Networking & Security

OpenFollow targets trusted LAN deployment. A few settings are worth reviewing before running on a shared production network.

Pi network configuration

IPv4 is configurable from two places: the on-device Settings → Network screen and the web UI's General → Network panel. The web form is gated by the Web PIN like every other config section – adequate on a trusted LAN, so keep the show network trusted. On some hosts the web panel is read-only; configure from the device screen instead.

Apply validates the IP and subnet before committing. A router / default gateway is optional – leave it blank on a flat show LAN (Art-Net, sACN, PSN) with no internet egress; when supplied it must sit inside the subnet. Invalid input surfaces a banner and nothing is committed.

Web PIN

Set a PIN under General → Web Access. While unset, every web route is open. Once set:

• Browsers must enter the PIN to reach any non-asset route.
• Peer-to-peer broadcasts between OpenFollow instances are authenticated with the PIN. The PIN itself never travels on the wire.

Treat the PIN as operator credentials. Anyone who has it can change settings and install a software update onto the device.

Leaving the PIN unset is acceptable on bench networks only. Production setups should always have one.

OSC input allowlist

OpenFollow accepts /marker/<id> x y z on the OSC input port (default 8765). Without a sender allowlist, any device on the LAN can hijack marker positions. The startup logs print a prominent warning when the allowlist is empty.

Configure under Input → OSC Input → Allowed sender IPs as a comma-separated list:

192.168.1.10, 192.168.1.20, 10.0.0.50

List one IP per authorised control surface – the touchscreen, the lighting console, the show control machine. Leave blank only when you are absolutely sure the LAN is trusted (e.g. dedicated point-to-point cable to a single sender).

Peer broadcast

OpenFollow instances discover each other on the LAN and can apply settings to peers via the Apply to all stations button. Outgoing peer-sync requests are restricted to private destinations only:

• RFC 1918 – 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
• Link-local – 169.254.0.0/16
• Loopback – 127.0.0.0/8

Public destinations are silently rejected. You cannot accidentally broadcast settings to a routable address.

Peer requests are authenticated with the Web PIN. A peer with a different PIN (or no PIN) will reject the request.

Software updates

OpenFollow updates from General → Software Update in the web UI – Check & Install Latest downloads and installs the newest release over the internet, or Offline install installs a release package you upload over the LAN. Either path restarts the service onto the new version. See Updating.

• Authentication – anyone with the Web PIN can install an update and restart the service. There is no separate update credential; the PIN is the gate.
• Trust – an offline upload is installed as a system package. Only upload .deb files you trust.

Time sync

A Raspberry Pi has no battery-backed clock, so on startup – and whenever its network address changes – a station with internet access sets its clock over NTP from the time server run by the Physikalisch-Technische Bundesanstalt (PTB), the national metrology institute of the Federal Republic of Germany. It runs in the background alongside the automatic update check and fails silently on a show LAN with no uplink, so it never blocks startup or the render path.

Multicast on managed switches

PSN and OTP are multicast, and OSC input is too when a Multicast group is set. Managed switches need IGMP snooping enabled with a querier on the relevant VLAN.

If a console doesn't see PSN despite OpenFollow sending, run tcpdump -ni any host 236.10.10.10 on a Linux box on the same VLAN. Visible there but not at the console = switch fabric dropping multicast.

Wired vs Wi-Fi

Use wired Ethernet for production.

VLANs and routing

If your venue runs separate VLANs for control vs production traffic, OpenFollow should typically live on the show-control or lighting VLAN with the consoles. Crossing VLANs:

• OSC unicast routes between VLANs trivially if the router permits it.
• Multicast (PSN, OTP, and OSC input when a multicast group is set) needs PIM or another multicast routing protocol on the router. Most production networks don’t bother – keep OpenFollow and PSN consumers on the same VLAN.

Ports used by OpenFollow

OpenFollow binds the configured web port (default 80) and at most one alternative (8080 or 2010, whichever is free). Behind a host firewall, allow inbound on whichever Web UI port the diagnostics surface reports as Serving on, plus the OSC input port.