Ports and network

New to this?

Start with the Quick guide: Before you start.

The ports Centro System Manager for Crestron listens on, the connections it makes to other devices, and what to allow through a firewall.

Ports 80 and 443 on the processor belong to the processor's own firmware — its web pages and Crestron's services. It uses ports of its own beside them and doesn't change them.

Ports it listens on

These are the defaults. Use the processor's IP address, for example https://192.168.1.50:8443.

Port	Protocol	Who connects	What for
8443	HTTPS	Staff browsers, systems with an API key	The admin app: everything you sign in to. Calls made with an API key, the MCP endpoint (/mcp) and the processor's interactive API reference (/docs/public). Also serves the download of the processor's certificate.
8543	HTTPS, with a client certificate	Connections from locations — Crestron Home drivers and Crestron Custom	Connections that identify themselves with a certificate. One that must present a certificate can only connect here.
8080	HTTP	Staff browsers, connections from locations	The download of the processor's certificate, so a device can fetch it before it trusts the processor. Connections that aren't asked for a certificate. Anything else is sent on to the admin app on port 8443.
8180	HTTP	Users' phones, touch screens	The User App only. The admin app and the other connections aren't reachable on it.

Each port does one job:

• The admin port (8443) is the only one that serves the admin app, and the only one that takes an API key. A call that carries an API key on any other port is refused with 400 at once, so the key is never sent in the clear by mistake. If the site uses its own certificate, this is the port that shows it — see Certificate and API keys.
• The connection port (8543) asks every caller for a certificate. It has its own port so that the admin port never asks a browser for one. Its default is the admin port plus 100. See Connection certificates.
• The plain HTTP port (8080) exists for two things that can't happen over HTTPS: a device downloading the processor's certificate before it trusts the processor, and a connection making contact before it has a certificate. A browser that opens it is redirected to the admin port.
• The User App port (8180) is plain HTTP because a user's phone will never trust the processor's certificate. It serves the User App and nothing else, and the other three ports refuse its traffic. See User App.

It listens on every network adapter the processor has, including its control subnet.

Connections it makes

To	Port	Protocol	What for
Crestron devices on the processor's own subnet	41794	UDP broadcast	Discovery: finding Crestron processors and touch screens. Each device answers to UDP 41794 on the processor.
A device added under Manual devices	41794, then 443	UDP to the device's address, then HTTPS	Asking the device what it is, then reading its details. Used for a device discovery can't reach by broadcast, for example on another subnet. The device answers to UDP 41794 on the processor.
Crestron Home processors	443	HTTPS	Checking a discovered processor and installing or updating the Centro driver.
Other Crestron processors	443	HTTPS	Reading an adopted processor's details and health.
Touch screens	443 and 22	HTTPS and SSH	Reading an adopted touch screen's details and setting it up to show its location.
Your mail relay	The port you set	SMTP	Email alerts. See Email.
The licence store, on the internet	443	HTTPS	Activating a key online, and a daily check of keys activated that way. Not used with a licence file.
Centro's log server, logging.lightingcontrol.co.uk, on the internet	443	HTTPS	Sending a copy of the processor's log, and the errors the admin app and the User App report, so support can see a problem. On by default. Turn off Send this processor's logs to Centro under Settings → Settings → Logs to stop it. See Logs.

Discovery by broadcast only finds devices on the processor's own subnet. Add a device elsewhere under Settings → Deployment → Manual devices.

The processor's clock is kept right by the processor's own time server setting (SNTP), not by Centro System Manager for Crestron.

A Crestron Home driver or a Crestron Custom module can also send its own logs to Centro's log server, when its own switch is on or when Ask drivers and modules to send their logs is on under Settings → Settings → Logs. That traffic goes from the local processor, not from the processor Centro System Manager for Crestron runs on.

Firewall notes

• Staff network → processor: allow 8443, and 8080 if staff devices will download the processor's certificate over HTTP.
• Systems with an API key → processor: allow 8443 only.
• Crestron systems → processor: allow 8543 and 8080. A connection that's required to present a certificate uses 8543 only.
• Users' network → processor: allow 8180 only. Don't open 8443, 8543 or 8080 to users.
• Processor ↔ Crestron systems and touch screens: allow UDP 41794 both ways for discovery and manual devices, and 443 from the processor, with 22 to touch screens.
• Processor → internet: nothing is required to run the site. By default the processor sends its log to logging.lightingcontrol.co.uk over HTTPS (443): allow it, or turn off Send this processor's logs to Centro on a site that allows no outbound traffic. Allow HTTPS to the licence store if you activate keys online.
• Don't publish any of these ports to the internet. Centro System Manager for Crestron is made for the site's own network.

Changing the ports

The four ports are read when the program starts, and they can be set to other numbers — for example when another program on the processor already uses one. The plain HTTP port, the connection port and the User App port can each be turned off; the admin port can't.

The ports are kept through program upgrades and a factory reset. A backup holds them too, so restoring a backup brings back the ports in use when the backup was taken.

To confirm

What is the supported way for an installer to change the ports before the program first starts? The app has no setting for them.

If you change a port after connections, touch screens or User App QR codes are in use, they still hold the old address and must be set up again.