The Packet Filter feature on RAK gateways lets users control LoRaWAN® traffic by filtering packets based on device identity and behavior. It blocks unauthorized devices, reduces excessive join requests, and improves network stability and security.
This feature runs locally on the gateway and works in all operating modes: Basics Station, Packet Forwarder, and Built-in Network Server. It gives administrators precise control over which devices can connect and how often join requests are accepted.
Key Concepts
The Packet Filter is a built-in mechanism on the RAK gateway that filters packets based on set rules before sending them to the network server.
-
White List Mode
White List Mode lets you control which devices can connect to your LoRa network. When enabled, the gateway checks each device before accepting join requests or uplink data.The checks include:
OUI: The first 3 bytes (6 hex characters) of a device's DevEUI, typically assigned by the device manufacturer.
Network ID: A value derived from the device’s DevAddr that identifies the LoRaWAN network. Uplink packets are forwarded only if their Network ID matches the configured value.
OUI filtering is applied only during the device join process (OTAA). Once a device has successfully joined the network, subsequent uplink messages are not filtered by OUI.
-
Auto Filter Mode
Auto Filter Mode protects the network from devices that send too many join requests in a short time, often caused by misconfiguration or unstable behavior.You can customize the blocking behavior using these settings:
Join Interval: Minimum time required between two join attempts.
Join Count: Maximum allowed join requests within a certain time window.
Discard Period: How long the device is blocked once the rule is triggered.
Configuring Packet Filter in Different Work Modes
The Packet Filter feature is disabled by default. To use White List Mode or Auto Filter Mode, you must first enable them in the gateway's web UI.
Available options vary depending on the gateway's operating mode.
For Packet Forwarder/Built-in Network Server Modes
Log in to the gateway's web UI.
Go to LoRa® > Configuration > Packet filter.
Enable White List Mode and/or Auto Filter Mode using the toggle switches.
- After enabling, you can configure the following:
| Parameter | Description |
|---|---|
| OUI |
OUI is the first 3 bytes (i.e., 6 hexadecimal characters) of the device's DevEUI, identifying the manufacturer.
|
| Network ID |
A number between 0 and 127 (decimal), derived from the first 7 most significant bits (MSB) of a device's DevAddr. For example, a DevAddr starting with 0x26 (00100110 in binary) has the first 7 bits 0010011, which equals decimal 19. |
| Discard Period (s) | Duration (in seconds) during which OTAA join requests are blocked after violation. |
| Join Period | Time window (in seconds) during which repeated join attempts are monitored. |
| Join Interval | Minimum time (in seconds) between two OTAA join attempts from the same device. Used to detect abnormal behavior. |
| Join Count 1 | Maximum join requests allowed within the Join Interval. If exceeded, the device is blocked for the Discard Period. |
| Join Count 2 | Maximum join requests allowed within the Join Period. If exceeded, the device is blocked for the Discard Period. |
- Click Save changes to apply the configuration.
For Basic Station Mode
- Log in to the gateway's web UI.
- Go to LoRa® > Configuration > Packet filter.
- Only White List Mode is supported and must be enabled manually.
- After enabling, you can configure the following:
| Parameter | Description |
|---|---|
OUI |
OUI is the first 3 bytes (i.e., 6 hexadecimal characters) of the device's DevEUI, identifying the manufacturer.
|
Network ID |
A 6-character hexadecimal value. Refer to NetID and DevAddr Prefix Assignments table to determine the network. |
- Click Save changes to apply the configuration.
Troubleshooting
| Issue | Possible Cause | Suggested Solution |
|---|---|---|
Authorized node cannot join or report data |
Misconfigured OUI or Network ID |
Ensure the correct OUI or Network ID is included in the whitelist. |
OTAA join requests frequently fail |
Auto filter rules too strict |
Loosen Join Count and/or extend Discard Period. |
Packet Filter option not available in Basics Station mode |
Gateway firmware version is outdated. |
Upgrade gateway firmware to version 2.2.14 or later. |
FAQs
1. Are Packet Filter rules executed locally or in the cloud?
Locally. All rules are executed by the gateway itself in real time, with no cloud involvement.
2. Is a reboot required after changing Packet Filter settings?
No. Changes take effect immediately upon saving.
3. Does OUI filtering apply to devices that have already joined the network?
No. OUI filtering only applies during the OTAA join process.
If a device has already successfully joined the network, changing the OUI filter will not affect its subsequent uplink traffic, because DevEUI is no longer included in uplink packets.
To apply OUI filtering to an existing OTAA device, the device must rejoin the network.
4. What happens if the OUI matches but the Network ID does not?
For OTAA devices:
If the OUI matches, the device is allowed to send Join Requests.
The device can successfully join the network.
After joining, uplink packets are identified by DevAddr.
If the Network ID does not match, uplink packets are blocked by the gateway.
For ABP devices:
ABP devices do not perform a join process, so OUI is not evaluated.
The device immediately sends uplink packets using its configured DevAddr.
If the Network ID does not match, uplink packets are blocked by the gateway.
5. Why does the network server still receive device data when the OUI does not match but the Network ID matches?
This behavior typically occurs with ABP devices.
ABP devices do not perform a join process, so OUI (DevEUI) filtering is not applied.
Uplink packets are sent directly using the DevAddr.
Packet Filter evaluates ABP uplinks only based on the Network ID, which is derived from the DevAddr.
As long as the Network ID matches, the gateway will forward the uplink packets to the LNS, even if the OUI does not match.
Changelog
-
Version 1 - Configure Packet Filter on RAK LoRa® Gateways
- Date Published: 10/30/2025
Updated