A narrow host
The tunnel carries the agreed authorisation point, not “internet for the till”.
Payment terminals
A terminal on the counter is not a server on the internet.
It needs the authorisation host agreed with the acquirer. It does not need the rest of the network. The same layout covers an ATM, a ticket machine and a parcel locker: a fixed address and a narrow path to supervision.
ExampleExample: a chain of 50 shops. Each has one terminal on a SIM in the private APN. An illustrative scenario, not a client reference, and not a promise that every acquirer will accept the path — we check the host path in the design.
Request a proposal APN types and connection types +48 698 355 667
A separate subnet
A failed or compromised camera does not open the terminal.
One SIM fleet
Suspending a SIM takes the shop off the APN without a site visit.
What bounces off the edge
A terminal with a route to the internet can be scanned together with the till and the camera if they share one flat shop network.
The SIM asks for your APN. Traffic to the host goes through the tunnel to the point you agree. The till and the cameras do not share a subnet with the terminal. In the shop the edge is often a Peplink router when the same site also has link backup.
Security
- No public address on the terminal.
- Only this fleet’s SIMs are on the APN list. IMEI binding where the operator has it.
- A firewall rule: the terminal sees the host, not the whole of headquarters.
A chain of shops can be part of the service of an entity covered by KSC. Segmenting terminals is a technical measure. We do not decide whether a retailer is in scope.
Peplink · SpeedFusion · InControl 2 Starlink How it works
Request a proposal APN types and connection types +48 698 355 667
Related
On the same path
-
MDM and private APN
Enrolment, the profile, and a console reached only from the APN.
-
FAMOC
FancyFon’s console on a phone or terminal that is already on the APN.
-
Samsung Knox
KME enrolment, Knox Manage policy and a Knox Configure role.
-
Android zero-touch
The reseller adds a company Android device before people receive it.