Why Outbound-Only (Port 8883) Beats Open Firewall Holes

The Founder's Explanation (Teach Exactly This Way)

"A door with a one-way peephole. You inside can look out and even call out to the street. But nobody outside can open it or knock their way in. Outbound-only is that door for a BMS — the gateway dials out to the cloud, but nothing from the internet can come in. No inbound hole, nothing for an attacker to push against."

Teaching the Concept

The One-Way Door Picture a door with a one-way peephole: you can look out and call out, but no one outside can open it or knock their way in. An outbound-only BMS is that door — the gateway dials out to the cloud, and nothing from the internet can come in. No inbound hole means nothing for an attacker to push against. The Design ``` GATEWAY -> outbound TCP 8883 (MQTT over TLS) -> cloud INBOUND firewall: nothing opened no VPN, no port-forward, no inbound attack surface ``` Why IT Says Yes ``` Inbound holes ZERO Port one outbound (8883), encrypted Approval one meeting; no new attack surface Standard traffic monitorable JSON over TLS ``` Outbound-only means the building calls the cloud, never the reverse — no inbound holes, and an IT approval that takes one meeting.

---

Related Topics

• MQTT for IoT in buildings — lightweight publish-subscribe telemetry
• What is BMS integration? — how a BMS connects VFDs, meters and other systems
• Browse all Protocols topics — more from this section of the EnSmart BMS Library