For your IT team
Two ports, one direction, nothing to the internet.
The kit works out of the box on its own WiFi hub and never needs your network. If you want live feedback from the gate on an office PC, the desks need a route to that PC. This page is what your network team will ask for.
What we need from you
- An RJ45 Ethernet drop at the desk, or access to your own WiFi. A dedicated VLAN is welcome; the units only ever talk to each other and to the Back Office PC.
- The Back Office PC on the same VLAN, or a route to it. It is an ordinary Windows PC in the office; nothing is installed on a server.
- Nothing else. No internet, no DNS, no proxy, no inbound rule from outside the building, no cloud account.
Ports and directions
| Port | From | To | Carries |
|---|---|---|---|
| TCP 8047 | Back Office PC, desks, handhelds | front desks and handhelds | the live register, configuration, notices, the visitor's screen and the signature; authenticated and encrypted per link |
| UDP 8058 | Back Office PC, handhelds | broadcast, answered unicast by the desks | finding the desk without typing its address (ezPublic uses 8048) |
Every connection is opened by the office or by a unit in your building and is refused unless both ends prove the same site key. If broadcast is filtered on your VLAN, discovery simply does not find the desk and the address is typed once on the pairing screen. The gate itself never depends on any of this: the desks and handhelds keep their own copy of the register and keep working with the office PC switched off.
What a stranger on your LAN sees
Port numbers are not secrets; a scan finds them in seconds. What matters is what each listener hands to someone who has not proved the site key, so here it is, from the code:
- TCP 8047. The desk speaks first: a magic word, a version and sixteen random bytes. The caller must prove itself over those bytes: a unit with the site's key, or an office computer signing with its own key, one the desk has allowed. A wrong answer closes the connection silently, indistinguishable from a dead port. Everything after that is a sealed envelope, ChaCha20-Poly1305, one command per connection, a fresh challenge every time, so a recorded session cannot be replayed and a captured one is ciphertext.
- Allowing an office computer. The computer and the desk each show six digits from a committed key exchange. A person at the desk compares them and taps Allow; nobody in between can make the two screens agree. From then on every office command carries that computer's signature.
- UDP 8058. The only thing a stranger learns without a key: the site name, the desk's address, which unit it is and which way it faces. Nothing can be done with that which a port scan would not already show.
- On the units. Every row in the register is sealed separately (XChaCha20-Poly1305) before it reaches storage, so a stolen handheld holds ciphertext, and the unit locks behind an Emirates ID tap or a PIN.
The two-minute version
A word with your network team helps
Ten minutes with the person who owns the VLANs is usually all it takes: which switch port, which SSID, whether broadcast crosses the VLAN. We give them the table above and the MAC addresses of the units on delivery, and we are on the phone while they test.