Configuration of the proxy for a gateway connection to the telematics infrastructure
Last adaptation to the version: 14.1.0 (08.2025)
New:
- BetaFor participants on the Beta Channel only:
- The TI-Proxy now also supports terminals in different local networks
- The field for the ‘'Outgoing IP’' has been removed
- [TIP Proxy Assistant
- Bei Anbindung über WireGuard können Rekey After Time und Reject After Time eingestellt werden (v14.0.1)
This article refers to a Beta version
Introduction
The TI proxy can be used to enable secure communication between card terminals and TI connectors of the telematics infrastructure. The proxy forwards the terminal's data traffic via a WireGuard tunnel to a cloud gateway that manages access to the telematics infrastructure.
TI Proxy Wizard
Step 1 - Import configuration
Step 1 Import configuration
| Caption | Value | Description | UTMuser@firewall.name.fqdnApplicationsTI Proxy  Step 1 - Import configuration
|
|---|---|---|---|
| Files: | No files selected. | If available, configuration files can be uploaded here | |
| WireGuard configuration: | [Interface] Address = 203.113.0.113/32 ListenPort = 51820 ... |
Inserting/uploading the configuration information for WireGuard from the config file | |
| TI-Proxy Configuration: | tiaas: wireguard: ip: 203.113.0.113 ... |
Inserting/uploading the configuration information for the TI proxy from the config file | |
Step 2 - InterfaceStep 2 Interface
| |||
| Interface: | wg0 | Used WireGuard Interface |  |
| Name: | wireguard-interface-wg0-ti-proxy | Name of the WireGuard Connection | |
| IPv4 address: | IPv4 address in the transfer network for the local network interface | ||
| IPv6 address: | IPv6 address in the transfer network for the local network interface | ||
| Listening Port: | 51820 | Port of the WireGuard Connection | |
| Private Key: | Private key of the WireGuard connection | ||
| Release server networks globally: | Networks that are to be enabled for the WireGuard connection. Not required here. | ||
Step 3 - PeerStep 3 Peer
| |||
| Peer type: |  | ||
| Name: | wg0-peer-1 | Name of the Peers | |
| Release peer networks: | »192.168.12.0/24»192.168.13.12/30»192.168.13.16/30»192.168.13.24/30 ... | Networks of the peer that are to be released | |
| Endpoint: | 203.113.0.113 | Public IP address under which the WG tunnel for the connector is received | |
| Endpoint Port: | 60010 | The corresponding port | |
| Open Key: | Public key of the peer | ||
| Pre-Shared Key: | Pre-shared key to further secure the connection | ||
| Keepalive: | On 25 Seconds | Sends a signal regularly. This keeps connections on NAT routers open. | |
Step 4 - TI ProxyStep 4 TI Proxy
| |||
| Connector IP: | IP address of the connector that enables the connection to the telematics infrastructure usually a private IP address from a VPN |
 | |
| Incoming IP: | IP address of the WG interface | ||
Step 5 - Advanced SettingsStep 5 Advanced Settings
| |||
| Create routes to the peer's networks: | Yes | Routes are created to the networks/hosts that were entered in step 3 under ‘'Enable peer networks’', with the interface that was displayed in step 2 as the gateway. |  |
| Create zones: | Yes | Creates new zones for the WireGuard interface | |
| Zones: | wireguard-wg0 firewall-wireguard-wg0 |
Name of the new Zone | |
| Create network objects for the peer: | Yes | Creates network objects for remote station | |
| Network objects for the peer: | »wg-net-wg0-peer-1-1»wg-net-wg0-peer-1-2»wg-net-wg0-peer-1-3 ... |
Network objects that are created for the remote station. The automatic proposal can also be changed. | |
| Network group: | wg0-networks | Name of the network group of the connection is displayed | |
| Create rules between the peer and internal-networks: | Yes | Generates autogenerated rules that facilitate commissioning | |
| Control group: | wg0-network | Name of the control group is displayed | |
General Configuration
General
| Caption | Value | Description | UTMuser@firewall.name.fqdnTI-Proxy  General configuration of the TI proxy
|
|---|---|---|---|
| Connector IP: | IP address of the connector that enables the connection to the telematics infrastructure usually a private IP address from a VPN | ||
| Incoming IP: | 203.113.0.113 (A0) | IP address of the interface of the UTM that establishes the connection to the connector | |
Connection to a connector via WireGuard (incoming IP)notemptyThis variant is the standard configuration in practice.
| |||
| Connector IP: | IP address of the connector that enables the connection to the telematics infrastructure usually a private IP address from a VPN |
 | |
| Incoming IP: | 10.0.2.1 (wgx) | Tunnel IP address of the WG interface that establishes the connection to the connector | |
| Rekey After Time: | 120 Seconds | Defines the period of time after which a new key agreement (rekeying) is to be carried out. (Minimum: 120 seconds) | |
| Reject After Time: | 180 Seconds | Defines the period of time after which a peer is considered inactive after the last packet received and packets are discarded.(Minimum: 180 seconds) | |
Configure card terminal proxy
Card terminal proxy
| In the card terminal proxies area, add a proxy for a card terminal as follows: | |||
| Caption | Value | Description | UTMuser@firewall.name.fqdnApplicationsTI-Proxy  Add card terminal proxy dialog
|
|---|---|---|---|
| Card terminal IP: | IP address of the card terminal in the internal network | ||
| Card terminal port: | 4742 | Port of the card terminal via which communication takes place | |
| Incoming and outgoing port: | 60000 | Port on which the UTM receives the data packets | |
| Configuration with the button Save and close | |||
|
UTMuser@firewall.name.fqdnApplications 
| ||