Routing Policies

What is a Routing Policy?

A Routing Policy is a set of ordered rules that control how traffic from endpoints in an Endpoint Group is handled. Each rule matches traffic based on criteria you define (destination IP, protocol, port) and specifies what to do with matching traffic: forward it to a Routing Target, drop it, or reflect it to another endpoint.

A Routing Policy does three things:

1. Routes traffic, rules direct packets to the appropriate Routing Target
2. Secures traffic, rules act as a stateful firewall; traffic that matches no rule is dropped by default
3. Enables edge services, the Edge Services tab controls Remote Access and Embedded Terminal capabilities for endpoints using this policy

Routing Policies belong to a VSlice. All Routing Targets referenced in a policy must be in the same VSlice.

How Rules Work

Rules are evaluated top to bottom. The first rule that matches the traffic applies. If no rule matches, the traffic is dropped.

This means:

• Put more specific rules above more general ones
• A "forward all traffic to internet" catch-all rule should be last, not first
• If you want to block specific destinations, put a Drop rule above the catch-all

Rule Fields

Each rule has the following fields. Fields under Show advanced settings are revealed by checking that checkbox in the Match or Action section.

IP Pattern Examples

Port Examples

Ports are entered as comma-separated numerical values. Both Source Ports and Dest Ports accept the same format.

Example Rule Sets

Basic internet access (all traffic to internet)

All outbound traffic goes to internet. Simple and permissive, suitable for development or testing.

Private VPN with internet fallback

Traffic destined for the private data centre subnet goes over VPN. Everything else breaks out to internet.

Private VPN only, no internet access

Traffic to the data centre is forwarded. All other traffic is dropped. Endpoints cannot reach the internet at all.

Vantiq Motors Example Vantiq Fleet uses two Routing Policies in vantiq-fleet:

fleet-road-policy, for HGVs on active routes:

• Rule 1: Uplink to 10.50.0.0/16 → fleet-dc-uk-vpn (telematics to data centre)
• Rule 2: Uplink to 10.60.0.0/16 → fleet-dc-eu-vpn (EU data centre for European routes)
• Rule 3: Uplink all → fleet-internet-eu (firmware updates, driver app)

fleet-depot-policy, for HGVs in depot for maintenance:

• Rule 1: Uplink all → fleet-dc-uk-vpn (all traffic over VPN, no internet)
• Edge Services: Remote Access Proxy enabled (technician can open vehicle diagnostic UI in browser)

Edge Services Tab

The Edge Services tab within a Routing Policy enables advanced access capabilities for endpoints using this policy.

Embedded Terminal

Enables a browser-based SSH terminal to the endpoint device. When enabled, a Connect button appears on the endpoint's Remote Access tab, opening a terminal session in the browser without requiring a VPN client or static IP.

Remote Access Proxy

Proxies HTTP/HTTPS traffic to a web interface running on the endpoint device, making it accessible via a unique URL. No public IP or VPN client needed on the connecting device.

Important prerequisite: You must create at least one Edge Service under Configuration → Edge Services before you can enable Remote Access Proxy here. Without one configured, you will see the error: "You must have at least one remote access proxy configured."

The steps are:

1. Create the Edge Service first (specify the protocol and port the device's web UI uses)
2. Return to this Routing Policy → Edge Services tab
3. Enable Remote Access Proxy and select the Edge Service from the list
4. Save

The proxy URL then appears on each endpoint's Remote Access tab.

Configuration Order

When building your configuration from scratch:

1. Create a VSlice with a subnet
2. Create a Routing Target, start with Internet, no configuration needed
3. Create a Routing Policy, add rules referencing the Routing Target
4. Create an Endpoint Group referencing the Routing Policy
5. Assign endpoints to the group

Where to Find Routing Policies

Navigate to Configuration → Routing Policies.

From this screen you can:

• Create Routing Policies
• Edit existing ones, including adding rules and configuring Edge Services
• Delete those no longer needed

Create a Routing Policy

Prerequisites

You need at least one Routing Target in the same VSlice before you can write useful rules. Create an Internet Routing Target first if you have none, it requires no configuration.

Steps

1. Go to Configuration → Routing Policies.
2. Click the Add button.
3. Fill in the fields below.
4. Click the Create button to save.
5. After creation, edit the policy to add rules and configure Edge Services.

Fields

Next Step: Add Rules

Once you have your Routing policy created, you can add Policy rules to it.

Edit a Routing Policy

Add, reorder, and update rules and edge services.

Steps

1. Go to Configuration → Routing Policies.
2. Click the edit icon next to the policy.

The edit screen has four tabs: Details, Policy Rules, Edge Services, and Advanced.

Details Tab

VSlice cannot be changed after creation.

Policy Rules Tab

Add, edit, reorder, and delete traffic routing rules.

Adding a rule:

1. Click Add Rule. A modal dialog opens.
2. Optionally enter a Description for the rule.
3. The Enabled toggle is on by default. Leave it on unless you want to save the rule in a disabled state.
4. In the Match section, select Direction (Uplink or Downlink) and Protocol (Any, TCP, UDP, SCTP, or ICMP).
5. Apply reflexively is enabled by default. Leave it on in almost all cases.
6. If you selected TCP, UDP, or SCTP, Source Ports and Dest Ports fields appear. Enter comma-separated port numbers (e.g. 80,443) or leave blank for any port.
7. Check Show advanced settings in the Match section to reveal the Apply when endpoint is connected to field. This defaults to Any regional gateway and can be used to restrict the rule to a specific gateway.
8. In the Action section, select Forward, Drop, or Reflect. If Forward, select a Routing Target.
9. Check Show advanced settings in the Action section to reveal DNAT Divert IPv4 Address and DNAT Divert Port for traffic redirection.
10. Click Done.

Rule ordering: Rules are evaluated top-to-bottom. Drag rules to change their order. More specific rules must appear above more general ones. The last rule is often a catch-all: forward all remaining traffic to an internet target, or drop it.

Editing a rule: Click the edit icon on any existing rule.

Deleting a rule: Click the delete icon. Takes effect immediately.

Changes to rules apply immediately to all endpoints using this policy. If any endpoints have active sessions, those sessions are not terminated. Subsequent packets are routed according to the updated rules.

Edge Services Tab

If Remote Access Proxy is enabled with no Edge Services available, you will see: "You must have at least one remote access proxy configured."

Create an Edge Service under Configuration → Edge Services first, then return here to enable and select it.

Advanced Tab

The Advanced tab provides traffic shaping controls for all endpoints using this policy.

Click Save and Apply Rules to save all changes across all tabs.

Delete a Routing Policy

1. Go to Configuration → Routing Policies.
2. Click the delete icon.
3. Confirm deletion.

⚠️

A Routing Policy cannot be deleted while it is assigned to an Endpoint Group. Reassign or delete those groups first.