Configuring NetID Filtering on KONA Gateways

NetID filtering allows a TEKTELIC KONA gateway to forward only LoRaWAN® packets that match authorized networks or devices.
This feature helps reduce backhaul traffic and prevent data from roaming or misconfigured devices—particularly valuable for gateways using metered cellular connections.

KONA gateways support two methods for configuring NetID filtering:

• Through KONA Element or KONA Core servers using the Bulk Configuration interface.
• Through LoRa Basics Station when connecting to third-party network servers such as AWS IoT Core for LoRaWAN.

Each LoRaWAN® packet contains unique identifiers that can be used for filtering:

KONA gateways support filtering both uplinks and join requests.

• DevAddr List – screens regular uplink packets.
• JoinReq List – screens join requests.

Note
For reliable operation, configure both DevAddr and JoinEUI/DevEUI rules for each device.
Filtering only one type may result in lost join requests or uplinks.

{"loraTrafficFilter": {
  "devAddrList": [
    {
      "ruleId": 111,
      "action": "ALLOW",
      "start": "26000000",
      "end": "26FFFFFF"
    },
    {
      "ruleId": 222,
      "action": "DENY",
      "start": "00000000",
      "end": "FFFFFFFF"
    }
  ],
  "joinReqList": [
    {
      "ruleId": 1001,
      "action": "ALLOW",
      "devEUI_Start": "0004A30B001CXXXX",
      "devEUI_End":   "0004A30B001CXXXX",
      "joinEUI_Start":"70B3D57EDXXXXX",
      "joinEUI_End":  "70B3D57EDXXXXX"
    }
  ]
}}

This JSON snippet can be applied to gateways managed through KONA Element/Core, or adapted for Basics Station configurations.

• BSP version 7.1.2 or newer

• Gateway software:

  • tektelic-gateway-bridge 1.9.4-r81 or later
  • tektelic-lora-hal 5.2.1-r5 or later

• The gateway and devices are already provisioned in KONA Element or KONA Core.

• Gateway is online.

1. Log in to the KONA Element or KONA Core web portal.

2. Open the Gateway Groups tab and select the gateway(s) to update.

3. Click CONFIGURATION → Apply Configuration.

4. In the Add Configuration dialog, paste your NetID filter JSON configuration.

5. Click Save. The configuration is transferred to the gateway and saved locally.

6. To confirm, open CONFIGURATION → Get Configuration Status, select the gateway, and choose Get Configuration Status.

7. Reboot each gateway to apply the new NetID filter.

When the gateway connects to a third-party network server via LoRa Basics Station, NetID filters are configured from the network server interface.

• BSP version 7.1.2 or newer

• Gateway software:

  • tektelic-bstn 1.9.4-r81 or later
  • tektelic-lora-hal 5.2.1-r5 or later

• Gateway registered and online in AWS IoT Core for LoRaWAN.

1. Sign in to the AWS IoT Console and open IoT Core for LoRaWAN.

2. Create a New gateway or Edit an existing gateway.

3. Expand LoRaWAN Configuration – optional.

4. Under NetID Filters (optional), click Add NetID and enter the allowed NetID, for example:

   000013
   

Refer to LoRa Alliance NetID Allocation page for NetID prefix https://lora-alliance.org/lorawan-network-coverage/

5. (Optional) Add JoinEUI filters under JoinEUI Filters (optional).

6. Click Save. The gateway’s Basics Station service restarts automatically and applies the new filters.

Note AWS IoT Core filters only by NetID. DevAddr or JoinEUI range filtering is not supported.

• Verify that the gateway is online before applying the configuration.
• If the configuration fails to save, ensure your browser allows pop-ups or try Google Chrome.
• Always reboot the gateway after saving the configuration.
• Confirm successful filtering by reviewing the gateway’s uplink log entries.