how to network a receiver to a public server

Question

My company use sensors on doors to track activity and access control on the doors for many sites throughout the UK. We need to log this activity by sending UDP packets from the sensor's receiver to the public server via a 4G router where the data will be received and access control logs will be saved.

We had a solution were the receiver was programmed to send the data to the public servers static IP address and the router was set as the default gateway, therefor when the server was not found on the network it would be sent to the router and then sent to the server. However this means that if we changed server IP address we would have to reprogram every receiver we use in the UK on site which is not good practice.

Because of this we need a solution that comes from a routing rule of sorts that sends all data from the receiver to the public IP address of the server so that we can change the routing config remotely.

Any help would be appreciated

Answer 1

I think you are approaching the problem from the wrong direction.

DNS is the known proven solution to decoupling the IP address/physical machine a service is provided on. Trying to re-invent a solution to this problem at a network routing level is not the right way forward.

Secondly using UDP packets over the general Internet to try and deliver data that should not be lost (if it can be lost, what's the point of trying to collect it in the first place?). Also given the context it is possible that this data may be potentially sensitive in nature. Unless the content is encrypted and also contains things like timestamps then there is nothing to stop an adversary replaying or faking messages as well as spoofing UDP src addresses is trivial (see the majority of DDoS attacks).

Firewalls can be set up to only allow traffic that is initiated from with in the network and to only allow access to trusted srcs for things like DNS

I suggest you look at the following:

1. Running a VPN on your router/gateway. This means all traffic is encrypted and will terminate inside your network.
2. Look at getting a custom/private APN (e.g. from O2) from your Cellular network provider. Again this means that all the traffic will terminate within your network. While not encrypting the traffic it is not exposed to the Internet and you don't have to run the receiving server exposed to the world.