IT Security Overview

This document provides an overview of the FastRTK Base Station's network services, security measures, and recommended network configurations for IT administrators.

Network Services

The FastRTK Base Station runs three primary network services:

NTRIP Caster (Port 10000/TCP)

The NTRIP (Networked Transport of RTCM via Internet Protocol) caster is the primary service for delivering GPS correction data to end users.

Property	Details
Port	10000/TCP
Protocol	HTTP-based (NTRIP 1.0/2.0)
Authentication	HTTP Basic Auth (username/password sent in the Authorization header)
Data	Binary RTCM 3.x correction messages streamed over a persistent TCP connection

Rovers periodically transmit their approximate position to the caster via a $GPGGA sentence so the caster can deliver the optimal correction stream.

Security measures:

• Individual user accounts with expiration dates
• Connection limiting per user
• IP-based access logging
• No sensitive data transmitted (GPS corrections only)

Web Server (Ports 80/443)

The administrative web interface for system configuration and monitoring.

Property	Details
Ports	80 (HTTP, default), 443 (HTTPS, disabled by default)
Protocol	HTTP, or HTTPS with TLS once enabled
Authentication	Session-based with admin credentials
Purpose	System administration only

By default the admin UI is served over HTTP on port 80. HTTPS on port 443 is reserved for encrypted access but is disabled by default — enable it (and install a certificate) before exposing the admin UI beyond a trusted network.

Security measures:

• Optional HTTPS/TLS for encrypted admin traffic
• Session timeout after inactivity
• Single admin account with configurable password
• Admin interface can be disabled for public-facing deployments

SSH Server (Port 2525/TCP)

Remote terminal access for advanced configuration and troubleshooting.

Property	Details
Port	2525/TCP
Protocol	SSH2
Purpose	Remote maintenance

Security measures:

• Non-standard port reduces automated scanning and bot log noise
• Can be disabled entirely by blocking port 2525 if remote access isn't required
• Whitelist support IPs at the firewall for additional protection
• Root access disabled by default

Firewall Configuration

The base station's on-device firewall operates on a deny-all principle: all traffic is blocked by default, and only the ports required for the services above (10000, 80, 443, and 2525) are explicitly allowed.

Inbound Rules (Required)

Port	Protocol	Source	Purpose
10000	TCP	NTRIP Users	GPS corrections
443	TCP	Admin IPs	Web admin (HTTPS)
2525	TCP	Admin IPs	SSH access

Network Configuration Options

Option 1: LAN Isolated

Place the base station on the LAN but restrict its exposure. Two common variants:

1a. VLAN segmentation — the base station sits on a dedicated VLAN with controlled access to the rest of the network and the internet.

Internet ─── Firewall ─── VLAN 100 (Base Station)
                    └─── VLAN 200 (Corporate)

1b. Fully disconnected from the internet — the base station is on the LAN but blocked from inbound and outbound internet traffic by firewall rules or physical segmentation. Field rovers on cellular reach it via VPN.

Pros:

• Maximum isolation — limited exposure to external threats
• Granular firewall control
• Easy to audit and monitor

Cons:

• VLAN variant requires VLAN-capable infrastructure
• Disconnected variant blocks remote monitoring, FastRTK monitor services, and remote support; cellular rovers need a VPN to connect

Option 2: Port Mapping (Small Deployments)

Use NAT port forwarding on an existing router.

Internet ─── Router (NAT) ─── Base Station
              │
              └── Port 10000 → 192.168.1.100:10000

Pros:

• Works with existing infrastructure
• Simple to configure
• No additional hardware needed

Cons:

• Base station shares network with other devices
• Less isolation

Option 3: Cellular Modem (Remote Sites)

Use the built-in or external cellular modem for connectivity.

Internet ←── Cellular ─── Base Station

Pros:

• No site infrastructure needed
• Works in remote locations
• Carrier provides firewall

Cons:

• Monthly data costs and SIM subscription management
• Dependent on cellular coverage
• Higher latency
• In standalone mode the SIM must be provisioned with a public static IP to accept incoming NTRIP/admin traffic — these SIMs can be harder to obtain and configure

Security Best Practices

1. Change default passwords immediately upon installation
2. Use HTTPS for all administrative access
3. Limit admin access to specific IP addresses when possible
4. Enable automatic updates to receive security patches
5. Monitor logs for unusual access patterns
6. Use strong passwords for NTRIP user accounts
7. Set account expirations for temporary users
8. Disable unused services (SSH if not needed)

Compliance Notes

• The FastRTK Base Station does not store or process personal data
• GPS correction data is not considered sensitive information

Support

For security-related questions or to report vulnerabilities, contact FastRTK support through the DMG Knowledge Base.