BlastShield Documentation

Note 1: a USB interface is required to connect the boot media.

Note 2: size the appropriate number of NICs for your Gateway application.

Note: a USB interface is required to connect the boot media.

If you have received a registration URL then use this method to register: Step 2 - Register with your BlastShield™ Network

If you have not received a registration URL, then contact us here: https://www.blastwave.com/contact

This behavior can indicate that your firewall or web proxy is blocking outbound traffic. Please check the following:

If you have verified that the outbound traffic is allowed on your network, please check on your computer that your host AV or endpoint security software is not blocking the BlastShield™ Client from running.

If you see the "Failed to create private key in secure enclave" warning in the BlastShield Mobile Authenticator app, it commonly means that there is no screen lock configured on the mobile device (i.e. no passcode and no face id/touch id).

To resolve this, make sure that the screen lock is enabled on the phone.

If, when starting the connection process, you see an error message on the Desktop client indicating it failed to connect to the authentication server due to a problem with the server certificate: -

This indicates that there may be an SSL web proxy or similar device inspecting the traffic. The following domains must be bypassed from the proxy:

auth.blastwave.io and lighthouse.blastwave.io

If the authentication step used to work for a user, but subsequently stops working, this can be due to an invalid or missing key. If a key has become invalid then an authentication reset of the user is required. The user should be sent the new invitation URL to register with.

Also, if a user has changed mobile device, then an authentication reset of the user will be required. The user should be sent the new invitation URL to register with.

An authentication reset should be performed on the BlastShield™ Orchestrator by the Administrator. You can learn how to reset user authentication here: reset user authentication.

The BlastShield™ solution is zero-trust, so you will require a policy to allow access to the Agents on your protected servers.

Check the following on the host running the BlastShield™ Desktop Client.

Users, endpoints and Host Agents are each allocated a unique protected IP address from the overlay subnet by the Orchestrator when they are created. The overlay IP address is used to connect to a node in the BlastShield™ encrypted overlay. The default network for the subnet is 172.16.0.0/16 and if you want to use a different network prefix, you can change this on the Orchestrator.

The Orchestrator will always have the first IP address in the overlay subnet, so in the case of the default configuration, this will be 172.16.0.1. Endpoints and Host Agents will be allocated the next available address after the Orchestrator address as they are created. Users will be allocated an IP address in the 172.16.128.1 subnet for the default settings.

You can set your own IP address instread of the system suggested address, but the address must be in the protected overlay and it must not duplicate an existing IP address.

See the following article for details on changing the default network prefix: Changing the network prefix on the Orchestrator.

The Host Agent may be upgraded directly from the Orchestrator, which you can learn about here. This is the recommended method.

For Host Agents which are on Release 1.2 or lower, the Agent is upgraded by installing the latest version of the Agent software onto the server and you can learn how to do this here.

The majority of Gateways are upgraded from the Orchestrator. The exception to this is a container based Gateway, much must be upgraded by by modifying the container to use a newer image.

You can read the Gateway upgrade process here.

The Gateway requires an x86 based hardware platform with the following minimum specifications:

If the 'Send Default Gateway' checkbox is ticked, then a default gateway address will be sent in the. DHCP offer from the BlastShield Gateway to its protected Endpoints.

The BlastShield Gateway will use 172.16.255.254 as the default gateway (if the standard prefix is being used).

The default gateway configuration can be enabled for Endpoint devices which require a default gateway IP address in their IP configuration and for configuring the Enhanced Gateway Endpoint connectivity feature.

Apple have implemented the DHCP functionality on the Mac such that if a default gateway is not sent in the DHCP offer then it discards the sent DNS entry, but it does accept the IP address.

The BlastShield Gateway allocates the protected IP address to the Mac endpoint by a DHCP offer but it does not include a default gateway address in the offer.

To learn how to work around this, watch the following video or read the steps below.

Anydesk is a remote connectivity app which connects a remote user to a host computer and routes the connection via Anydesk’s SaaS cloud.  Since the SaaS cloud is outside of the BlastShield Network, then BlastShield™ will not send packets to it.   Clients such as Microsoft Remote Desktop will work as an alternative, since they use a peer-to-peer connectivity.