...
This is the default implementation for Operators.
No dedicated VPN routers required/deployed for network attached BATMs.
The OpenVPN software is configured via batm-manage.
...
Scenario B (dedicated hardware)
...
The VPN configuration is not distributed by CAS.
This scenario is considered more secure than Scenario A.
...
Scenario “B” Requirements
Set the variable
batm.vpn-skiptotruein the file/batm/config/gate.propertiesDisables VPN distribution via the gate service.
Connect your BATMs to the hardware VPN.
Connect your hardware VPN to your CAS server (or server-side VPN).
The BATMs must be able to communicate with
the Gate service on the port 7741, and
the Master service on the port 7741.
The Gate and Master services use their specific IP addresses, and
the Gate service must be able to communicate with the Master service (via port 7747)
...
Notes
Gate service
The Gate service listens for your terminals' pairing requests. After a successful pairing, the gate service sends the terminal the VPN configuration, including information on how to connect to the master service.
Prior to pairing, the terminal's VPN configuration must (normally) already have been generated.
...
| Note |
|---|
The Gate service is only compatible with terminals running on version 20230801 and newer!
|
The Gate service configuration
...
/batm/config/network
The example below demonstrates that every individual service has its own bind IP address. During installation, a default configuration will be created upon the initial execution of batm-manage start
| Code Block |
|---|
public_ip=1.2.3.4
master_bind_ip=10.3.2.1
gate_bind_ip=10.3.1.1
admin_bind_ip=10.3.2.2 |
/batm/config/gate.properties
Basic properties fully functional will be generated by the first batm-manage start gate (or all when it comes to gate service)
However, gate service can be further configured by following properties:
...
batm.processing-slots
optional, default value:
20this property is used to throttle upgrade traffic so server won’t be overloaded by too many terminals downloading upgrade packages at a time
...
batm.download
optional, default value:
/batm/app/shared/location where the terminal upgrade package used to upgrade terminals to version
20230801will be located, the package will be downloaded once and then reused for all terminalsmake sure the location has the correct permission and is accessible to
batmgateuser
...
batm.master.hostname
optional. by default gate service distributes to terminal master_bind_ip as a target to connect to master service.
batm.master.hostnameallows you to set FQDN that would be sent to the terminal.
batm.vpn-skip
...
optional, default value: false
this property indicates to gate service that it is not going to distribute VPN configurations to the terminals (because of Deployment Scenario B: value is true ) and therefore it is not a problem when VPN configuration is not found on drive and this step can be skipped.
Master service
Listens to terminal’s requests. Answers only terminal requests file is fully described here: https://generalbytes.atlassian.net/wiki/x/CYBtz
Master service
The Master service communicates with your BATMs. It replies only to BATMs/terminals that are coming from trusted ( paired ) terminals.
The Master service uses
batmmasterunix user, which is a member of thebatmgroup.The Master service
...
listens on port 7741.
Please note that the same port uses gate service but on a different interface.
| Note |
|---|
The Master service should never be exposed to the Internet. |
Admin service
Listens to user's The Admin service listens for users' browser requests. Enables It enables CAS users to configure ATMs remotely and inspect processed transactions.
The Admin service uses
batmadminunix user, which is a member of thebatmgroup.The Admin service
...
listens on port 7777.
| Note |
|---|
The Admin service should never be exposed to the Internet. |
...
A very powerful way for extending the existing functionality of the server. More can be read here.
More about extensions: