Zyxel 3G / 4G (LTE) Devices - Cards, Dongles, and VPN Connections

Mobile operators typically assign a private IP address from the 10.x.x.x range to a mobile client using a 3G or 4G connection. These IP addresses are part of the private address space as defined by RFC 1918, which means they are not routable on the public internet. As a result, the mobile provider uses Network Address Translation (NAT) to convert these private IP addresses to a public IP address, allowing multiple clients to share a single public IP address when accessing the internet.

This setup works well for general web surfing and most internet activities, but it introduces challenges when trying to directly access a device connected via 3G/4G from the internet. Since the device is behind NAT, it cannot be reached directly from the outside world.

Implications for VPN Connections

When setting up a Virtual Private Network (VPN) over a 3G/4G connection, it is crucial to account for the NAT environment. VPNs that rely on protocols like IPSec can be affected by NAT because these protocols were originally designed for a direct, end-to-end connection.

IPSec VPNs with Internet Key Exchange version 1 (IKEv1) require special considerations in such environments. Specifically, you must enable NAT Traversal (NAT-T), which encapsulates the IPSec packets within UDP to pass through NAT devices. Alternatively, using Internet Key Exchange version 2 (IKEv2) can simplify the configuration as it inherently supports NAT traversal, improving compatibility and security.

In all cases, when a device on a 3G/4G connection needs to establish a VPN tunnel, the device must be the one initiating the connection due to the NAT constraints. This ensures that the VPN server is aware of the client’s IP address and can establish a secure communication channel.

Case Study: Sunrise Mobile Operator

For business customers using the Sunrise mobile network, there is an option to request a public, dynamic IP address specifically for VPN services. This service enables the client to bypass the NAT restrictions that come with a private IP address, allowing for a more straightforward VPN setup.

To utilize this service:

1. Request Activation: Business customers need to contact Sunrise to request the activation of a public dynamic IP address for their VPN service.
2. Change APN Settings: Once the service is activated, the Access Point Name (APN) on the mobile device must be changed to "remote." This setting instructs the mobile network to assign a public IP address to the device instead of a private one, eliminating the need for NAT traversal in the VPN configuration.

This service is particularly useful for businesses that require reliable and secure VPN connections for remote workers who are frequently on the move and rely on mobile internet for connectivity.

Additional Considerations

• Security Implications: Assigning a public IP address to a mobile device can expose it to potential security threats from the internet. Therefore, it is crucial to ensure that strong security measures, such as robust firewalls and up-to-date antivirus software, are in place on devices using public IPs.
• IPv6 Considerations: With the gradual adoption of IPv6, some mobile operators may offer IPv6 addresses that do not require NAT. IPv6 can simplify VPN configurations since each device can have a unique, globally routable IP address, eliminating some of the complexities associated with NAT.
• APN Settings: Different mobile operators have specific APN settings that must be configured for various services. It's important to ensure that the correct APN is used for the desired service, as incorrect settings can lead to connectivity issues.
• Alternatives to IPSec: While IPSec is widely used, other VPN protocols like OpenVPN or WireGuard can offer greater flexibility and easier NAT traversal. These protocols are often easier to configure on devices that frequently change networks or operate behind NAT.

Conclusion

Using 3G/4G connections for VPN access is common, especially in scenarios where wired internet connections are unavailable or impractical. However, the use of private IP addresses and NAT by mobile operators introduces additional configuration steps to ensure reliable and secure VPN connections. By understanding these nuances and properly configuring the VPN and mobile devices, businesses and individuals can achieve effective and secure remote access over mobile networks.