Campus Site Router Setup
You don't set up a VPN — we do.
You give our pre-configured router a network connection, and it builds the encrypted tunnel to our cloud on its own. Your team's job is small: provide a dedicated BAS VLAN and an internet connection, and allow our router's traffic to reach us.
At a glance
You don't build a VPN, and usually open no inbound ports. Our router makes the encrypted connection outbound on its own.
- You provide: a BAS VLAN (all buildings), plus access and internet ports for our router.
- We provide: the router, all IP addressing, the encrypted tunnel, and remote management.
- Your firewall: allow one outbound UDP connection. (Stateless firewall or port ACL? See Firewall Rules.)
- Isolation: the BAS VLAN is a dead end — it can't reach your corporate network.
- Existing devices? We migrate them one at a time, live — see how.
Overview
For campuses with multiple buildings (schools, hospitals, corporate parks), we deploy a small pre-configured router on your network that connects all building automation equipment back to our cloud platform. No VPN is configured on your firewall. No inbound connections are opened. Your IT team creates a dedicated VLAN for BAS devices, and our router handles everything else.
How It Works
Your IT team creates a VLAN dedicated to building automation devices across all campus buildings. Our router plugs into that VLAN and acts as the gateway for all BAS devices. It assigns IP addresses, manages the network, and tunnels all traffic through an encrypted outbound connection to our cloud.
What We Install
| Detail | Description |
|---|---|
| Model | MikroTik hEX RB750Gr3 |
| Size | Approximately 4.5" × 3.5" × 1" — about the size of a paperback book |
| Ports used | Port 1 (WAN — internet access), Port 2 (BAS VLAN connection) |
| Power | 24W adapter (included), or 802.3af/at PoE with optional injector |
| Noise | Fanless, silent |
What We Need From You
| Requirement | Details |
|---|---|
| BAS VLAN | A dedicated VLAN for building automation devices, trunked across all buildings with BAS equipment |
| Access port for our router | One untagged (access mode) port on the BAS VLAN where our router plugs in — do not send the VLAN tagged |
| Internet port | One Ethernet port with internet access (separate from the BAS VLAN) for the router's WAN connection |
| BAS devices on the VLAN | All Jace controllers, thermostats, air handlers, and RTUs placed on the BAS VLAN |
- No DHCP server or IP helper — our router handles all IP assignment
- No gateway or SVI (switched virtual interface) — our router is the gateway
- No ACLs or inter-VLAN routing rules — the VLAN just needs layer 2 connectivity
- No DNS or NTP configuration — our router provides these to devices
The BAS VLAN only needs to be a layer 2 broadcast domain connecting our router to the BAS devices. We manage everything else.
Our router becomes the gateway for the BAS VLAN. It assigns IP addresses to all devices via DHCP and routes their traffic through the encrypted tunnel to our cloud. Your IT team does not need to manage device IPs or routing.
Firewall Rules
In most cases your firewall only needs to allow one outbound connection from our router's WAN port. Whether you need an inbound rule depends on your firewall type — stateful firewalls (most networks) need nothing inbound; stateless firewalls or switch-port ACLs do (see Switch Port ACLs or Stateless Firewalls below).
| Direction | Protocol | Port | Destination | Purpose |
|---|---|---|---|---|
| Outbound | UDP | 51820 | 18.223.58.49 | Encrypted VPN tunnel (WireGuard) |
| Outbound | UDP | 123 | Internet | Time synchronization (NTP) |
If your network uses stateful firewalling (most do), the return traffic is automatically allowed and no additional rules are needed.
Switch Port ACLs or Stateless Firewalls
If the switch port where our router connects has an inbound ACL (common on campus networks), return traffic from our cloud must be explicitly permitted. Without this, the router can send packets out but never receives responses, and the tunnel will not establish.
Our router uses a fixed source port of 13231 for all VPN traffic. The full conversation looks like this:
| Direction | Protocol | Source | Source Port | Destination | Dest Port | Action |
|---|---|---|---|---|---|---|
| Outbound (from router) | UDP | Router IP | 13231 | 18.223.58.49 | 51820 | Allow |
| Inbound (to router) | UDP | 18.223.58.49 | 51820 | Router IP | 13231 | Allow |
How to tell if this is needed: If the router is powered on and has internet access (can browse, can ping other hosts) but the VPN tunnel never connects, a switch port ACL blocking UDP traffic on port 13231 is the most common cause.
Network Isolation
The BAS VLAN is completely isolated from your corporate network:
- BAS devices cannot reach corporate resources — they only talk to our router
- Our router does not route traffic between the BAS VLAN and your corporate network
- All BAS traffic goes through the encrypted tunnel to our cloud or stays local on the VLAN
- Your corporate network sees only one device (our router's WAN port) making one outbound UDP connection
What Your Network Sees
| What Your Network Sees | Details |
|---|---|
| On your corporate network | One device (router WAN port), one IP, one encrypted UDP stream |
| On the BAS VLAN | Our router acts as gateway — assigns IPs and manages all BAS device traffic |
| Cross-VLAN traffic | None — BAS devices cannot reach corporate resources |
| Protocols on your corporate network | None — no STP, LLDP, CDP, OSPF, BGP, or multicast |
| Inbound connections from the internet | None |
Frequently Asked Questions
What if we already have IP addresses on our BAS devices?
We migrate them one at a time in a coordinated, scheduled window so there's no bulk outage — each device is offline only 2–5 minutes while everything else keeps running. The full step-by-step process is in the Technical Reference.
Does this require a VPN on our firewall?
No. Our router handles the encrypted tunnel entirely on its own. Your firewall has no VPN configuration.
Can BAS devices access our corporate network?
No. Our router does not route traffic between the BAS VLAN and your corporate network. BAS devices can only communicate with our cloud platform.
What if we have devices in 10 buildings?
As long as the BAS VLAN is trunked to all buildings, one router handles all of them. Every device on the VLAN gets an IP from our router and connects through the same encrypted tunnel.
What happens if the internet goes down?
BAS devices continue to operate locally. They lose cloud connectivity until internet is restored, at which point the tunnel automatically reconnects. No manual intervention required.
Who manages the router?
We do. The router is pre-configured and managed remotely through the encrypted tunnel. Your IT team does not need to manage, update, or monitor it.
For network engineers: Technical Reference
Deeper detail lives on a separate page so this guide stays focused on what your team needs to do:
- Cloud infrastructure — AWS region, encryption, endpoint IP
- Device migration — step-by-step for sites with existing static IPs
- Zero-trust network controls (optional) — egress ACLs, DHCP snooping, port security, static-IP mode
Questions?
Contact us at any time. We're happy to schedule a call with your IT team to walk through the deployment.