Ports & Firewall Rules¶
ShowMatic controllers need a few network paths to work: local control over your LAN, and outbound access to ShowMatic cloud services. This page lists the ports involved so you can configure firewalls, guest WiFi, and VLAN rules.
Summary
- On your LAN: clients connect to the device on TCP 443 (local control).
- To the internet: the device connects out on TCP 8883 (cloud MQTT) and TCP 80 (firmware and file downloads).
- The device does not accept inbound connections from the internet. Nothing needs to be port-forwarded to the controller.
Firewall Rules for Multiple Networks¶
If you prefer to keep you ShowMatic (or other IoT) devices separate from your trusted devices like phones and computers, you will be connecting these devices to a separate network / subnet. If you do that, please make sure you have firewall rules setup as below so that you can still connect locally for the best experience.
| Connection | Allow / Deny |
|---|---|
| ShowMatic Network to Internet | Allow |
| Internal Network to ShowMatic Network | Allow |
| ShowMatic Network to Internal Network | Deny |
If you want to lock it down further by restricting ports, see below.
Port Usage¶
The controller always initiates cloud connections. Allow these outbound from the device’s IP (or from your IoT VLAN).
Device To Internet (ShowMatic cloud)¶
| Port | Protocol | Destination | Purpose |
|---|---|---|---|
| 8883 | TCP (TLS) | mqtt.showmatic.io |
Cloud MQTT — commands, status, adoption, pressure lockout |
| 80 | TCP | cloud.showmatic.io |
Firmware version checks and file/firmware downloads |
Regional brokers
In the near future we will be adding a server for Europe, likely in Germany. If you transfer your devices to a regional server the mqtt cloud server above will point the device at a different MQTT broker. Scheme is always mqtts:// (TLS).
On your LAN¶
| Port | Protocol | Direction | Purpose |
|---|---|---|---|
| 68 | UDP | Outbound to router | DHCP — device gets an IP address |
| 53 | UDP / TCP | Outbound to DNS | Name resolution before cloud connections |
| 5353 | UDP | App to device | Response for local device discovery |
| 443 | TCP | Inbound to Device | Local app connections |
How Traffic Flows¶
flowchart LR
subgraph LAN["Your local network"]
App["Control app / browser"]
Device["ShowMatic device"]
App -->|"TCP 443 — local control (WSS)"| Device
App -.->|"UDP 5353 — mDNS discovery"| Device
end
subgraph Internet["Internet (outbound from device)"]
MQTT["mqtt.showmatic.io:8883"]
Cloud["cloud.showmatic.io:80"]
end
Device -->|"TCP 8883 — cloud MQTT"| MQTT
Device -->|"TCP 80 — updates & downloads"| Cloud