devices were directly
connected to the private network. Applications running across the VPN may therefore benefit from the
functionality, security, and management of the private network.
7.4.1. IPsec
Internet Protocol Security (IPsec) is a network protocol suite that authenticates and encrypts the
packets of data sent over a network. IPsec includes protocols for establishing mutual authentication
between agents at the beginning of the session and negotiation of cryptographic keys for use during
the session. IPsec uses cryptographic security services to protect communications over Internet Protocol
(IP) networks. IPsec supports network-level peer authentication, data-origin authentication, data integrity,
data confidentiality (encryption), and replay protection. IPsec is an end-to-end security scheme operating
within the Internet Layer of the Internet Protocol Suite. IPsec is recognized as a secure, standardized
and well-proven solution by the professional public.
Although there are 2 modes of operation, M!DGE3 only offers a Tunnel mode. In Tunnel mode, the
entire IP packet is encrypted and authenticated. It is then encapsulated into a new IP packet (ESP –
Encapsulating Security Payloads) with a new IP header.
Symmetrical cryptography is used to encrypt the packets. The symmetric keys must be safely delivered
to the peer. In order to maintain a secure connection, symmetric keys must be regularly exchanged.
109 © RACOM s.r.o. – M!DGE3 Cellular Router
Settings