Two Ways In, Band the Ports for Both
To connect a LoRaWAN gateway to a network server you need three things: somewhere to send the traffic, credentials the server will accept, and a region that matches the radio. ioX-Bridge takes gateways over Basics Station with a TLS client certificate, or over the ordinary Semtech UDP packet forwarder. Both are on this page, with the actual addresses.
One thing before anything else. The region you select when you register the gateway has to match the frequency plan the gateway is running. When it does not, packets are dropped without an error anywhere: the gateway looks healthy, the console looks healthy, and nothing arrives. It is the most common reason a correctly wired gateway never comes up, and it is the first thing to check rather than the last.
- US915, EU868 and AU915, each with its own UDP port and its own Basics Station endpoint
- Basics Station over a secure WebSocket, with a client certificate generated for that specific gateway
- The Semtech UDP packet forwarder, because a great deal of deployed hardware runs it
- No proprietary gateway required, and no vendor preferred
- A healthy gateway updates its last seen time roughly every thirty seconds, so you know within a minute
Three fields and a warning
Register the Gateway First
Nothing connects until the network server knows the gateway exists. Registering it takes three fields, and the console then shows you exactly where to point it.
Traffic only flows once the middle box is registered and pointed at the right regional endpoint.
| Field | What goes in it |
|---|---|
| Name | Something you will recognize on a list at two in the morning. A location works better than a model number. |
| Gateway ID | The gateway's EUI64, sixteen characters, usually printed on the label or shown in its own web interface. |
| Gateway region | US915, EU868 or AU915, matching the frequency plan the gateway is actually running. |
Once it is registered the gateway shows as never seen until it makes contact, and the console displays the endpoint details for the region you chose. The same details stay available afterward on the gateway's own dashboard, so you do not have to write them down.
Selecting the wrong region does not produce an error. It produces silence. Packets are dropped without a message, at either end, which is why a gateway that is wired correctly and configured correctly can still show nothing at all.
Trusted by teams monitoring critical infrastructure
Generated per gateway
How the Basics Station Certificate Works
A Basics Station gateway authenticates with a certificate of its own rather than a shared secret, so one compromised gateway does not put the rest of the fleet at risk. You generate it in the console, per gateway.
| Step | What happens |
|---|---|
| 1 | Open the gateway you registered and go to its TLS certificate tab. |
| 2 | Generate the certificate. It is shown once and never again, so put it somewhere before you close the page. |
| 3 | Install the certificate on the gateway as tc.crt, and the key as tc.key. |
| 4 | Install the public Let's Encrypt ISRG root chain as tc.trust, which is what the gateway uses to verify us. |
| 5 | Set the gateway's LNS URI to the secure WebSocket address for your region, from the table above. |
Certificates are valid for one year and do not renew themselves. Note the date somewhere you will see it, because an expired certificate presents exactly like a network fault: a gateway that was fine yesterday, with nothing in the logs to explain it.
Work top down
When It Does Not Come Up
Check these in order and stop at the first one that is wrong. Almost every failure at this stage is one of four things, and none of them require anybody to drive anywhere.
Still says never seen
The address or the port on the gateway does not match the endpoint shown on its dashboard. Compare them character by character rather than from memory; a transposed port number reads as correct at a glance.
Connects, then nothing arrives
The region is wrong. The gateway is talking and the packets are being discarded silently. Re-check the frequency plan the gateway is actually running, not the one it was ordered as.
Basics Station will not establish
Either the certificate files are not where the gateway expects them, or tc.trust does not hold the Let's Encrypt root chain. A gateway attempting to connect over plain unencrypted WebSocket, or with no client certificate at all, is refused.
It was working and stopped
Check the certificate expiry first if it is a Basics Station gateway. After that, whether anything changed on the network path outbound.
Gateway is up but a device is silent
Not a gateway problem. Open the gateway's LoRaWAN frames tab and power-cycle the device: if no join request appears at all, the device is out of coverage or on a different region, which is a device question rather than a connection one.
