NRSW Factsheet

This factsheet outlines the feature set as of version 3.8 of NetModule Router Software (NRSW). See also the GUI simulator for illustration. The Linux based software is composed of more than 130 applications and packages containing both NetModule proprietary and open source software. For detailed description of specific features please refer to overview, detailed or the user manual.

A big asset of the NetModule Routers is the self explanatory, hence easy to use Web Manager.

The Command Line Interface (CLI) offers a generic control interface to the router and can be used to get/set configuration parameters, apply updates, restart services or perform other system tasks. For power users root login with full Linux shell is available.

CLI-PHP, the HTTP frontend to the CLI application, can be used to configure and control the router remotely. It is enabled in factory configuration, thus can be used for deployment purposes, but disabled as soon as the administrator account has been set up.

Web Manager and CLI offer comprehensive status information to the user including system information.

We basically distinguish between Wide Area Network (WAN) and Local Area Network (LAN) interfaces. WAN interfaces, e.g. Mobile network, WLAN and Ethernet, are directed towards the WAN. Typically the router acquires an IP address on a WAN interface from the service provider. In case of multiple WAN interfaces the router needs to make a decision on which interface a packet shall be sent out. This is called routing. In contrast, on a LAN interface, e.g. Ethernet or WLAN, the router typically runs a DHCP server and assigns IP addresses to the hosts in its LAN.

Multiple WAN interfaces (Mobile network, Ethernet, WLAN) can be prioritized in a list or the traffic can be distributed to multiple interfaces based on the session or the source address. Every interface can be supervised with ICMP messages. Custom configuration (reference host, interval, emergency actions, etc.) is possible. In case of restrictions on the maximum packet size, the router can adjust the maximum size of TCP packets.

Ethernet ports are in LAN mode by default, but can be set into WAN mode. The capabilities of the Ethernet interfaces depend on the actual hardware. NB1600 has two separate interfaces that can be operated as two different IP networks with routing in between or combined using bridging. NB2700 and NB3700 have an integrated switch that can be configured as separate ports (port based LAN) or as switch. In addition, VLANs according to IEEE 802.11Q can be configured. On each VLAN traffic shaping is supported.

Each cellular modem requires a SIM card for making connections. The software assigns SIM cards dynamically according to the configuration. In most cases, the Access Point Name (APN) has to be configured at minimum in order to make an Internet connection. If the SIM is protected by a PIN, the software automatically enters the PIN which has been configured by the user in advance.

The software supports client mode (wpa_supplicant) and access point mode (hostapd). Simultaneous operation is only supported when your router model includes two WLAN modules (e.g. NB3700-2L2W-G). In client mode, the router can be configured to connect to one or multiple networks. In access point mode, the router will receive connection requests from clients and assign IP addresses to them at connection setup. See also the captive portal extension Coova Chilli Standalone for Public WLAN solutions.

The system provides drivers for several USB devices. Supported devices include memory sticks and USB to RS-232 adapters . Unsupported USB devices can be forwarded via IP to another host where a device driver is available.

Software update and configuration via USB memory stick is possible. For advanced scenarios, an autorun script can be executed when plugging the stick in, see USB Autorun for more details.

Serial interfaces can be forwarded via IP with a serial to network proxy (ser2net) or being accessed from the SDK. Most routers have one physical interface. A second interface can be added via a USB serial adapter.

The logic for the digital inputs and outputs is normally implemented in the SDK. For example, the IOs can be controlled via SMS or a UDP server.

The GNSS receivers in our products currently support GPS and some of them also Russia's Global Orbiting Navigation Satellite System (GLONASS). The received GNSS data is collected and served on a local TCP server, more specifically this is GPS Daemon (GPSD). Output formats include NMEA 0183 and GPSD JSON. The GPSD project provides client-side libraries in C, C++, and Python for easy interaction with GPSD. If you just want to do a quick test, you can use Telnet or one of the Linux GPSD clients such as gps, xgps, xgpsspeed, cgps or lcdgps. To significantly improve the time-to-first-fix (TTFF) the software supports assisted GPS (A-GPS), which relies on a Secure User Plane Location (SUPL) server for getting additional data.

Destination based static routes have to be configured by the user. However, routes can also be configured via SDK which allows more dynamic scenarios.

Policy-based routing (PBR) allows to configure routing rules that make a routing decision based on the source address. Multipath routing can be applied to distribute the traffic load on multiple interfaces, also called load balancing. Weighted round robin queuing (WRR) will then be configured using the iproute2 utilities and applied by the kernel to distribute the load.

Mobile IP (MIP) can be used to enable seamless switching between different kinds of WAN links (e.g. Mobile networks and WLAN). The router can play both roles, mobile node and the home agent.

NetModule routers are able to prioritize and shape certain kinds of IP traffic making use of Linux Advanced Routing & Traffic Control. This is currently limited on egress, which means that only outgoing traffic can be handled. The current QoS implementation uses Stochastic Fairness Queueing (SFQ) classes in combination with Hierarchy Token Bucket (HTB) queuing disciplines. In case of demands for other classes or classless queuing disciplines (qdiscs), please contact our support team in order to evaluate the best approach for your application.

NetModule routers use Linux’s netfilter/iptables firewall framework which supports stateful inspection, that is, granting the same permissions for inherited connections within an IP session (e.g. FTP which builds up a control and data connection). The administration page can be used to enable and disable firewalling. When turning it on, a shortcut can be used to generate a predefined set of rules which allow administration (over HTTP, HTTPS, SSH or TELNET) by default but block any other packets coming from the WAN interface.

Network Address & Port Translation (NAPT) basically translates IP and ports. The feature is typically used for port forwarding scenarios when operating multiple virtual servers behind a single IP address.

OpenVPN is a software application that implements virtual private network (VPN) techniques for creating secure point-to-point or site-to-site connections in routed or bridged configurations. It uses a custom security protocol (Blowfish) that utilizes SSL/TLS for key and data exchange. It is capable of traversing network address translators (NATs) and firewalls as it relies on a single USD port only. OpenVPN allows peers to authenticate each other using a pre-shared secret key, certificates, or username/password. When used in a multiclient-server configuration, it allows the server to release an authentication certificate for every client, using signature and certificate authority. NetModule Routers support 4 OpenVPN tunnels in client mode. In server mode it can terminate connections from 10 clients. 25 clients are possible with a server license.

Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to be used during the session. NetModule Routers support 4 IPsec tunnels and can operate as initiator (client) or responder (concentrator). We use the Openswan implementation and have tested the interoperability against many third party firewall and VPN concentrator manufacturers.

The Point-to-Point Tunnelling Protocol (PPTP) is a method for implementing virtual private networks between two hosts. PPTP is easy to configure and widely deployed amongst Microsoft dial-up networking servers. However, due to its weak encryption algorithms, it is nowadays considered insecure but it still provides a straightforward way for establishing tunnels. NetModule Routers support 4 tunnels in client mode and can also operate as server.

Generic Routing Encapsulation (GRE) is a tunnelling protocol developed by Cisco Systems that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links over an Internet Protocol network. NetModule Routers support up to 4 GRE tunnels.

Circuit Switched Data (CSD) Dial-in means terminating a circuit switched data call from another mobile or ISDN device. This feature is only supported for legacy reasons. Future modems might not support it and the feature may be dropped from the software somewhen.

A Dynamic Host Configuration Protocol (DHCP) service for each LAN/WLAN interface which will provide dynamic IP addresses to hosts in the local network. The lease time can be configured and various DHCP options are supported. For a deterministic behaviour, hosts can be bound to its MAC address so that they will always receive a certain IP address.

The DNS proxy server can be used to resolve or forward DNS requests towards servers on the Internet which have for instance been negotiated during WAN link negotiation. By pointing DNS requests to the router, one can reduce outbound DNS traffic as it is caching already resolved names but it can be also used for serving fixed addresses for particular host names.

A Network Time Protocol (NTP) server is included. Supported time sources are other NTP servers, the GPS and the mobile network (e.g. GSM).

The included dynamic DNS client can be used to tell one or more DynDNS providers the current WAN address of this router. This address can be either derived from the current hot-link address or by querying an HTTP service in the Internet for the current public IP address. The latter might be applicable in NAT scenarios.

The E-Mail client can be used to send notifications to a particular E-Mail address upon certain events or by SDK scripts.

By using the event manager you can notify one or more recipients by SMS or E-Mail upon certain system events. The messages will contain a description provided by you and a short system information.

On NetModule routers, it is possible to receive or send short messages (SMS) over each mounted cellular modem (depending on the assembly options). Messages are received by querying the SIM card via the modem. Received messages are pulled from the SIM cards and temporarily stored on the router but get cleared after a system reboot. Please consider to consult an SDK script in case you want to process or copy them. Using the SMS control script from the SDK, the router and even other hosts can be operated via SMS.

Apart from the Web Manager, the Secure Shell (SSH) and Telnet services can be used to log into the system. Valid users include root and admin as well as additional users as they can be created in the User Accounts section. Please note, that a regular system shell will only be provided for the root user. For all other users the CLI will be launched. Whereas normal users will only be able to view status values, the admin user will obtain privileges to modify the system.

NetModule routers are equipped with an Simple Network Management Protocol (SNMP) agent, supporting basic Management Information Base (MIB) tables (such as ifTable), plus additional enterprise MIBs to manage multiple components. Our MIB can be downloaded directly from the router.

A redundant pair of NetModule routers (or other systems) can be set up by running the Virtual Router Redundancy Protocol (VRRP) between them. A typical VRRP scenario defines a first host playing the master and another the backup device, they both define a virtual gateway IP address which will be distributed by gratuitous ARP messages for updating the ARP cache of all LAN hosts and thus redirecting the packets accordingly. A takeover will happen within approximately 3 seconds after the partner is not reachable anymore (checked via multicast packets). This may happen when one device is rebooting or the Ethernet link went down. Same applies when the WAN link goes down.

Depending on your hardware, you can set up a voice gateway on the router which can be connected by any VoIP client from the local network capable of the SIP protocol. It hereby listens for arriving SIP calls and forwards them as a mobile call using the configured cellular modem.

NetModule routers are shipping with a Software Development Kit (SDK) which offers a simple and fast way to implement customer-specific functions and applications. The SDK API provides more than 50 functions, e.g. for SMS, E-mail, RS-232, file transfer and much more. Over 40 real-world sample applications making use of these functions are included in the software.

The system comes with two user accounts root and admin. Further users can be created and roles assigned to them. A Remote Authentication Dial In User Service (RADIUS) server can be used for authenticating remote users. This applies for the Web Manager, the WLAN network and other services supporting and incorporating remote authentication.

Fail-safe software update is provided also over the air (OTA). When issuing a software update, the current configuration will be backed up and reapplied after the update. Any other modifications to the file system will be erased. The configuration is generally backward-compatible. We also apply forward compatibility when downgrading to a previous software within the same release line. For mass update and configuration automatic provisioning is provided as well as smooth integration with popular network monitoring and management systems such as Zabbix.

Configuration via the Web Manager becomes tedious for larger volumes of devices. The router therefore offers automatic and manual file-based configuration to automate things. Once you have successfully set up the system you can back up the configuration and restore the system with it afterwards. You can either upload a single configuration file (.cfg) or a complete package (.zip) containing the configuration file and a packed version of other essential files (such as certificates) in the root directory. System integrators may define their own factory settings, so that the router will fall back to their default settings when the end user presses the reset button.

The router includes certificate management capabilities for Root CA, HTTPS, SSH and OpenVPN certificates. The Simple Certificate Enrollment Protocol (SCEP) is supported in order to securely transfer certificates from the certificate authority to the router.

From the Web Manager you can inspect the system log, debug log and boot log. You can generate and download a tech support file. We strongly recommend providing such a file when getting in touch with our support team, either by e-mail or via our on-line support form, as it significantly speeds up the process of analyzing and resolving your problem.

More detailed information is available here.