Keep live control local and isolated.

Topology

Place the iPhone/iPad and Generic Link endpoint on a trusted LAN where direct TCP traffic is allowed. Manual host/IP entry is used; v1 does not broadcast for discovery.

Firewall and Wi-Fi

• Allow outbound TCP from the Apple device to the configured endpoint port.
• Allow return traffic for the established connection.
• Disable guest/client isolation between the wireless client and wired endpoint.
• Avoid captive portals, public Wi-Fi and NAT/port forwarding.

Addressing

Reserve the endpoint address through static configuration or DHCP reservation. A hostname may be used when local DNS is reliable. Profiles accept ports 1–65535; the reference endpoint defaults to 5200.

Security

Generic Link v1 uses plain TCP. Use a production VLAN, access control and physical/network segmentation appropriate for show control. Do not expose an endpoint to the public internet.

Polling

The app requests current state every two seconds and pauses polling while a write is serialized. Endpoints should support this rate or document a gateway-side cache.