Advanced TI Proxy Configuration

TI proxy with routed networks

New with Securepoint: 09.2026

notempty

This article refers to a Beta version

Introduction

The TI proxy forwards data traffic from card terminals to the telematics infrastructure via WireGuard. The basic steps for this are described in the article on proxy configuration.
However, this default configuration only works with terminals on local networks. For routed networks such as VPNs or site-to-site connections, manual configuration is required.
This article describes the necessary steps for such scenarios.

Supported scenarios

The following network scenarios are supported:

Routed networks (VPN): Terminals are located in a network that is connected to the UTM via a VPN tunnel. The article IPSec site-to-site connection provides guidance on establishing a permanent connection between two sites.
- Example: A UTM A establishes a connection via an SSL VPN connection to a UTM B, to which a card terminal is connected

Site-to-site connections: Terminals at branch offices are connected via a site-to-site connection
- Example: Head office with a UTM and a branch with a local terminal
Roadwarrior connection: Mobile terminals connect to the UTM via a VPN client. Details on setting up mobile workstations or laptops in a home office can be found in the article SSL VPN Roadwarrior.
- Example: A laptop with VPN access that functions as a card terminal.

Requirements

The following prerequisites must be met for configuration:

TI-Proxy version 14.0.9 or later, as this version introduces support for terminals on different local networks
An already configured VPN or site-to-site tunnel between the UTM devices or sites, via which the terminals are to be connected

Configuration

notempty

Card terminals in routed networks (e.g. VPN) cannot be configured directly via the TI proxy. Manual routes and firewall rules are therefore required (see Creating routes and Firewall rules).

Network development

The following example describes a network configuration with two UTMs.

UTM 35 (terminal side / VPN client): A card terminal with the IP address 192.168.35.177 (port 4742) is connected to this UTM via DHCP. It makes its internal network (192.168.35.0/24) available for the VPN tunnel.
UTM 85 (connector side / VPN server): This UTM establishes a WireGuard connection to the connector (10.180.96.90).
VPN connection: Both UTMs are connected to each other via an SSL VPN tunnel within the 172.199.1.0/24 network. The UTM85 acts as the server (IP .1), whilst the UTM35 acts as the client (IP .2).

Create routes

To enable data traffic between the networks, a route to the VPN tunnel network must be created on the UTM 35 (terminal side).
The article Ethernet Interfaces explains how interfaces are generally managed. The route is configured as follows:

Destination: 172.199.1.0/24
Gateway / Interface: tun0 (VPN interface to the client UTM)

Firewall rules

notempty

The TCP component in ctproxy is disabled. Communication between the connector and the terminals takes place via the firewall rules. Further information on this can be found in the article on rulerouting.

On the UTM 35 (Terminal page), rules must be created for data traffic from the VPN tunnel to the internal network:

Option 1 (simple, insecure): VPN tunnel network (172.199.1.0/24) ➔ internal network ➔ Any ➔ ACCEPT
Option 2 (recommended”'): VPN tunnel network (172.199.1.0/24) ➔ internal network ➔ TCP port 4742 / UDP port 4742 ➔ ACCEPT

On the UTM 85 (connector side), a rule must be created for traffic from the connector to the remote terminal network:

Connector (10.180.96.90) ➔ remote terminal network (192.168.35.0/24) ➔ TCP 4742 service ➔ ACCEPT

UDP is handled by the TI proxy itself.

notempty

A separate UDP rule is not required on the UTM85 for this step; the TI Proxy handles this automatically