Keep live control local and isolated.

Topology

Place the iPhone/iPad and configured TCP endpoint on a trusted LAN where direct traffic is allowed. Manual host/IP entry is used; v1 does not broadcast for discovery.

Firewall and Wi-Fi

• Allow outbound TCP from the Apple device to the configured endpoint port.
• Allow return traffic for the established connection.
• Disable guest/client isolation between the wireless client and wired endpoint.
• Avoid captive portals, public Wi-Fi and NAT/port forwarding.

Addressing

Reserve the endpoint address through static configuration or DHCP reservation. A hostname may be used when local DNS is reliable. Processor records accept ports 1–65535; the reference endpoint defaults to 5200.

Security

Generic Link v1 and declarative integration profiles use plain TCP. Optional bearer tokens/shared secrets authenticate but do not encrypt the session. Use a production VLAN, access control and physical/network segmentation appropriate for show control. Do not expose an endpoint to the public internet.

Polling

The app requests current state every two seconds and pauses polling while a write is serialized. Endpoints should support this rate or document a gateway-side cache.