Site Router VPN Setup Guide

What We're Installing

A small, pre-configured router (MikroTik hEX RB750Gr3) that connects HVAC controls equipment back to our cloud-hosted management platform. This allows us to securely monitor and control building automation equipment — thermostats, air handlers, rooftop units, and controllers — without requiring any changes to your existing network infrastructure.

This is not a switch or hub. It is a dedicated router with its own firewall. It does not participate in your network's switching, spanning tree, VLANs, or routing protocols.

What We Need From You

One Ethernet port with internet access. That's it.

Firewall / Outbound Rules

The router establishes a single encrypted tunnel to our cloud. All building automation traffic rides inside this tunnel. Your firewall only needs to allow:

If your network uses stateful firewalling (most do), the return traffic is automatically allowed and no additional rules are needed.

Switch Port ACLs or Stateless Firewalls

If the switch port where our router connects has an inbound ACL (common on campus and school networks), return traffic from our cloud must be explicitly permitted. Without this, the router can send packets out but never receives responses, and the tunnel will not establish.

Our router uses a fixed source port of 13231 for all VPN traffic. The full conversation looks like this:

How to tell if this is needed: If the router is powered on and has internet access (can browse, can ping other hosts) but the VPN tunnel never connects, a switch port ACL blocking UDP traffic on port 13231 is the most common cause.

What Your Network Sees

From your network's perspective, the router looks like any other single device:

Network Isolation

The HVAC controls equipment (controllers, sensors, etc.) connect to Ports 2–5 on the router, which is a completely separate network from your building LAN. The router provides:

• Its own private IP subnet for connected equipment (not routable from your network)
• Its own DHCP server for connected equipment
• NAT between the equipment network and your WAN port — your network never sees the internal device IPs
• A firewall that blocks all unsolicited inbound traffic from your network to the equipment

Your Building Network                    Our Equipment (isolated)
┌──────────────────────┐                ┌──────────────────────────────┐
│                      │   One cable    │                              │
│  Your switch/jack ───┼───────────────►│  Port 1 (WAN)               │
│                      │                │       MikroTik hEX           │
│  You see:            │                │  Ports 2-5 (equipment) ──►   │
│  - 1 MAC address     │                │       HVAC controllers       │
│  - 1 IP address      │                │       Thermostats            │
│  - 1 UDP stream      │                │       Air handlers, RTUs     │
│                      │                │                              │
│  You don't see:      │                │  All equipment traffic stays │
│  - HVAC devices      │                │  here or goes through the    │
│  - Any internal IPs  │                │  encrypted tunnel to our     │
│                      │                │  cloud — never touches       │
│                      │                │  your network                │
└──────────────────────┘                └──────────────────────────────┘
                        

Cloud Infrastructure

All communication between the site router and our cloud is encrypted end-to-end. The tunnel carries all building automation management traffic including device polling, configuration changes, and alarm data.

Frequently Asked Questions

Does this device need to be in a DMZ?

No. It works on any standard access port with internet access. It initiates all connections outbound.

Will this affect our network performance?

No. Building automation traffic is minimal — typically a few kilobytes per minute for device polling. Comparable to a single workstation browsing the web.

Can we monitor the traffic?

Yes. All traffic from the router exits through Port 1 on your network. You can mirror the switch port or use your firewall's traffic logs. You'll see a single encrypted UDP stream — the contents are not inspectable (by design), but the volume and destination are fully visible.

What if our firewall blocks UDP 51820?

The tunnel won't establish. We can work with your team to whitelist outbound UDP 51820 to 18.223.58.49. This is one rule to one IP address.

Do we need to configure anything on our router/firewall?

Only if you have strict outbound filtering or switch port ACLs. The router needs outbound UDP 51820 to our cloud endpoint and UDP 123 for NTP. If your switch port uses an inbound ACL, return UDP traffic from 18.223.58.49 port 51820 must also be allowed. See the "Switch Port ACLs" section above.

What happens if the internet goes down?

The HVAC equipment continues to operate locally on its own network. Cloud connectivity resumes automatically when internet is restored. No manual intervention required.

Can we restrict this to a specific VLAN?

Yes. Place the Ethernet port on any VLAN with outbound internet access. The router doesn't care which VLAN it's on — it just needs a path to the internet.

Who manages this device?

We do. The router is pre-configured and managed remotely through the encrypted tunnel. Your IT team does not need to manage, update, or monitor it.

Questions?

Contact us at any time. We're happy to schedule a call with your IT team to walk through the setup.

Contact Us