A system for communication, comprising: a station, comprising first and second interfaces (36, 38) configured to be connected to a packet data network and to have different, respective first and second network addresses; a terminal, comprising third and fourth interfaces (54, 68) configured to be connected to the packet data network and to have different, respective third and fourth network addresses, wherein the station is configured to transmit first data to the terminal over a first path through the packet data network directed from the first interface to the third network address, while the terminal is configured to transmit second data to the station over a second path through the packet data network directed from the fourth interface to the second network address; and first and second Transmission Control Protocol, TCP, proxies (46, 70), which are deployed respectively in the station and in the terminal, and are configured to emulate a TCP connection between the station and the terminal by transmitting TCP frames from the station to the terminal only over the first path and from the terminal to the station only over the second path; wherein the station comprises a first outgoing one-way link connected between the first TCP proxy and the first interface and a first incoming one-way link connected between the second interface and the first TCP proxy; wherein the one-way links are physically configured to carry signals in one direction and to be incapable of carrying signals in the opposite direction; characterized in that the station comprises first and second switches, which are coupled between the outgoing and incoming one-way links and the first TCP proxy and are configured to connect the first TCP proxy to the packet data network via the outgoing and incoming one-way links only when the emulated TCP connection is in use. a station, comprising first and second interfaces (36, 38) configured to be connected to a packet data network and to have different, respective first and second network addresses; a terminal, comprising third and fourth interfaces (54, 68) configured to be connected to the packet data network and to have different, respective third and fourth network addresses, wherein the station is configured to transmit first data to the terminal over a first path through the packet data network directed from the first interface to the third network address, while the terminal is configured to transmit second data to the station over a second path through the packet data network directed from the fourth interface to the second network address; and first and second Transmission Control Protocol, TCP, proxies (46, 70), which are deployed respectively in the station and in the terminal, and are configured to emulate a TCP connection between the station and the terminal by transmitting TCP frames from the station to the terminal only over the first path and from the terminal to the station only over the second path; wherein the station comprises a first outgoing one-way link connected between the first TCP proxy and the first interface and a first incoming one-way link connected between the second interface and the first TCP proxy; wherein the one-way links are physically configured to carry signals in one direction and to be incapable of carrying signals in the opposite direction; characterized in that the station comprises first and second switches, which are coupled between the outgoing and incoming one-way links and the first TCP proxy and are configured to connect the first TCP proxy to the packet data network via the outgoing and incoming one-way links only when the emulated TCP connection is in use.