eurogard ServiceRouter compact

Transcription

1 eurogard ServiceRouter compact Manual Falk Schönfeld Mario Cappello

2 eurogard ServiceRouter compact: Manual by Falk Schönfeld and Mario Cappello Copyright 2019 eurogard GmbH

3 Table of Contents 1. System description Overview Standard application, Router at plant is VPN-Server Client network with central ServiceServer Functional overview and concept Access routes Alarm management USB tunnel Preconditions in the target network (End customer LAN) Commissioning and operation Hardware installation, technical specification Connection and control elements Voltage supply Reset button Set up button VPN switch Status LED Error LED Network LED (3G) Network connection at the front of the device WAN connector LAN connectors USB connector Establishing first contact Operating concept Installation - quick set up guide Preparation of the ServiceRouter compact Connection to the Internet Time Router as VPN-Server Router as VPN Client Configuration options of the ServiceRouter compact Administration area Basic settings/lan Host name Domain name IP address of the Router in the LAN network Netmask DHCP Server for the LAN DHCP area HTTPS port of the web interface Web access/wan WAN media Ethernet Ethernet - DHCP/dynamic Ethernet - static DSL - DHCP MTU WiFi Connection configuration ESSID Encryption Pass phrase MTU UMTS iii

4 eurogard ServiceRouter compact APN PIN User name and password WAN Fallback Configuration Deactivated Switching Multi-WAN Time Time source Time zone Device is NTP Server NTP Server chart ddns Certificates Field contents Validity period in days Issue certificates for WAN-IP as well Issue certificates for LAN-IP as well Generate Server certificates Import root certificates Internet Explorer Show Server certificates OpenVPN OpenVPN mode OpenVPN client Checklist Router as OpenVPN client HTTP-Proxy-Server OpenVPN Server DHCP range for VPN clients VPN Transport protocol Port Enable client-to-client connections Limit VPN packet size Interval for keep-alive-packets in seconds VPN restart after how many unsuccessful pings Crypto algorithm Translate VPN network Accounts Refresh status Add new account New user certificate Download Change password Delete account WLAN (only with WLAN option) WLAN interface Operating mode Radio band ESSID Country Encryption Passphrase Firewall Port 22 - ssh Port https Allow LAN devices access to WAN Parameterized firewall rules for incoming connections Routing... iv

5 eurogard ServiceRouter compact 13. Ports Messaging ing address Server/Port Username/Password Transport encryption Allow certificates of unknown origin address of recipient Test configuration SMS-Gateway Reports Devices Host configuration Fault messenger Configure message trigger RS S7 Interface Modbus RTU/TCP Gateway USB-Tunnel WAN-Switch Configure trigger MBus TCP Gateway Reboot Ping Time emitter Status-Logs Network IP addresses Network interfaces DHCP VPN-Status UMTS-Status Logs Firewall ddns Diagnosis Routing Backup maintenance Backup Restore point Update Reset Configuration Service Maintenance access Declaration of Conformity Disclaimer General Safety instructions Proper use, installation and assembly... v

6 List of Examples 3.1. Host and Domain name URL in case of HTTPS on changed port vi

7 Chapter 1. System description 1. Overview The demand for secure Internet access solutions for remote service and operation of PLC-based systems has been continuously growing over the past years. Compared to the standard operating and monitoring solutions, Ethernet-ready controllers and web-based user interfaces have the advantage of global accessibility. In order to make full use of the potential of these possibilities, an easy-to-handle and secure Internet access is required. eurogard GmbH now presents the latest generation of their solution for Internet-based TeleService. Our combined TeleService know-how since 1995 has been incorporated into this professional Internet-based solution for industrial use which is optimally adapted for PLC networks, and at the same time extends the functionality range. The ServiceRouter compact is a complete solution for remote service of automation networks via a fast Internet connection. Wired communication with DSL, or via UMTS-HSDPA with a wireless interface bandwidth of up to 21 Mbit/s. The ServiceRouter compact can act as VPN-Server as well as VPN-Client. This allows for easy implementation of different network structures. For the operation of larger service networks eurogard offers different portal servers. These solutions offer sufficient bandwidth for up to 1000 VPN channels and form the basis for customised projects with special requirements, e.g. regarding specific access strategies of individual users to clients or IP ranges in the service network. 2. Standard application, Router at plant is VPN-Server While in earlier modem times point-to-point connections were set up by dialing a telephone number, in this application the Internet-based TeleService connection is established via VPN software client on the user's PC. The ServiceRouter at the remote plant is VPN server. This requires the Router to be integrated into the (end customer) target network and to be accessible at least through port forwarding of the VPN port. If the target network only has a dynamic IP, a service such as DynDNS is required to update the current IP. The free software EurogardSRConnect establishes the connection to the VPN server. In addition, your certificates are managed and the access times for subsequent invoicing are saved. Continuous communication between individual systems is not possible in this scenario. 1

8 System description Summary Easy and secure point-to-point VPN connections to all plants The ServiceRouter is integrated into the plant network via port forwarding or has its own DSL modem. Wireless (UMTS/HSDPA) access is only possible on the user side, but not on the plant side (except when using an "expensive" M2M SIM card with open inbound ports) The eurogard VPN-Client Software "EurogardSRConnect" makes the connection setup clear and straightforward 3. Client network with central ServiceServer Distributed plants are equipped with ServiceRouters in client mode. The ServiceRouter sets up a VPN connection to an identified ServiceServer, monitors the connection and forms a service network with other clients. This requires a ServiceServer as a central server. This kind of network allows for cross communication between the remote plants. Furthermore, plants may be connected via wireless UMTS/ HSDPA, high-priced M2M SIM cards are no longer required. 2

9 System description Since mobile communication networks are normally blocked from the Internet through firewalls, the individual plant routers have to be interconnected as clients on a server outside of the mobile communication network. Together with the Server they constitute a combined and closed network in which they can communicate and can be reached by a chosen application in the service network (data base, programming device). When using a ServiceServer, plants are organised in different and separated customer networks. A combined Admin network may be implemented. For further information please contact us. Summary Very easy integration of the Routers as clients in the target network No port forwarding, only an IP with Internet access is required Wireless connection to plants via UMTS offers sufficient bandwidth - uncomplicated and for world-wide use Reasonably-priced start with ServiceServer as central VPN server Complex structures may be implemented at any point in time through the portal server MAGNUM 4. Functional overview and concept The following overview screen shows the structure of the firmware. 5. Access routes On the WAN side the Router exclusively accepts VPN or SSL encrypted data. The firewall is blocked for all other ports; this can not be unblocked. Please contact the manufacturer directly for customer specific adjustments. 3

10 System description WLAN access in position Access Point allows for direct local communication with the PLC network, in order to enable mobile use of programming devices during commissioning or use of WLAN operating units. 6. Alarm management The alarm messaging function sends configurable messages via and/or Web-SMS. Changes of status are detected by preconfigured trigger bits via the data connection to the target unit; the corresponding message is immediately transmitted. The use of Web-SMS also allows for Routers without SIM card to send text messages to mobile phones. 7. USB tunnel USB devices may be connected to the USB port of the Router for remote use. In this case, the USB port is forwarded to the remote PC and may be used in the same way as a local device. Possible applications are USB cameras, programming adapters or storage devices. 8. Preconditions in the target network (End customer LAN) Operation as Server in the target network The ServiceRouter has to be integrated through forwarding of the ports described below. Furthermore it has to be accessible through updating of its IP via DynDNS. All ports described may be configured UDP 1194 For tunneled connection to the PLC network (VPN) TCP 443 For access to the configuration interface (SSL) Only temporarily: TCP 22 for emergency support through manufacturer eurogard. The ports 443 and 22 in the Router may be blocked after initial start-up and no longer have to be forwarded. Since, as a standard, the public IP of our customers is dynamic, the public IP of the ServiceRouter is dynamic, as well. For external access to the ServiceRouter, the local IP has to be updated via the DynDNS Internet service. In order to do this, outward communication of the Router to port 80 is required. The Router requires access to an NTP server in order to update its system time. In case no internal NTP is available, port 123 outgoing has to be enabled in order to access an Internet NTP. The battery-buffered real-time clock of the ServiceRouter bridges offline times and ensures continuous accessibility of the Router. Operation as client in the target network If the ServiceRouter is operated as client in the target network, port forwarding does not apply along with many a discussion with local IP administrators. The ServiceRouter only requires an IP in the network and access to the Internet, just as with any other PC in this network. Access to an NTP-Server is required. DynDNS is only required once at the central server. 4

11 Chapter 2. Commissioning and operation 1. Hardware installation, technical specification The Router is designed for installation, e.g. in a switch cabinet, for DIN-rail mounting. It requires a slot with the following dimensions: Height = 98mm, Width = 52mm, Depth = 90mm Technical data Voltage supply VDC Power consumption appox. 4W Ambient temperature C Humidity 0.95% rel. humidity, non condensing Design DIN-rail Dimensions (H x W x D) 98 x 52 x 90 mm Mobile communication GSM/GPRS/EDGE 850/900/1800/1900 MHz UMTS/HSPA+ 800/850,900,AWS1700,1900,2100 MHz Upload max. 5,76 Mbit/s Download max. 21 Mbit/s GPS in preparation Network VPN OpenVPN-Server, OpenVPN-Client WAN/LAN 2 x RJ 45 10/100 Mbit/s, full and half duplex WLAN b/g/n, Access-Point, WAN-Client Security VPN Certificate administration, exclusively encrypted data traffic, flip switch VPN ON/OFF Additional functions USB USB 2.0 for tunneling of USB devices, one-click configuration for ServiceServer via USB stick Message function Reports via , alarm messaging via and SMS (ISO-on-TCP, Modbus TCP) Fallback Internet access of 3G to WLAN or WAN, definition of two OpenVPN Servers Miscellaneous Buffered real-time clock, watchdog, firmware updates, dyndns 1.1. Connection and control elements The supply terminal, the reset button, the set up button as well various LEDs indicating errors and operating conditions are located at the front of the device. 5

12 Commissioning and operation Voltage supply Supply voltage is 18-30VDC/4-10W. The Power-LED indicates sufficient supply Reset button After pressing the reset button for at least 5 seconds, the reset procedure is initiated when the button is released. This is indicated by fast flashing of the LEDs. The device restarts twice after a few seconds. After approximately one minute, the device is back in default status. If the reset button is pressed for less than 5 seconds, the device simply reboots. The reset function is available 15 seconds after power-up of the Server, indicated by flashing of the Error LED Set up button After pressing the Set/WLAN button for at least 5 seconds, the restore procedure is initiated when the button is released. Providing a restore point on the Router has previously been generated or has been uploaded via the web interface, the status is restored during this procedure. This is indicated by fast flashing of the LEDs. The device reboots after a few seconds. The device is set back to the last secured status after approximately one minute. With Routers with WLAN option, the WLAN may be switched on or off via the Set/WLAN button. Press the set up button for a maximum of 2 seconds. If the button is pressed for more than 2 seconds, the restore function may be triggered unintentionally VPN switch The VPN switch is the last resort to switch the configured VPN function on or off. This guarantees full control of the remote access to the plant at any time for the end customer. 6

13 Commissioning and operation Status LED The Status LED indicates the status of the VPN connection. If the device is parameterised as VPN client or VPN server, the status LED starts flashing. As soon as a VPN tunnel has been set up, the LED switches from flashing to a continuous light. Precondition for the described process is the on setting of the VPN switch Error LED The Error LED indicates errors and operating status messages. After start up of the device, the device requires approximately 15 seconds in order to initialise the hardware and the operating system. Subsequently, the LED starts flashing at one second intervals and the Router starts setting up its configuration. When this process is terminated, the LED switches off and the Router is in operating mode; should this not be the case, an error has occurred during installation of the stored configuration. If a reset is triggered or a restore point is loaded, the LED flashes rapidly for a short period of time and the device will restart. After re-initialisation, the Router carries out a new configuration which is also indicated by fast flashing of the LED. Subsequently, the system is restarted again Network LED (3G) The N-LED indicates the status of the UMTS modem as well as the connection status to the mobile network. The LED flashes when the UMTS modem is configured and switched on. As soon as the device has logged into the mobile network, the LED lights permanently Network connection at the front of the device Two RJ-45 Ethernet connections are located at the front of the device WAN connector Connect the WAN socket to a web-enabled network or to a DSL modem. Any Internet traffic has to be handled via this socket. If the WAN access is configured via the mobile network or the WLAN, this socket is bridged to the LAN and may be used as additional connection for local devices LAN connectors All terminal devices from the local network for remote access are connected to the LAN socket of the device either directly or via external switch USB connector USB devices such as webcams, programming cables or storage units may be connected here and can then be remotely accessed. An external USB hub allows for connection of several devices. 2. Establishing first contact All administrative interactions with the ServiceRouter compact are carried out via the web interface. In order to access this interface, the LAN-IP of the ServiceRouter compact has to be accessible for your PC. As a standard, connect the LAN interface of the ServiceRouter compact directly to your PC via switch or patch cable. If not configured beforehand, set your PC to obtain an IP address automatically via DHCP. Enter the URL in your browser in order to access the web interface of the ServiceRouter compact. In case an error messages appears, check the network settings of your PC and, where necessary, deactivate the use of a proxy server through your browser. 7

14 Commissioning and operation Local settings. Allow the Router to assign an IP address. Click Adminlogin (top right) in order to change to the administration area and enter 'eurogard' (default) as user name and password. Go through the configuration menu in the order described below. Please change the password (under Admin accounts) at a later point in time! The following parameters are set as default on initial power-up: WAN / Internet: Connection Ethernet, DHCP-Client, waiting for IP from the customer network. LAN: DHCP-Server on: As soon as you connect a PC to the LAN side via Ethernet, the Router attempts to allocate an IP to this PC via DHCP protocol. DynDNS: no connection allocated WLAN: deactivated Accounts: the device is delivered with the following Administrator / User accounts: Admin: User: eurogard Password: eurogard Settings: Name: Servicerouter Domain: dyndns.org Language: German VPN: No certificates generated, either for the Router or for the user. 3. Operating concept Since the eurogard ServiceRouter compact is a network component, the entire interaction with the user is carried out via a web frontend in the browser. Operation using a monitor, keyboard and mouse is not supported. The link on the upper right hand side of the screen ("Adminlogin") allows for log in to an administrative account. For default values, please see chapter Section 2, Establishing first contact. The user interface has a main menu on the left hand side and, depending on the menu item chosen, a corresponding sub-menu. 8

15 Commissioning and operation Some of the menu items only display information, some allow for changing the settings. Menu items allowing changes to settings often have a Save button. Only after pressing the Save button will specified data be submitted. Some of the tables apply direct changes and the Save button need not be pressed. Additionally, some events require confirmation after a safety query. This manual can also be found in the device in browser form. The help link in the submenu bar connects to the relevant chapter of this context-sensitive manual. In this process, the browser opens a new window or a new tab. Where no help pages are displayed after clicking the help link, please check to see if a new tab has appeared in the background or if you have received notification from a popup blocker. 4. Installation - quick set up guide This chapter guides you through the configuration. Only the basic operational parameters are set here. For a more detailed and exhaustive explanation of all menu items, please see chapter Section 2, Establishing first contact. Call up the web interface of the ServiceRouter compact. Before proceeding, log on to the ServiceRouter as Admin. Please click the link Adminlogin in the upper right hand corner to do so. 9

16 Commissioning and operation Enter eurogard both as user name and password. After successful login the Login-Link changes to the Logout-Link, stating the name of the current user, in this case "eurogard". You are now logged in as administrator on the eurogard ServiceRouter compact. Go through the various subsections in sequence Preparation of the ServiceRouter compact Open the main menu item "Router Configuration" and the submenu item"basic Settings/LAN". 10

17 Commissioning and operation Settings which should be altered in all cases are the host and domain names. These names will reappear in the certificates which have to be generated as one of the next steps in case the Router is to be configured as VPN Server. On the LAN side the ServiceRouter has been set to IP Please change this address to a valid IP from the address range of your service network, e.g for the network in the menu item IP address in plant network. Where the IP has been changed, and after pressing the Save button, the device can be accessed via its new IP. Please adjust the network settings of your PC accordingly. In the above example, the Router can now be accessed via the address If your computer is configured for address allocation via DHCP, briefly disconnect the network cable or enter the following line at the command prompt: ipconfig /renew Your computer should receive a new IP from the device and display a similar text: Microsoft Windows [Version ] 11

18 Commissioning and operation Copyright (c) 2009 Microsoft Corporation. Alle Rechte vorbehalten. C:\Users\klaus>ipconfig /renew Windows-IP-Konfiguration Ethernet-Adapter LAN-Verbindung: Verbindungsspezifisches DNS-Suffix: Verbindungslokale IPv6-Adresse. : IPv4-Adresse : Subnetzmaske : Standardgateway : example.com fe80::cd46:3019:dbd7:c9f Adjust the entry in the address bar of your browser to the newly configured IP of the Router Connection to the Internet You can set your preferred access to the Internet under the menu item "Router Configuration"# Network access/wan. You can choose between Ethernet via DHCP or static IP, as well as PPPoE (DSL), WiFi client or UMTS. Select your way of access and test the functionality. Go to Status-Logs Diagnosis. You should be able to ping an Internet host such as, for example, google.com. This is precondition for the following installation steps. Try restarting if the device is unable to access the Internet in spite of correct settings. Please refer to Backup Maintenance Service Time For safe and stable VPN operation between eurogard ServiceRouter compact and Client-PCs or ServiceServers, all subscribers require a synchronised time base. As default, the Router synchronises the correct time via Internet via NTP. The correct time zone for Germany is pre-set. 12

19 Commissioning and operation The correct time of the Server can be viewed in the upper right-hand corner, below the Adminlogin link. The time displayed is the time of the website access, not the current time. If the clock has not been set, the time indicated flashes in red Router as VPN-Server Certificates. As previously stated, all VPN clients require a certificate. The contents of the certificate are determined by particular specifications. In order to keep the operation of the device as simple as possible, most entries are set automatically. Only very few remain to be set by you. Since a certificate is a kind of digital passport, it should include 'personal' data of the owner. Call up Router Configuration Certificates. Enter the relevant data for your company. The pre-entered data in the text fields serves as example. Enter your Internet country code (ISO ), for example DE for Germany or AT for Austria. Confirm your settings by pressing the button save in the bottom right corner of your screen. 13

20 Commissioning and operation Caution After expiry of the validity period, access to the VPN network with the expired certificate is no longer possible. Set up a reminder in due time in order to create and use new certificates. Initiate the generation of the certificates for the ServiceRouter compact by clicking generate new certificates. Since this utilises random values, the duration of this process may vary from time to time. Please be patient as this may take several minutes. OpenVPN. press save. Call up the menu item Router Configuration OpenVPN. Set the select field to Server and Your Router is now ready for operation as VPN Server. Under the menu items Router Configuration Accounts you can now set up a VPN client account. 14

21 Commissioning and operation 4.5. Router as VPN Client Certificates. As previously mentioned, all VPN participants require a certificate. If the Router is configured as VPN-Client, a certificate is required for the Server the Router is to connect to. OpenVPN. Call up the menu item Router Configuration OpenVPN. Set the select field to Client and go to Browse. Select the tar file generated by the Server. Terminate the process by pressing the Save button. The Router should now be connected to the Server. This is indicated by the continuous light of the status LED. Caution Please note that the network settings for the LAN side have to correspond to the service network settings on the Server. If, for example, the service network has been parameterised, the Router has to obtain a fixed and unique address from this network. 15

22 Chapter 3. Configuration options of the ServiceRouter compact This chapter describes the configuration of the Router in detail. In order to quickly put the Router into operational state, as is sufficient for most applications, please refer to chapter Chapter 2, Commissioning and operation. The structure of this chapter follows the main menu of the Router Configuration. The following chapter describes all configuration options for all sub menus. 1. Administration area In order to change the configuration or the operating parameters of the ServiceRouter compact, it is necessary to login to your admin account on the Server. Click the Adminlogin-link in the upper right-hand corner. 16

23 Configuration options of the ServiceRouter compact For the initial start-up or reconfiguration after a reset, please use username/password eurogard. After successful login, the Login link changes to Logout link. 2. Basic settings/lan Under this menu item you set the basic operating parameters Host name The host name is the network name of the Router. It may only consist of letters, numbers and the minus sign. This name will be included in the Server certificates and helps the VPN subscribers to locate the device in the Internet. Default: sr-compact 2.2. Domain name Computers are grouped into administrative units via domains. For domain names, the same rules apply as for host names, additionally, however, the full stop "." may be used which helps with regards the structure. Please enter the complete domain of which your Server is part of at this point. Also the domain name is included in the certificates and helps to locate the device in the net. Example 3.1. Host and Domain name Assuming you have registered with DynDNS.com under the name mein-server.dyndns.org, mein-server is host name and dyndns.org is domain name. Default: example.com Client mode If the Router is to be operated in VPN client mode, default values may be used as host and domain name, since certificates do not have to be generated IP address of the Router in the LAN network IP addresses are a clear identification of computers and networks. Please make sure not to double assign them IP addresses consist of a network and a host part. Any network the ServiceRouter compact may have to access also has to be explicitly specified. Default:

24 Configuration options of the ServiceRouter compact 2.4. Netmask Enter the netmask for the LAN interface at this point. Default: DHCP Server for the LAN Network settings can be dynamically assigned to network subscribers by means of DHCP. Default: activated 2.6. DHCP area The pool of available IPs can be configured. This means an address range can be created from which subscribers can use fixed IPs without the danger of overlapping with addresses assigned dynamically via DHCP Please note that the VPN-Software also assigns addresses to the clients via DHCP. There must be no overlapping of the settings specified at this point and the DHCP area for the admin network under OpenVPN. For further information please refer to Section 8.3.1, DHCP range for VPN clients. Default: HTTPS port of the web interface In this field, the port can be entered where the integrated webserver software receives SSL-encrypted connections. The ServiceRouter compact issues its configuration websites via this software. Since these pages, depending on the configuration, are also available via the Internet, this is carried out with SSL-encryption. The relevant protocol is HTTPS instead of HTTP. Caution Please enter URLs as in your browser. The default port for HTTPS is 443. If you wish to change this port, you must also inform your browser. Add a colon, followed by the port number between server address and directory path. Example 3.2. URL in case of HTTPS on changed port If your new HTTPS-Port is, for example, 4444, the URL has to be entered as follows: or Default: Web access/wan This section describes the allocation of the Internet connection for the ServiceRouter compact WAN media Please select the type of connection at this point. You can choose between Ethernet, WiFi, UMTS or DSL per PPPoE. 18

25 Configuration options of the ServiceRouter compact 3.2. Ethernet Select the configuration of the Internet connection of the device. You can choose between DHCP and manual specification of network parameters. Please note that for DSL access, at this point in time, the device only supports automatic configuration via DHCP Ethernet - DHCP/dynamic All data required for connection set up is received dynamically from a DHCP server in the connected network Ethernet - static The input screen holds all necessary parameters. Specification of the default gateway and DNS server is supported only for the entry of an IP DSL - DHCP Enter user name and password as determined by your ISP. Press the "save" button and the ServiceRouter compact sets up the connection and keeps it permanently. If the connection is terminated, the device tries to restore it. No manual interaction or intervention is required MTU This value should only be altered if your device is running behind a NAT cascade and Path MTU Discovery by means of filtering of ICMP-Typ-3-Code-4 packets does not work. Default: WiFi With Routers including the WLAN option, connection to the Internet may be established via WiFi per reachable access point Connection configuration As with the Ethernet configuration you can choose between static and dynamic IP address ESSID At this point the name of the wireless network is configured to which the device is to connect to. Data is either entered into the text field or selected via the search button. Pressing the search button opens a pop-up window with a list of available WiFi networks. Select your network and confirm by pressing the save button Encryption Select the encryption type. "WPA/WPA2" or "no encryption" is available Pass phrase Enter the password for the network encryption MTU see Section 3.4, MTU 19

26 Configuration options of the ServiceRouter compact 3.6. UMTS Routers with UMTS option can set up an Internet connection via the mobile communication network APN APN means Access Point Name and indicates the access point to the mobile network. Enter the APN of your mobile network provider. Example: web.vodafone.de for the Vodafone network PIN Enter the PIN of your SIM card. If your card does not have a PIN, leave this field empty User name and password In addition to the APN, some mobile network providers require a user name and password. Enter this information in the corresponding fields. Example: User name: t-mobile, password: tm for the T-Mobile-Network 4. WAN Fallback Configuration Here you have the possibility to configure a second WAN. This allows you to maintain the connection in the event of a power failure by automatically switching to the second WAN. Depending on the type of device you can choose Ethernet, WiFi, UMTS or DSL via PPPoE. All combinations of interfaces are available. Caution Depending on your provider's conditions there may be increased costs when using your connection Deactivated No second connection is active Switching As soon as the first WAN is down, the second one is automatically accessed. The connection is interrupted for only 1-2 minutes. Every six hours, the system checks if the first WAN is available again and switches back if necessary. For details on configuration, see Section 3, Web access/wan Multi-WAN Multi-WAN allows for simultaneous access to the Internet with two connections. If one WAN fails, the system switches to the other WAN almost without interruption of the connection. This setting offers particularly high availability. For details on configuration, see Section 3, Web access/wan. 5. Time For safe and stable VPN operation between eurogard ServiceRouter compact and Client-PCs or Servicerouters, all subscribers require a synchronised time base. As a standard, the Server synchronises the correct time via Internet per NTP???. The correct time zone for Germany is preset. If NTP is to be used in connection with public time servers, ensure that the device has Internet access via port 123/UDP. The time set can be viewed in the upper right-hand corner, below the Adminlogin link. 20

27 Configuration options of the ServiceRouter compact If the battery-buffered real-time clock has been reset, the time indicated flashes red. All changed settings, also changes in the table, have to be saved by clicking the save button (bottom right) Time source Here you can select if the device is to receive its time settings via the network protocol NTP??? or if it is to be set manually. Please note that without regular adjustment the current device time starts to diverge. Default: NTP 5.2. Time zone Adjust the time zone of the device. This will allow the device to define the time difference to the Greenwich meridian and to correct the NTP time. This will also automatically change summer and winter time. Default: Central Europe 21

28 Configuration options of the ServiceRouter compact 5.3. Device is NTP Server If the device is to communicate the current time to requesting network subscribers, this menu item should be enabled. Default: aktiviert 5.4. NTP Server chart This chart lists the servers and ports to be used for time levelling via NTP???. These settings may be changed if required, for example in order to only use already existing company servers. 6. ddns In order for the ServiceRouter compact to be traceable by its VPN clients in the case of an Internet connection with changing IP addresses, a provider is required who changes the reference of host-/domain names to your IP as soon as your Internet IP changes. At this point, the eurogard remote service products only support the service DynDNS. Caution This service is only required if you are connected to the Internet via a regularly changing IP address. This applies for example in the case of basic DSL connections. In order to access this service, enter Create an account and log in. Click "Add Host Services". Choose a host name and select a domain from the list. 22

29 Configuration options of the ServiceRouter compact Exit the provider s website after configuration of the account and the host name; set the parameters for the ServiceRouter compact. Enter the account information on the ddns site and the host name and domain name on the System Settings site. From this point on, the Server checks every ten minutes to see if your Internet IP has changed. If this is the case, it is updated by the DynDNS.com server. You can check the exact point in time of the last update and the current IP address under Status-Logs ddns. For further information please see Section 4, ddns. 7. Certificates Certificates play a major role in the security concept of the eurogard ServiceRouter compacts. Tip A Server certificate only has to be generated if the Router is to be operated as VPN Server. The Router itself and every VPN access have their own key and the relevant certificate. The keys ensure security of communication, the certificates establish the reference between the keys and their owners. This makes a certificate a digital passport. In this manual, the term certificate is always meant as including the relevant key. Each of these certificates has a field name "Allgemeiner Name". This shows the owner of the certificate. This may be a server, as for example serviceserver.eurogard.de or also Klaus Meyer. Certificates are organised in chains. This means a trustworthy party issues the first certificate, the so-called root certificate. This is exclusively intended to sign further certificates. The next signed certificate can itself then sign new certificates. 23

30 Configuration options of the ServiceRouter compact This means that if the issuer and his allocation procedures are trustworthy I can also trust the owner of a certificate signed by this root certificate.. In practice, various companies have established themselves over the past years which professionally authenticate certificates for their customers in accordance with strict criteria. Most applications working with certificates, such as for example browsers, have lists of trustworthy issuers. If, for example, a browser does not know the signatory of the certificate of a SSL-encrypted website, it will issue a warning message. Since a self-created root certificate is used in the ServiceRouter compact which is therefore unknown to the browser, a warning message is issued when the web configuration site is called up per per???. Section 7.6, Import root certificates describes how to inform the browser about your root certificates and thus avoid warning messages. Caution Ensure that your certificates do not fall into the wrong hands! Whoever is in possession of your Server certificates can issue client certificates! As a standard, certificates have a limited validity. Please ensure that the device has the correct current time before generating new certificates. This is essential for the whole system to function. The host or domain name in use must not be changed after generation of the certificates Field contents The contents of these fields are displayed in the certificates. This is not mandatory regarding security and functionality but helps to specify and distinguish the different certificates. Enter the required information. The country code consists of two letters and corresponds to the website code,1 e.g. DE, AT, NL. All other entries have a maximum length of 64 characters. 1 gemäß ISO

31 Configuration options of the ServiceRouter compact 7.2. Validity period in days Enter the validity period of the Server certificates in days. Choose a sufficiently long period. If the validity expires, clients will be unable to connect to your device, even with valid certificates. Default: 9125 This corresponds to 25 years. 25

32 Configuration options of the ServiceRouter compact 7.3. Issue certificates for WAN-IP as well If this function is activated, the certificate is bound not only to the host name but also to the IP of the WAN interface. This IP is read directly from the interface during the certificate generation process. When calling up the web interface per HTTPS via the IP, e.g. no browser warning is issued in the case of an imported root certificate (see Section 7.6, Import root certificates ). In case of a subsequently changed WAN IP the general availability of the web interface remains unaffected and further ensured. This option is only practical if the WAN IP does not change. Default: deactivated 7.4. Issue certificates for LAN-IP as well As in Section 7.3, Issue certificates for WAN-IP as well, the certificate can also be bound to the LAN-IP. Default: activated 7.5. Generate Server certificates Caution Before generating certificates, ensure that the device has the correct current time and that the host and the domain names correspond to the ones for future operation. The Server certificates consist of a root certificate for issuing further certificates and a Server certificate used by applications such as OpenVPN or the webserver software. The Server certificate is the digital passport of the Server. If these certificates are re-generated, all other certificates including the ones of the VPN subscribers lose their validity. If the web interface of the device is accessed via HTTPS, for example the browser compares the address called up to the one in the Server certificate. In order to avoid error messages with regards the certificate, host names and domain names should already be configured accordingly in the menu Router configuration Basic settings/lan. In case these options are selected, this also applies to the WAN and LAN IP. Caution If there are clients 'in action' while re-generating the Server certificates, these clients will no longer be able to connect unless new certificates are loaded to the clients or the old Server certificates are restored. Press generieren in order to generate new Server certificates. Since random values are created here, the length of this process may vary on occasion. The new certificates are available after a few minutes. If the certificates are created in the during VPN processes, these processes are terminated. Go to the configuration site Router Configuration -> OpenVPN in order to re-activate VPN functionality Import root certificates In order to avoid browser alarm messages regarding the certificate, the root certificate can be imported via the browser. In order to do so, click the button "import". From this point on there will be no further warning messages when accessing the web interface. The next paragraph describes importing and deleting of the root certificate using Internet Explorer

33 Configuration options of the ServiceRouter compact Internet Explorer Import root certificate Click import; the following dialog box is opened at the bottom of the screen: The certificate window is displayed and the certificate can be installed on the PC by clicking the button install certificate... The certificate wizard is started. Click Next. The next dialog specifies the storage location. Click Browse, in order to select a location manually. From the list displayed select Trusted root certification authorities. 27

34 Configuration options of the ServiceRouter compact Confirm the two following safety warnings and the certificate is installed Remove root certificate Click the menu item Extras in the top right hand corner of the browser and select Internetoptions. Click the tab Content and Certificates. 28

35 Configuration options of the ServiceRouter compact The tab trusted root certification authorities displays a list. Select your certificate authority and click Remove. Confirm the safety instructions and the certificate is removed from the computer Show Server certificates This menu item shows the list of Server certificates. The most important safety feature is the fingerprint displayed. It is the check sum of the keys used in the certificate. 29

36 Configuration options of the ServiceRouter compact Any number of certificates with identical field contents can be generated, the fingerprints, however, will always be different making this an important security feature. 8. OpenVPN Parameters for the VPN operation can be set in this menu. Since a separate OpenVPN process is started for each service network, only some pre-settings are determined here. Some settings can be selected individually for the various processes. This will be indicated in the relevant cases. Caution If settings are changed and saved here during VPN operation, this will result in a reset of all VPN networks. All connected clients will consequently be disconnected and cannot be accessed for approximately 2 minutes OpenVPN mode You can choose between OpenVPN mode "Server" or "Client" at this point. Valid certificates are required in order to activate the OpenVPN server. A warning message is displayed if no valid certificates are available.. Since no valid certificates can be found on the device Default: off OpenVPN client If the Router is to connect to a ServiceServer or other Routers in VPN server mode, select the option VPN-Client. In this case, a valid Server certificate is required as tar file. In the following example, a user "umts_router2" has been created on the Server and a certificate has been generated. This certificate was downloaded to a PC as a tar file, in order to be installed on our Router. 30

37 Configuration options of the ServiceRouter compact The process is terminated by pressing "save". The certificate is uploaded to the Router and activated immediately. The certificate is displayed in the list as 'activated'. As soon as a VPN access has been activated in OpenVPN client mode, the Router continuously tries to establish connection to the Server. If the connection is terminated or the Router restarts, for example after a power cut, it will continue to try and re-establish the connection. This ensures that a VPN channel is permanently available, circumstances permitting.. In order to delete a VPN access or activate a different one, click the corresponding buttons in the list. Caution For a successful connection set up it is mandatory that at least the target port of the Server is accessible and not blocked by a Firewall, and that a DNS Server can be reached which resolves the target server's name to an IP address. In our example the target port UDP 1300 at the Firewall has to be opened and the Server name "eurogard.eu" has to be resolved via a DNS Server. Furthermore it has to be ensured that response packets from Server to Router are not blocked by the Firewall. This may be the case if the Firewall setting are very restrictive. In this case, please contact your company s IT-administrator Checklist Router as OpenVPN client Preconditions Target port of the Servers has to be reachable (Firewall setting of the customer network) DNS Server has to be reachable for resolving the Server name to an IP address 31

38 Configuration options of the ServiceRouter compact Response telegram of the Server must be able to reach Router (Firewall settings of the customer network) A valid certificate is required Time has to be set correctly IP address range of the LAN side of the Router and the service network of the Server have to be identical, e.g. Router IP: , Server IP: , SPSIP HTTP-Proxy-Server Under this menu item you can set the use of a web proxy. Caution Prerequisite for using the proxy functionality is the use of TCP as transport protocol for OpenVPN! If the eurogard ServiceServer to be used is configured as an HTTP proxy, the required parameters are set by the router via the access file, so that the user does not have to pay any further attention to these options. If this is not the case, and if the router is explicitly supposed to use the services of a web proxy, enter at least IP and port here, if necessary also authentication data. This information must be requested from the administrator of the proxy. Caution The external proxy server can only be used if the VPN server is neither in proxy mode nor in S-tunnel mode, since the fields of a certificate will be filled automatically otherwise during upload OpenVPN Server DHCP range for VPN clients Since the OpenVPN software in the Server allocates an IP to each client and since IPs can never be double-allocated, the IP range must be customised in accordance with your requirements. Please note that the Server also allocates IP addresses via the LAN. The areas from which addresses are assigned must not overlap since this will inevitably result in breakdowns and inaccessibility of clients. Default: from to VPN Transport protocol UDP or TCP may be selected as transport protocols. Mixed mode is not supported Default: UDP Port Enter the port to access the VPN Server process of the Router. It may be necessary to change this port, depending on the requirements of the customer network. Default: Enable client-to-client connections This option controls intercommunication of the VPN clients within one service network. Default: on Limit VPN packet size Since the packet size of 1500 Bytes must not be exceeded in the IP networks used in this context, the size of the packets sent through the tunnel can be limited. This is carried out entirely transparently through the VPN application and undetected by the rest of the software. 32

39 Configuration options of the ServiceRouter compact Since the eurogard ServiceRouter compact and ServiceServer mask all data per??? prior to the forwarding to the WAN interface and since the devices, in some cases, are operated behind NAT Gateways, packets will exceed the maximum size. It therefore has to be limited. If the value chosen is too low, it will affect the throughput, if chosen too high, the connection will freeze. The best compromise between throughput and general accessibility results in the following Default: Interval for keep-alive-packets in seconds The VPN software uses the connectionless UDP protocol for data transport, therefore neither the Server nor the client can directly check if the VPN tunnel is still available. For this reason a test datagram is sent in predefined intervals. These intervals can be defined here. If n replies (to be configured in the next section) fail to appear, the connection is reset. During the dial-in of the clients, these settings are also transferred to the clients and implemented. This is of particular importance if the Server is connected to the Internet via a dynamic IP. Also the display of the connected VPN clients uses this value. If a ServiceRouter is disconnected from the power supply it is shown as connected until the time out for the next Ping has expired. Default: 60 seconds VPN restart after how many unsuccessful pings This configures how many test datagrams have to remain unanswered before the connection is re-established. Since UDP is connectionless it is not unusual that a packet is lost on the way. This applies particularly to wireless connections depending on signal strength like eg. UMTS. Default: 4 This option is also transmitted to the clients during connection set up Crypto algorithm Since the various Router versions use different cryptographic algorithms please specify the type at this point. If you intend to use a V1 ServiceRouter in your plants please choose option Compatibility Mode v1-router. Default: Standard v2-router Translate VPN network This option is not required for standard operation. If, however, the network address of the customer LAN is identical to the address of the VPN network, a routing problem will occur. In order to avoid this conflict, the network may be translated.. Example On the LAN side, the Router has the IP , a PLC with the IP is connected. The technician is in the office. The office LAN also has an IP from the range. If the technician sets up a VPN channel to the Router in order to service the PLC, without translation functionality a second network 1 will be created. The technician's PC cannot detect which network to choose for the packets in order to access the PLC. For this reason, requests via the VPN tunnel are translated, e.g. to the network, configured under "IP of the Router in the VPN network". 9. Accounts All user accounts are administered in this section.. 33

40 Configuration options of the ServiceRouter compact A warning message is displayed if the default administrator account is still active. You should create a new account at this stage and delete the "eurogard" account. The existing accounts are organised in an overview chart. Again you have the possibility to filter, browse and set the maximum number of lines displayed. The table has the following columns: Account name Plant network Certificate (created/not created, validity) Online status of the user. Again, please note Section 8.3.6, Interval for keep-alive-packets in seconds and Section 8.3.7, VPN restart after how many unsuccessful pings. If a client does not log out of the VPN correctly, it may take a certain length of time until his status is displayed as "offline". Action for activities. Here, for each user a certificate can be generated and downloaded, passwords can be changed and the account can also be deleted Refresh status After pressing this button, the online status of all accounts, including the ones on the current site, is checked. The updated status is then entered into the chart Add new account Pressing this button opens a new table below the overview chart where you enter the account information. Choose an account name and password. This password has to be entered when the user logs into the web interface. The password must have a minimum of 6 characters. Both the user name and the password are case-sensitive. "bediener0815" and "Bediener0815" would therefore be two different accounts New user certificate This triggers the generation of a new client certificate for the relevant user account. Successful generation and validity of the certificate is displayed in a popup window as well as in the updated field "Certificate" in the relevant line of the overview chart. If a certificate has already been created, a security warning has to be acknowledged. In this case, the existing certificate is revoked. 34

41 Configuration options of the ServiceRouter compact Caution A revoked certificate can no longer be used by a client for access to the Server. Make sure not to block the only way of access to a Client-Router in this way, for example to an UMTS Router Download Press "download" in order to download an archive file with all certificates, keys and an OpenVPN configuration file for the relevant user. The eurogard-connect-software as well as the eurogard ServiceRouter require the tar format for setting up the VPN.. Depending on the validity range, this file is essential for access to the VPN Server. Caution If this file or a storage medium containing this file is lost you should generate a new client certificate as quickly as possible. The old certificate is automatically revoked in this case. If a VPN-Client with this certificate is connected, his connection to the Server will be immediately terminated. If no certificates exist, the download button is deactivated and greyed out Change password A new password can be created here for user access with password. After pressing this button, a field for entering the new password is displayed below the overview table. Press the button "speichern" on the right hand side in order to confirm settings Delete account By clicking this control element and confirmation upon security query the relevant account is deleted and the certificate is revoked. 10. WLAN (only with WLAN option) WLAN interface The WLAN adapter is enabled or disabled at this point. 35

42 Configuration options of the ServiceRouter compact Operating mode At this point operation of the Router as WLAN access point or WAN client is selected. In Access point mode WLAN clients can connect to the Router and have access to the LAN side of the Router. In WAN mode the Router connects to an Access point as WLAN client and can then set up the Internet connection. Mixed operation is not supported. 36

43 Configuration options of the ServiceRouter compact Radio band b with 11MBit/s, g with 56MBit/s and n with 150MBits/s are available. In 11g-mode the device is compatible to the 11b-standard ESSID This displays the Router ESSID in Access point mode or the Access point ESSID in WAN mode, to which the Router connects. In WAN mode, the button "show" displays a list of all available Access points in the area. Select the preferred Access point and the ESSID is automatically entered into the corresponding field Country In Access point mode, the Router's country code is determined at this point Encryption WPA or WPA2 encryption is available. The Router can also handle WLAN without encryption, although we strongly advise not to operate without encryption Passphrase The passphrase is used to decrypt data traffic in WPA/WPA2 mode. It has to consist of a minimum of 8 characters. 37

44 Configuration options of the ServiceRouter compact 11. Firewall The integrated firewall is part of the security concept. With a few exceptions all settings of the firewall are automatically parameterised by the ServiceRouter compact. As a general rule, all eurogard remote service products mask the data traffic of the LAN clients via??? before entering the WAN. This minimises administration requirements and enhances the acceptance of the devices. The following basic settings are activated as default: All services of the device itself and of all LAN connected devices have unlimited access to the WAN. From the WAN side, access to the device and to devices in the LAN is not possible, except for the HTTPS secured access to the web interfaces by means of the Proxy function via Port 443. All LAN and VPN clients have unrestricted access within their respective networks Port 22 - ssh If the Section 2.1, Maintenance access is activated, it can be reached via the LAN and the WAN interface. With this button, reachability of the service port via the WAN port can be prevented. Default: permitted Port https If you do not wish the web interface of the Server to be accessed from the WAN side, this option can be blocked with this button. If reachability of the HTTPS protocol has been directed to a different port from port 443, the chosen port is opened or closed at this point. 38

45 Configuration options of the ServiceRouter compact Default: permitted Allow LAN devices access to WAN Access of LAN devices to the Internet may be blocked here. Default: permitted Parameterized firewall rules for incoming connections In this section, you can set additional firewall rules for inbound connections. In order to do so, click the button "add new rule". A window opens in which you can create a rule using protocol, source and target IP. Please note that the source IP is the IP of the device sending the request (e. g. a PC), while the target IP represents a device from the system network or the Router itself. 'Action' defines what happens to data packets matching this rule. The new rule is then saved by clicking on the "save" button and is now listed in the overview. All rules are displayed in the overview. 39

46 Configuration options of the ServiceRouter compact Caution Please note that the first-match principle is applied. This means that the rules are processed from top to bottom and that the first matching rule is applied. It is therefore essential to place the specific rules in the upper part of the list and the more general rules in the lower part. 12. Routing As a standard, the Router redirects all requests from the LAN side to other networks to the WAN interface. Under "Routing", however, routes may be determined for Routers or Gateways. This may be done for individual hosts as well as for entire networks. Additionally, the interface for access to the Gateway, LAN or WAN, may be determined. 40

47 Configuration options of the ServiceRouter compact 13. Ports Now the Router supports the port forwarding function. Requests on a specified WAN port are directly forwarded to the configured port of a device inside the LAN. This way single devices inside the LAN could be addressed by devices from the WAN zone, without the need of an established vpn channel. For example the webserver with the IP should be reached from the WAN zone. Rule 1 shows you, how to achieve this. The webserver is now available by the WAN-IP or rather by the hostname plus the specified WAN-Port. E.g.: Caution Please note that the data traffic may be unsecured, depending on the service you use. Authentication can only performed by the device inside the LAN itself. 41

48 Configuration options of the ServiceRouter compact 42

49 Chapter 4. Messaging All messaging to and from the Router is parameterized at this point. 1. Settings regarding sending and receiving s are made here. Direct traffic through the device is not provided for in order to avoid problems of spam. For direct ing, an server account must be used ing By activating the button "enabled, s are included in the messaging process. 43

50 Messaging address Enter the address of the account which is to be used by the Server Server/Port Enter the name of the SMTP-Server and the corresponding port of your account Username/Password If authentication is required by your chosen SMTP-Server, the relevant user data can be entered here Transport encryption If the SMTP server chosen supports encrypted communication, the encryption method may be chosen at this point. Please note that, depending on the method chosen, the ports to be used may vary on one and the same Server. Select "none", if communication is to take place unencrypted. By selecting "STARTTLS if available" TLS transport encryption is automatically activated, in the case where this is supported by the Server. The option SSL/TLS always tries to establish a secure connection. If this is not possible, mails will not be delivered. Default: STARTTLS 1.6. Allow certificates of unknown origin If the mail server which has been configured uses self-generated certificates, this option must be enabled; otherwise, the device will not send s to this server address of recipient Enter the address of the recipient of Router messages Test configuration Clicking the "Test" button generates a status report of the device. Please note that any changes in the configuration have to be saved before testing. During the test, a window opens which displays the messages of the mail software and the mail server. 44

51 Messaging 2. SMS-Gateway The ServiceRouter compact can send SMS messages to different recipients. In order to ensure that this function can also be used with devices without UMTS modem, a web SMS service is used. The device supports the service of the provider CM Telecom. For existing customers, also the previous service SMS Trade is available.. 45

52 Messaging After registering on the site and making a deposit, you can start configuring the Router. For authentication of the Router with the provider, a key is required. This key is created on the respective provider's website in the Interfaces section. After the key has been created, it is displayed in plain text on the web page and can be copied to the clipboard. On the Router website, the key is simply inserted from the clipboard into the input field under the menu item of the same name.. The sender identifier determines under which sender an SMS is displayed in the recipient's device. Letters and numbers may be arbitrary varied. Since each Router is given its own identifier, it enables the SMS recipient to immediately assign from which router the SMS was sent. Press "save" before proceeding. Press the button "test" in order to send a test SMS to the registered target numbers. The following window displays the result: The connection of the SMS service with the fault indicator function is carried out under the item Devices->Fault indicator, as described in chapter 'Devices'. 3. Reports The device can send status reports at pre-determined intervals. This function and the intervals can be set here. The report includes the network parameters in use, connected VPN clients and sensor data of the hardware such as, for example, the CPU temperature. 46

53 Chapter 5. Devices This menu item contains information and configuration details of devices connected to the Router. 1. Host configuration Two functions are available: 1. Enter IP address and corresponding host name, as in the host file on a PC. 2. Allocate a static IP to a connected device in the LAN via the MAC address of the device. 2. Fault messenger The fault messenger sends messages via and/or Web-SMS. Individual bits may be monitored for changes of status. In case of changes, a message is immediately sent to the parameterised recipient. As precondition, at least one communication channel, or Web-SMS, has to be configured under the menu item "Messaging." Configure message trigger A connection to a device is configured corresponding to the settings of the data logger. Press "generate". Enter the IP of the device in the next screen and select the protocol for communication with the device. The following communication drivers are available: ISO-on-TCP for S7-compatible controls (e.g. S7-300/S7-400) ISO-on-TCP for S7-1200/1500 controls (Please note that only DBs may be read which have not been symbolically addressed in the TIA and PUT/GET is allowed.) 47

54 Devices IBHLink-Adpater at S7-compatible controls (e.g. S7-300/S7-400) Modbus-on-TCP In the case of S7-controls, flags as well as bits from data blocks are supported. In the case of Modbus devices, individual coils are monitored for status changes. and Web-SMS are available as message channels. In order to send messages via both channels, please create two separate messages, one for each channel. The recipient is entered in the field "Mail address" or "Telephone number". The message text can have up to 100 characters. The button "test" will only check if the parameterised device is accessible, test messages are not sent. This may be tested under "Messaging". The button "save" saves the settings and starts monitoring the parameterised bits. The status of bits to be monitored is checked every ten seconds. Since monitoring is carried out in the volatile memory of the Router, in case of a reset of the Router current messages may be sent out a second time after restart. 3. RS232 An alarm modem function can be parameterized under this menu item. This was tested for devices of the company Priva. In addition to the configuration, a suitable adapter and a cable are required. These can be obtained from eurogard. In order to be able to use this serial interface, select "enabled" in the drop-down menu. Input fields for the baud rate of the interface, data bits, parity and stop bits are displayed. Please refer to the manufacturer's documentation of the machine for the appropriate adjustments. Press save. Caution The RS232 interface only works if the USB tunnel is deactivated. 48

55 Devices 4. S7 Interface This function allows you to configure the Router from an S7 PLC. This is a customer-specific function that can be activated as necessary. If you are interested, please do not hesitate to contact us. 5. Modbus RTU/TCP Gateway By using an additional USB-RS485 adapter the router can be connected to a serial modbus. Queries from the modbus TCP are translated to modbus RTU and forwarded to the receipent on the bus. The results form the modbus slaves are conveyed vice versa. The gateway can handle up to 15 connections simultaneously. 6. USB-Tunnel The Router has an USB port for connection of external devices such as programming interfaces, webcams or memory sticks. Via a USB tunnel, these devices may also be used for remote service. The USB tunnel is activated via the Drop-Down menu. All USB devices connected are now automatically configured for tunneling. 49

56 Devices All USB devices connected on a client PC connected via VPN may be used by means of the licensed software USB-Redirector. Devices are handled as if they were directly connected to a USB port of the PC. The use of USB hubs is supported as well, so that more than two devices may be connected. They should, however, have a seperate external power supply since the Router only provides a limited supply of voltage per USB port. For this reason, external hard disks withouth independent power supply should not be connected via USB. The USB-Redirector software may be ordered directly from eurogard. 7. WAN-Switch The WAN-Switch enables the router's WAN interface when a positive pulse of a bit in an connected PLC is recognized. A typical application would be the monitoring of a fault bit which reports the actual state of a connected plant or machinery. When a fault occurs the router enables its remote access and the plant can be serviced. The access stays opened during the bit is set and is disabled after the bit's negative pulse is recognized plus the configured time delay Configure trigger A connection to a device is configured corresponding to the settings of the data logger. Press "generate". Enter the IP of the device in the next screen and select the protocol for communication with the device. The following communication drivers are available: ISO-on-TCP for S7-compatible controls (e.g. S7-300/S7-400) ISO-on-TCP for S controls (Please note that only DBs may be read which have not been symbolically addressed in the TIA) IBHLink-Adpater at S7-compatible controls (e.g. S7-300/S7-400) Modbus-on-TCP In the case of S7-controls, flags as well as bits from data blocks are supported. In the case of Modbus devices, individual coils are monitored for status changes. 50

57 Devices Should multiple bits being configured the WAN interface stays enabled as long as the last bit toggled back to zero state. 8. MBus TCP Gateway By using an additional USB-RS232 adapter and a logic level converter the router can be connected to a MBus. This mode only works combined with the etweak energy management system. 9. Reboot Ping The ping cycle is a monitoring cycle for the Internet connection. The Router checks if there is an Internet connection in the configured time period. If a connection cannot be established, the Router restarts automatically. This happens continuously until it has reconnected to the Internet. The cycle should therefore be chosen carefully. It is activated most frequently in combination with the use of UMTS and LTE. The ping-host is freely adjustable. 51

58 Devices 10. Time emitter Up to two devices/controllers can be synchronized with the date and time of the Router, these can be S7 controllers or Modbus devices. With activation of a timer, the Router writes the following data into the specified data block of a S7 control or the register of a Modbus device once per minute, starting with the specified address. For S7 as DATE-TIME format (BCD-Format) 8 Byte: Byte 0: year (17) Byte 1: month (12) Byte 2: day (13) Byte 3: hour (22) Byte 4: minute (55) Byte 5: second (30) Byte 6: blank Byte 7: day of the week (1 Sunday 7 Monday) For Modbus 7 Register as USHORT values: Register 0: year (17) Register 1: month (12) Register 2: day (13) Register 3: hour (22) Register 4: minute (55) Register 5: second (30) 52

59 Devices Register 6: day of the week (1 Sunday 7 Monday) Enter the IP address and further control parameters in the corresponding fields. You can then use the test button in order to check if a device with a corresponding protocol can be reached under the specified IP address. 53

60 Chapter 6. Status-Logs The system status is displayed under this main menu item. No entries are made here. 1. Network This screen displays all network-specific information. 54

61 Status-Logs 1.1. IP addresses All IP addresses used by the device are listed WAN IP address LAN IP address 55

62 Status-Logs VPN IP address position of the VPN switch 1.2. Network interfaces The two RJ-45-interfaces of the Router are shown here. The green LEDs light up if a network cable is plugged in and connection to another network device is set up DHCP Leases to DHCP clients are displayed here if the DHCP Server of the Router has been activated for the LAN side VPN-Status Information about the Router's VPN is displayed here. Among other settings, this includes the mode selected, the port used and the chosen protocol. In client mode, also the last three status messages for the VPN process are displayed. In Server mode, a list with all connected VPN clients is displayed UMTS-Status If the Router uses an UMTS modem which is configured as WAN interface, additional information regarding the status is displayed here. 2. Logs The OpenVPN-Log of the Router can be viewed here. 3. Firewall The submenu Firewall shows the status of the Firewall for the settings accessible to the administrator. These include the accessibility of the web interface via the WAN interface per HTTP/HTTPS and the service access per SSH. The second overview shows if LAN clients are allowed to send data via the WAN interface. This organises the LAN client s Internet access as well as access to the company network. 4. ddns This site provides information about dynamic DNS updates. Three items are displayed. The first line indicates the last IP which was submitted to the ddns provider. The second line shows the IP of the ServiceRouter compact's Internet connection. If required this is communicated to the ddns provider. The last line indicates whether the Server has been configured for ddns. The button "Update now" triggers an immediate synchronisation of the current Internet IP with the ddns provider. 5. Diagnosis The correct WAN configuration and connection can be tested under the menu item Diagnosis. The default settings entered here are only effective if connections from the device to the Internet are not manipulated by firewalls or the like. The command line tool ping sends a test data packet to a network client who then sends his reply. This client can be identified by its IP or its host name. 56

63 Status-Logs Since not every host replies to ping packets, the ping target should be checked beforehand in that respect. Servers such as for example goolge.com or heise.de will reply. Please note that this may change over the course of time. If a ping to google.com, for example, is not successful you can identify the google.com IP by means of a PC with Internet connection and ping this IP. If this works, it means that the ServiceRouter compact has been allocated an incorrect or no DNS server. In order to identify, for example, the google.com IP, proceed as follows: Open Start # Run and enter cmd. This opens the Windows command prompt. Enter nslookup google.com and press the return key. C:\Users\klaus>nslookup google.com Server: UnKnown Address: Nicht autorisierende Antwort: Name: google.com Addresses: C:\Users\klaus> Choose one of the google.com IPs which are displayed. The IPs listed in the above example may have changed in the meantime and should be verified. The tool nslookup can also be found in the Router. Enter the host name to be checked into the second text field and press the "nslookup" button. The DNS server configured and used in the Router and the result of the query is displayed in the next window. 6. Routing Routes currently used by the Router are displayed here. The flags have the following meanings: U: Up, interface active H: Host, Route to individual host 57

64 Status-Logs G: Gateway 58

65 Chapter 7. Backup maintenance The structure of this chapter follows the sub menus of the main menu item "Backup-Wartung". Functions such as backup or restore settings, as well as shut down and reboot are handled here. 1. Backup 1.1. Restore point A restore point saves the configuration of the device at the time of its generation. With this restore point, the configuration of the device can be restored at a later point in time. Press "generate" in order to generate the restore point. This takes approximately 5 seconds; a message window indicates that the restore point has been set.. An already existing restore point will be overwritten when a new one is created. If you upload a restore point into the device, the point is saved but the configuration is not restored. This has to be triggered separately. 59

66 Backup maintenance As soon as a restore point has been generated, the button "download" is activated. Press the button in order to load previously set restore points on to your PC. Select the file "settings.bak.bin" via the button "Browse" in order to load a restore point. The button "send" on the right hand side of the field appears, press "send" in order to load the restore point. The restore process is triggered by pressing the button "restore". All data on the device is overwritten with data from the restore point. Depending on the size of the restore point, this process may take a certain length of time. After the successful restore process the device reboots and can be accessed via the stored IP Update The device can carry out a firmware update via a special file. It is downward compatible regarding new and extended functionality. Select the update file and press save. The update process takes approximately 5 minutes. Make sure that the power supply is not interrupted during this time! 1.3. Reset After pressing "Reset" the device is set back to default settings after a safety query. The reset function can also be triggered via the reset button at the device. After pressing the button, all LEDs start flashing for a few seconds. The device restarts and the configuration is initiated. After a subsequent restart the device can be reached via IP on the LAN side. The WAN side is configured for address allocation via DHCP Configuration Human readable configuration files can be created. These files can then be downloaded "download" and customized. Thus it is possible to configure new devices faster and easier. The file can be selected, uploaded and imported via Configuration import. If the configuration contains a valid VPN client configuration, you will be asked in a 2nd step to upload this file. The device then starts with the newly set parameters and displays the LAN-IP under which the device will be available after the restart. It is also possible to change the configuration via a USB stick. For this purpose, a USB stick must be used, which is formatted with a FAT16 or FAT32 file system. The stick must contain in the root directory the file routerconfig.cfg. Additionally the valid OpenVPN client certificate as vpn.tar file, if VPN is configured. In order to prevent unauthorized access, a file named "auth" must be created which contains a valid username/password combination for router access. The first line must contain the user name and the second line must contain the password in plain text. The file log.txt, which is created during each configuration process, must be NOT present, otherwise the router acknowledges the attempt with a mistake. If you now plug the USB stick into the router, the configuration procedure starts. As soon as the stick is detected, the Error LED starts to flash. If a VPN configuration is included, the status LED flashes as well. If an error occurs during the procedure, this is indicated by a very fast pulsing of the error LED. Then please read out the log.txt file on the stick in order to to identify the problem. Should the configuration be correct and adopted the LEDs will extinct and the router will reboot. Please then remove the stick. 2. Service The button "restart" is self-explanatory, the function is triggered immediately after clicking the button. 60

67 Backup maintenance 2.1. Maintenance access Activating the maintenance access allows a eurogard service technician to connect to the device for diagnosis and trouble-shooting purposes. There are two ways of doing this. An admin account for logging on to the web interface is created A service for a direct connection to the device is started. For the direct connection, the SSH protocol on Port 22/TCP is used. Here, also fundamental problems causing, for example, inaccessibility of the web interface can be fixed. If this option is to be used, the operator of the device has to ensure that the Server is accessible via Internet through Port 22/TCP. Firewall or port forwarding options have to be adjusted accordingly. When activating the service access, this port is opened in the firewall for the LAN and for the WAN side. If the WAN side is not to be accessed, this may be changed under Router Configuration Firewall. After switching between "on/off" for the maintenance access, the new settings have to be confirmed by pressing the "save" button. 61

68 Chapter 8. Declaration of Conformity We hereby declare that the devices ServiceRouter compact ER1301, ER1301-WLAN, ER1301-UMTS and ER1301-W/UMTS are in conformity with all necessary standards and guidelines including 1999/5/EC and 2011/65/EC. The Declarations of Conformity can be viewed and downloaded at the following address: