Network Requirements for PlugStream
PlugStream charge points need an internet connection to communicate with PlugStream Cloud or a third-party CSMS.
This article is for network administrators and other people who manage the network on site.
| Option | PlugStream 7S / 7T | PlugStream 22 |
|---|---|---|
| Bluetooth LE 5.0 with external antenna | Yes | Yes |
| Wi-Fi 2.4 GHz 802.11 b/g/n (channels 1-11) | Yes | Yes |
| Ethernet | Yes | Yes |
| 4G LTE | Optional | Optional |
Table 1 – Network Connectivity Options
Data use varies with charging sessions, diagnostics, and firmware downloads. Do not apply a restrictive daily data quota that could prevent security or firmware updates.
Network security
Traffic between the charge point and PlugStream Cloud is encrypted. The internet rules below are initiated by the charge point, so no unsolicited inbound internet ports or NAT port forwarding are required.
HTTPS and secure WebSockets
PlugStream uses TCP port 443 for HTTPS and secure WebSocket connections. These connections carry setup, OCPP charging communication, diagnostics, and firmware downloads. Firmware files are transported over the secure connection. On firmware version 1.45.0 or later, the charger also verifies a cryptographic signature before an update can become bootable and rejects an unsigned or modified image. Hardware Secure Boot is a separate product-security control and must be confirmed in the controlled technical file for the released production configuration; it cannot be inferred from the network port or signed OTA alone.
Production PlugStream Cloud uses:
ocpp.ampnexus.netfor secure OCPP communicationapi.ampnexus.appfor device setup and API communicationapi.s3.ampnexus.netfor firmware or diagnostic file transfers when requested by PlugStream Cloud
If a charge point is configured for a third-party CSMS, the network must also allow its configured secure WebSocket hostname and port.
Outbound internet ports
| Port | Protocol | Destination | Purpose |
|---|---|---|---|
| 53 | UDP | 1.1.1.1 |
Primary DNS resolver on Wi-Fi |
| 53 | UDP | 8.8.8.8 |
Backup DNS resolver on Wi-Fi |
| 53 | UDP | Primary site DNS address supplied by DHCP | Final DNS fallback on Wi-Fi, when supplied |
| 123 | UDP | pool.ntp.org |
Network time synchronisation |
| 443 | TCP | ocpp.ampnexus.net |
Secure OCPP communication |
| 443 | TCP | api.ampnexus.app |
Device setup and API communication |
| 443 | TCP | api.s3.ampnexus.net |
Firmware and diagnostic file transfer |
All rules are outbound from the charge point except the normal replies to connections it initiated. Cloud-service hostnames may resolve to different IP addresses over time, so allow the stated hostname where the firewall supports hostname-based rules.
DHCP
DHCP uses UDP ports 67 and 68 on the local network. The DHCP service must provide enough addresses for every connected device and should supply an IP address, subnet mask, default gateway, and primary local DNS server.
DNS
PlugStream uses DNS to resolve the services needed for PlugStream Cloud, time synchronisation, firmware transfer, and any configured third-party CSMS.
On Wi-Fi, firmware version 1.37.0 or later uses the resolvers in this order:
| Order | DNS resolver | Firmware role |
|---|---|---|
| 1 | 1.1.1.1 (Cloudflare) |
Main resolver |
| 2 | 8.8.8.8 (Google Public DNS) |
Backup resolver |
| 3 | Primary local DNS server supplied by DHCP | Final fallback, when DHCP supplies one |
The charger records the primary DNS address received from DHCP before promoting the two public resolvers. It reapplies this order whenever Wi-Fi receives an IP address, including after a DHCP lease renewal. A secondary DNS address supplied by DHCP is not part of this Wi-Fi resolver order.
Network firewalls and DNS-filtering equipment should permit direct outbound UDP port 53 access to both public resolver addresses. If public DNS is intentionally blocked, resolution may be delayed or fail before the DHCP-supplied local fallback is attempted.
This fixed order applies to Wi-Fi. Ethernet normally uses DNS supplied by the site's DHCP service, while optional 4G uses the DNS configuration provided by the mobile connection; their resolver order may therefore differ.
NTP
| NTP Server | Port |
|---|---|
| pool.ntp.org | 123 |
If the PlugStream’s real-time clock is wrong, the charge point cannot authenticate itself with PlugStream Cloud. PlugStream has to be connected to an NTP server so that the internal clock can be updated. This communication takes place via UDP port 123.
The NTP server used by PlugStream is pool.ntp.org.
The hostname used for NTP is static. It cannot be changed by the user at present.