Equipment & IoT operators / The appliance stays. The path is deliberate.
Reach the equipment you already depend on.
Reach existing equipment and management interfaces across sites. Connect supported devices directly or use a gateway beside local appliances.
Available with assisted setup. Confirm the supported devices, locations and connection scope before deployment.
01 / Begin with the maintenance task
Your equipment.
Your existing tools.
A recorder at a branch, a kiosk in a store and a NAS in a remote office have different jobs. Start with the interface the operator already uses, then choose a private path, a selected public service or an outgoing source.
An operator reaches a local equipment interface.
- Approved operatorSupported enrolled device→WireGuard
- Fibmesh routing nodePermitted private path→WireGuard
- Site gatewayApproved LAN destination→LAN
- Installed equipmentExisting IP and management tool
Networks provides the path to the approved target while the equipment keeps its local address and management software.
The gateway is enrolled; the LAN appliance is not automatically enrolled. Application login, destination permissions and a return route or supported source NAT remain necessary.
Compare devices and gateways →One public address can serve different local targets.
- External applicationPublic IP + chosen port→Service request
- Fibmesh public deliveryInbound rules→WireGuard
- Site connectorMap each allowed public port→Target mapping
- NVR or local serverSelected LAN IP + service port
A supported mapping can send one public port to an NVR service and a different port to a local server. Only intentionally selected services belong on this path.
Distinct-port mappings describe a supported gateway design, separate from the original single-target POC. Replies to Fibmesh-delivered traffic must return through Fibmesh; unrelated LAN traffic keeps its ISP path. The preconfigured Edge hardware option remains development/pilot.
Explore Gateway IPs →A device calls an external service from a known source.
- LAN equipmentStarts an API request→LAN route
- Configured gatewayRoutes the selected traffic→WireGuard
- Fibmesh public sourceAssigned address / suitable exit→HTTPS
- External APISource check and device credentials
Use a supported outgoing routing arrangement when the external system expects a known source address. The equipment continues to authenticate with its own credentials.
A one-port connector does not automatically reroute LAN traffic. A shared gateway source identifies the outgoing connection point, not each individual appliance.
Plan equipment outgoing identity →The gateway has its own Fibmesh identity. Ordinary LAN appliances keep their local addresses and application identities; connecting the gateway does not automatically enrol them.
02 / Place the gateway for the task
Beside the appliance.
Account for the reply.
Equipment that cannot run a supported agent can stay on its existing LAN behind a supported gateway. Confirm the local target, the gateway’s reachability and the route back before calling the connection ready.
Selected incoming connection
The connector reaches the target.
- Operator or external systemUses the permitted private service or public IP and port
- Supported site gatewayApplies the approved path and, where needed, the target mapping
- Existing LAN applianceKeeps its local IP, management application and login
The other half of the connection
The reply needs a route too.
Private maintenance needs a return route or supported source NAT. For public forwarding, destination translation selects the appliance. Supported LAN-side source NAT can bring the appliance’s replies back to the connector, but the connector still needs routing that sends those replies through Fibmesh.
Translation alone does not select the tunnel path. Source NAT can also hide the original client address from the appliance; retain application authentication.
Explore the equipment gateway pattern →One Ethernet connection does not redirect the site.
A connector can serve selected incoming targets while unrelated new internet connections continue through the existing ISP router. Outgoing identity requires customer routing, policy routing or a downstream network that actually sends the intended traffic to the gateway.
Keep an installation record.
The most useful starting point is the equipment and its operating requirements.
- 01The appliance
- Model, firmware and the service it exposes. Record the local IP address and reserve it so a restart does not send a mapping to another device.
- 02The operator’s tool
- Management application, transport protocol and service port. Keep its accounts, permissions and device credentials under the equipment owner’s control.
- 03The permitted task
- Who needs access, from where and for what work? Select only the destinations needed for that task and name the person who can recover the installation locally.
Illustrative supported mapping design
One address. Distinct selected services.
A supported gateway can map separate public ports to separate local targets. This example describes the mapping design; it is separate from the original single-target customer POC.
Confirm the supported software and actual equipment ports before deployment. Scroll sideways to see every column on smaller screens. With a keyboard, focus the table region and use the arrow keys.
| Transport | Public port | Selected LAN target | Service |
|---|---|---|---|
| TCP | 18443 | 192.168.50.20:443 | Recorder web administration |
| TCP | 19443 | 192.168.50.30:443 | Local server web administration |
The same public IP, transport protocol and port cannot independently select two targets without another multiplexing mechanism. Confirm each required TCP or UDP service separately; selecting a web interface does not establish support for every stream or proprietary client.
Review gateway delivery and mappings →03 / Match the path to the service
Choose what needs
to be reachable.
Private maintenance, an incoming service and a known outgoing source are different jobs. Keep the scope explicit, including the protocols the equipment actually uses.
Compare the connection options →Private maintenance
Use Networks for approved operators reaching supported administration and diagnostic services. Keep application login and destination permissions in place.
Explore Networks →Check devices and gateways →A selected incoming service
Public IPs can provide address-based access through supported gateway mappings. Publish requires a compatible HTTP application; it does not carry raw video, proprietary equipment protocols or USB devices.
Explore Public IPs →A known outgoing source
Route the intended traffic through a supported gateway and suitable public source for the external system’s allowlist. A shared source address identifies the outgoing connection point, not each appliance. Equipment still needs its own credentials.
Plan outgoing identity →04 / Demonstrated deployment pattern · Pilot
A gateway beside the equipment already in place.
The original customer POC connected a preconfigured Fibmesh Edge device to a LAN and provided remote access to one configured target. The equipment kept its local address and router. Edge hardware remains in development/pilot.
Explore the gateway deployment →What the original POC established
One configured LAN target.
- One configured target retained its local LAN address
- An operator selected the target remotely
- Hardware release and fleet management remain separate
The original artifact did not demonstrate simultaneous forwarding to an NVR and a server. Multiple targets distinguished by protocol and public port belong to a separate supported gateway design. The preconfigured Edge option remains hardware in development/pilot.
For your installation, prove the useful work.
Connectivity is the path to the equipment. Your own management, telemetry, diagnostic, firmware and remote desktop tools perform the work.
- 01
Complete a real task
Use the actual management application from another internet connection. Check application login and the permitted service, then verify a person or port that should be denied.
- 02
Interrupt the connection
Restart the equipment and gateway, then test loss and restoration of internet access. Check target addresses and both directions of the route. Retain a local administration method.
- 03
Withdraw and replace
Remove the selected access or mapping and verify it stops working. When equipment is replaced, retire stale mappings, credentials and any enrollment belonging to the old device.
For continuous video, large backups or time-sensitive interaction, test the actual bandwidth and latency requirements. Connectivity does not guarantee equipment performance or replace someone who can recover it locally.
05 / A practical first deployment
One model.
One maintenance task.
Start with a known installation and the person who operates it. Keep the equipment record, recovery method and access removal with the deployment plan.
- 01
Record one installation.
Bring one equipment model, its firmware, stable local address, protocol and operator’s tool. Confirm whether it supports a native endpoint or needs a supported nearby gateway.
- 02
Commission the path.
Agree authorised people and systems, selected targets, firewall rules and the return path. For outgoing identity, explicitly route the intended traffic through the gateway.
- 03
Prove operation and recovery.
Complete the real maintenance task. Test restart, internet loss, denied access and withdrawal with the local owner before extending the arrangement to another installation.
06 / Operating the installation
Before you connect.
Does every appliance get a Fibmesh device identity?
Only individually enrolled devices have their own Fibmesh enrollment identity. A gateway has its own identity; ordinary appliances behind it retain their local addresses and application identities. They do not become enrolled just because the gateway joins.
Does the router need to run WireGuard?
The supported connector or gateway must run the tunnel software. The existing ISP router can remain in place if the network permits the required traffic and the deployment has working LAN and return routes. WireGuard is the currently supported tunnel protocol; a generic WireGuard-capable appliance is not automatically a supported Fibmesh gateway.
Can several servers share one gateway public IP?
A supported mapping deployment can direct distinct public ports to different local IP-and-port targets. The same public IP, transport protocol and port cannot independently identify two destinations without another multiplexing mechanism. This design is separate from the original single-target POC. Review Gateway IPs.
Will outgoing equipment traffic also use that public address?
Only if the intended traffic is routed through the gateway and the configured service supports that outgoing mode. Replies to Fibmesh-delivered incoming requests must return through Fibmesh. Ordinary LAN internet traffic otherwise retains its existing ISP path.
Is this a fleet-management or remote-control system?
Fibmesh supplies connectivity. Telemetry, diagnostic commands, firmware updates and remote desktop require the equipment’s own supported software. Self-service fleet claiming and automatic lifecycle orchestration are not established by the customer POC.
Can this carry printer discovery or safety-critical control?
Routed IP reachability does not automatically carry local broadcast discovery or USB protocols. Printers and scanners need compatible IP services and drivers. Industrial and safety-critical control require separate suitability and failure assessments; no certification or deterministic timing is implied.