KBC ThruLink User manual

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
ThruLink Quick Start Guide
Introduction
Welcome to KBC Networks’ Quick Start Guide for
ThruLink. This document has been designed to
provide a step-by-step guide to setting up a
ThruLink server, client and linking them together.
For more detailed information, please see the
Downloads section below.
The KBC ThruLink is an industrial hardware VPN that allows secure communications to be established
over any standard public or private IP network infrastructure. ThruLink performs behind Firewalls,
NAT and through almost any type of network configuration while offering advanced encrypted
communication for all IP protocols regardless of the type of traffic. When deployed, ThruLink provides
an advanced secure and encrypted private network that will not affect TTL, UPnP, VLAN information,
broadcast, multicast or any other traffic. ThruLink can also be provided with an integrated 3G/4G
modem that supports all primary network providers.
Features
•Multiple hardware encryption engines ranging in complexity from 128 to 256bit
•Encryption throughput models: SC (Standard Capacity): 15Mbps, SP (Standard Capacity
Plus): 30Mbps, HC (High Capacity): 100Mbps, HP (High capacity Plus): 200Mbps
•Optimized for stability, reduced latency of large packet streams over Public networks.
•Automatically switch between GSM and LTE networks for best performance.
•Supports MESH topology –no central server required.
•Hardened against DOS and known common network attacks.
•Level 2 and Level 3 capable device.
•Auto re-syncing/authentication after a network failure, enabling a self-healing
Encryption tunnel network.
•Support Multiple failover paths
•Multiple networks can flow separately or combined over the same encryption tunnel.
•Simplified installation.
•Easy-to-use graphical user interface.
•Can be installed within an existing network infrastructure.
Downloads
Full specifications, features and additional support information can be found on the relevant product
page within the KBC Networks site: www.kbcnetworks.com.

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 2of 12
General
Check the product upon receipt for any visible damage which may have been caused during shipping.
System Contents
Connecting to ThruLink
Note: Please ensure the wireless connection on your computer is disabled while carrying out this
procedure. For each ThruLink in the setup, follow the instructions that fit the setup requirement
(Server or Client). The default topology is “route” mode, if requiring MULTICAST or any other LAN
designed protocol, you will require “bridge” mode to be the topology. Additional support documents
and contact information can be found on the KBC Networks website.
Important: Plan your implementation before you start. Each ThruLink needs to have a “logical” name
and chosen IP address subnet within a Class that hasn’t already been used on the network.
By default, ThruLink runs a DHCP service on the LAN port for convenience and is within the network
range of 193.163.1.0/24 (ThruLink LAN IP is 193.163.1.1)
1. Connect an appropriate RJ45 Ethernet cable to ThruLink WAN port. Normally, this is an
active cable supplied by your network admin and allows ThruLink to make use of the
existing network.
2. Connect power to the ThruLink unit.
3. Set the local port on your PC to DHCP.
4. Connect an Ethernet cable between your PC and ThruLink LAN port.
5. After a short time, ThruLink will provide an IP Address.
6. Open a browser on the PC, type http://193.163.1.1 in the address field and press enter.
7. You will be prompted for the username and password and the default is set to
admin/admin.
8. The next section is only relevant if you are using the most up to date version of ThruLink
6.1.0.18 or greater. If you are using an older version you may not see this next section,
however it would be advisable for you to contact your nearest KBC office and ask them
how to download the latest firmware version.
Qty
Description
1
ThruLink unit
1
12Vdc Power supply for Standard/Standard Plus units*
1
Power cable for High/High Plus units**
1
Antenna***
1
Quick Start Guide
* Standard Capacity and Standard Capacity Plus units only
** High Capacity and High Capacity Plus units only
*** LTE units only

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 3of 12
ThruLink GUI Default Password Change Policy
It is good practice to change the default password for the Graphical User Interface (GUI), even though
this interface isn’t available by default on the WAN segment. In order to facilitate this requirement,
the force password change policy has been implemented on all version of ThruLink installed with
version 6.1.0.18 onwards. This policy is only executed when in factory default mode and won’t affect
any existing unit that upgrades to the latest version while maintaining their existing configuration.
The NEW password policy also has restrictions on characters that can be used. Any alpha numerical
characters and any of the following special characters can be used in the passphrase ! $ % ^ @ * ? #
As soon as the password has been changed you will be requested to login again with the new
password.

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 4of 12
When your screen looks similar to the one below, you are connected to the ThruLink Web GUI and
ready to start the configuration.
Configuring ThruLink
Configuring ThruLink as a Server
Important: Ensure the steps in ‘Connecting to ThruLink’ have been followed.
1. Click ‘GENERAL->Configuration’ menu link on the left and give ThruLink a unique name
in the Hostname field (every ThruLink on the network requires a unique name).
2. Click ‘Save Update’ at the bottom of the page.
3. Click ‘NETWORK->Interfaces’ menu link, set the WAN interface to ‘static’ (default is
DHCP).
4. Configure the WAN interface IP address, Subnet and Gateway so that it places ThruLink
onto your local network.

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 5of 12
Notes:
•The WAN IPV4 address needs to be an IP address that is not already used on the
local network.
•The default gateway IP will either be the router or gateway switch on your local
network.
•The LAN interface represents your private and secure network. The default range on
ThruLink is 193.163.xxx.xxx, which you can change to conform to your own network
requirements; however, for purposes of this guide we will leave the default IP in
place for the server.
5. Click ‘Save Update’.
6. Click ‘Reboot system’ on the lower left menu and wait for about 1 minute.
7. Log back into the system with either the same IP or the IP you changed it to (if you
forgot the IP address, open a command prompt and type ‘ipconfig’. The IP address
should be the gateway address shown if DHCP on the LAN interface is still enabled).
8. Click on ‘NETWORK->Interfaces’ and confirm it looks similar to the image below (your
WAN IP Address may not be the same as the below image).
9. Click on ‘NETWORK->Encryption tunnel’ menu link on the left.
10. Click the ‘Enabled’ checkbox at the top and select ‘Server’ to the right.
11. Leave the default Preshared Key ‘PSKPSKPSK’ for the setup.
Note: Please remember to change this value when implementing this system within a
LIVE environment to something more complicated. Any ASCII character is supported
except the space character.

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 6of 12
12. Leave the ‘Encryption’ set to ‘AES-128’ for this setup.
13. Leave the ‘Mode’ setting (default: Route).
14. Leave the ‘Port’ setting (default: 32000).
15. Click ‘Save update’ and confirm your configuration is the same as the following image:
16. Click ‘STATUS->System’ menu on the left. You should have a similar indicator like the
following image:
Configuring ThruLink as a Client
Important: Ensure the steps in ‘Connecting to ThruLink’ have been followed.
1. Click ‘GENERAL->Configuration’ menu link on the left and give ThruLink a unique name
in the Hostname field (every ThruLink on the network requires a unique name).
2. Click ‘Save Update’ at the bottom of the page.
3. Click ‘NETWORK->Interfaces’ menu link on the left and ensure the ‘WAN Interface’ is set
to DHCP (assuming it is connected or will be connected to a network that can supply
DHCP).
4. Set the ‘LAN interface’ to 193.163.2.1 (or a unique subnet of your choosing).
5. Click ‘Save update’ (you will be prompted to reboot the unit).

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 7of 12
Note: The DHCP Server is enabled and the IP range will change to reflect LAN IP address
used.
6. The unit will function after about 1 minute.
7. Log back into the system with either the same IP or the IP you changed it to (if you
forgot the IP address, open a command prompt and type ‘ipconfig’. The IP address
should be the gateway address shown if DHCP on the LAN interface is still enabled).
8. Click on ‘NETWORK->Interfaces’ and confirm it looks similar to the following image:
9. Click on ‘NETWORK->Encryption tunnel’ menu on the left.
10. Click the ‘Enabled’ checkbox at the top and select ‘Client’ to the right of it.
11. Leave the default ‘Preshared key’ (PSKPSKPSK) for this setup.
Note: Please remember to change this value when implementing this system within a
LIVE environment to something more complicated. Any ASCII character is supported
except the space character (all units must have the same key).
12. Type in the name of the server in the ‘Remote host’ field.
13. Type in the Public IP address of the router the server is connected too in the ‘Remote
connection’ field. (if performing this on a local network then type in the static IP
address that was configured on the server).
14. Leave the ‘Encryption’ field set to ‘AES-128’ (128 bit).
15. Select ‘Route’ or ‘Bridge’ mode as set in the Server configuration (default: Route).
16. Set the ‘Port’ field the same as the Server configuration (default: 32000).
17. Click ‘Save update’ at the bottom of the page and confirm your setup is the same as
the following image.

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 8of 12
Note: The connection status between the Client and Server can be viewed via the ‘STATUS->System’
menu (i.e. ‘Enabled and actively connected to UKDEMOSVR’, while ‘STATUS->Tunnel information’ and
‘STATUS->Active subnets’ show all ThruLinks on the secured encryption network.
Configuring ThruLink LTE as a Client
Important: Ensure the steps in ‘Connecting to ThruLink’ have been followed.
Ensure the DATA SIM has been inserted in the SIM slot before powering up the unit.
1. Click ‘GENERAL->Configuration’ menu link on the left and give ThruLink a unique name
in the Hostname field (every ThruLink on the network requires a unique name).
2. Ensure ‘Cellular Radio Cards’ is enabled.
3. Click ‘Save update’ at the bottom of the page and confirm your setup is the same as the
following image:

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 9of 12
4. Click ‘NETWORK->Interfaces’ menu and set the ‘Sim PIN number’ field if you were
provided with a SIM PIN.
5. Set the ‘APN (Access Point Name)’ field. This can be supplied by your provider or
contact support for help, or you may find it on our APN list at the following address –
https://www.kbcnetworks.com/apns
6. Set the ‘Username and Password’ fields if you were provided this information (typically
not required).
7. Set the ‘Dial code’ if connected to a GSM CDMA only network (default value is suitable
for most LTE networks).
8. Set the ‘LAN interface’ to 193.163.3.1 (or a unique subnet of your choosing).
11.Click ‘Save update’ (you will be prompted to reboot the unit).

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 10 of 12
Note: the DHCP Server is enabled and the IP range will change to reflect LAN IP address used.
12. The unit will function after about 1 minute.
13. Log back into the system with either the same IP or the IP you changed it to (if you
forgot the IP address, open a command prompt and type ‘ipconfig’. The IP address
should be the gateway address shown if DHCP on the LAN interface is still enabled).
14. Click on ‘NETWORK->Interfaces’ and confirm it looks similar to the following image:
15. Click on ‘NETWORK->Encryption tunnel’ menu on the left.
16. Click the ‘Enabled’ checkbox at the top and select ‘Client’ to the right of it.
17. Leave the default ‘Preshared key’ (PSKPSKPSK) for this setup.
Note: Please remember to change the preshared key value when implementing this system
within a LIVE environment to something more complicated. Any ASCII character is supported
except the space character (all units must have the same key).

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 11 of 12
18. Type in the name of the server in the ‘Remote host’ field.
19. Type in the Public IP address of the router that the server is connected to in the ‘Remote
connection’ field. (if performing this on a local network then type in the static IP address that
was configured on the server).
20. Leave the ‘Encryption’ field set to ‘AES-128’ (128 bit).
21. Select ‘Route’ or ‘Bridge’ mode as set in the Server configuration (default: Route).
22. Set the ‘Port’ field the same as the Server configuration (default: 32000).
23. Click ‘Save update’ at the bottom of the page and confirm your setup is the same as the
following image:
Note: The connection status between the Client and Server can be viewed via the ‘STATUS->System’ menu (i.e.
‘Enabled and actively connected to UKDEMOSVR’, while ‘STATUS->Tunnel information’ and ‘STATUS->Active
subnets’ show all ThruLink units on the encrypted ThruLink network.
Port Forwarding between Internet Router and Server
If an Internet facing router is being used on your network, then a Port forwarding rule will need to be set in
order to allow data packets to flow between the Internet and the ThruLink Server. This is called Port
Forwarding.
Port forward rule
Every IP network process uses one of the 65535 available ports to communicate, e.g. The general HTTP protocol
makes use of port 80 and FTP is port 21. The default port used for the ThruLink is 32000, which can be changed
to suit your own port preference. In order for the remote ThruLink clients to be able to authenticate with the
ThruLink Server, you need to forward port 32000 (or your preferred port) to the WAN IP address of the ThruLink
Server. You will need to ensure both TCP and UDP ports are forwarding, and if possible, maintain 2 separate
rules rather than one rule for both.
If you change the port default to any other port, please remember that all ThruLink units, including the server,
must be using the same changed port.

QSG-THLK_Series-Rev2004
Copyright © KBC Networks Ltd. 2020 www.kbcnetworks.com
Page 12 of 12
If working with multiple remote clients
If you are working with multiple remote clients, to ensure there are no simple typos or errors in the
configuration, it is advisable to follow the following simple steps.
1. Create a document with the name and LAN IP address used on each of the ThruLink units
2. Configure a single client and confirm it is connecting correctly. You should see a statement similar to
the pink line below where it states the connection
3. Go to the Backup/Restore on the working client and make a backup copy of the configuration (note this
is encrypted for security)
4. Power on and log into the new client
5. Go to Backup/Restore and restore the backup from the previous unit (this will force a restart)
6. Please remember to try and access the unit with the new LAN IP, not the default
7. Go to the configuration page and change the hostname of the new client (client2 etc)
8. Click Save update at the bottom
9. Go to the Interfaces page and change the LAN IP
Notes:
•In bridge mode, the IP will remain in the same subnet but not be a conflicting IP
•In route mode, the subnet needs to be unique.
•The default 193.163.1.1/255.255.255.0 is one unique subnet. On the second unit, this would be
changed to 193.163.2.1/255.255.255.0 to ensure it is a unique subnet
10. Click save update and again the unit will request a restart.
11. Once restarted, log back in with the now new IP and test to ensure it also now connect.
12. Repeat this process for each client, ensuring you make a note of the name and corresponding LAN IP
The configuration of the setup, according to this guide, is complete!
Warranty
Warranty information can be found at www.kbcnetworks.com.
Need Help/Troubleshooting?
Visit our website http://www.kbcnetworks.com or
contact your nearest KBC office or dealer:
APAC:
Phone: [phone]
Email: [email protected]
EMEA:
Phone: [phone]
Email: [email protected]
USA:
Phone: [phone]
Toll Free: [phone]
Email: [email protected]