Remote Access

TAPP maintains a remote management connection to the Network Router for configuration, diagnostics, and system health monitoring. This page documents what that connection is, how it is established, and what it can and cannot reach. The management tunnel carries bidirectional traffic to the Network Router, and this page states its scope precisely so that it can be evaluated against your security policy.

What It Is

TAPP uses Tailscale  (a mesh VPN built on WireGuard ) to remotely access the Network Router for configuration, diagnostics, and wireless sensor health monitoring. Remote access terminates at the Network Router and goes no further. The TAPP Gateway provides no forwarding path from the transport side to the protected side, so there is nothing for the tunnel to cross into.

Tailscale connects devices to each other using a coordination server as a key-exchange “drop box”; the encryption keys that actually secure traffic never leave each device. See Tailscale’s how it works  overview and its encryption  and security  documentation for the full model.

How the Tunnel Works

• The Network Router initiates an outbound connection to Tailscale’s coordination server — no inbound connection is ever established to your network.
• Your firewall does not need any inbound rules for this to work. Tailscale documents this in its firewall guidance .
• Tailscale attempts a direct peer-to-peer connection using UDP 41641 (NAT traversal ). If that port is blocked, it automatically falls back to an encrypted relay (DERP ) over outbound TCP 443. See connection types  for how direct vs. relayed connections are chosen.
• The tunnel is bidirectional for management traffic — TAPP technicians can read and write configuration on the Network Router itself. This access does not reach any equipment control system or the protected side of the TAPP Gateway.
• Access is scoped using Tailscale access controls (ACLs)  so that only authorized TAPP devices can reach the Network Router.

What TAPP Can Access via Remote

• Network Router configuration and diagnostics
• Wireless sensor health and radio status
• Telemetry processing and delivery status on the Network Router

What TAPP Cannot Access via Remote

• The protected side of the TAPP Gateway — no reverse forwarding path exists across the gateway, and the tunnel cannot alter the direction of data flow, which is established in hardware
• Any equipment control system — a boiler, chiller, water chemistry controller, or other connected equipment
• Any other device on the customer network — the Network Router is NAT’d and isolated

Configuration Options for Restrictive Security Policies

If the standard Tailscale configuration doesn’t meet your security requirements, TAPP can accommodate the following:

1. Force relay-only over TCP 443 — disable direct UDP 41641 tunneling entirely; all remote management traffic uses an outbound TCP 443 relay only.
2. Run Tailscale over cellular — configure the remote management tunnel to use the cellular backup uplink exclusively, so it never touches the customer network at all.

Either option can be configured before or after installation. Contact your TAPP Account Manager to request a modified configuration.