Network setup with standard hardware
How the internal network of a Rosepetal deployment is configured using the standard project hardware, and how it adapts to sites that do not allow an external router or do not provide internet access.
Standard configuration PDF
Download standard network setup (PDF, 3 pages)
Router-based topology, camera addressing and installation criteria.
The standard equipment of a Rosepetal project is mounted in the AIS rack, with the Panel PC and cameras connected to it:
| Equipment | Function |
|---|---|
| Router (Teltonika RUT901) | Internet uplink (DHCP or client IP), management network and optional 4G connectivity |
| Switch | Internal camera network (2.5 Gbps) |
| Rosepetal Controller | Runs the Rosepetal software: inference, logic and camera management |
| Panel PC | Operator interface on the plant floor |
| Cameras | Image capture on the production line |
Internal network scheme
There are three installation scenarios. All of them keep the cameras on the internal camera switch connected to dedicated interfaces of the Controller.
Standard scenario — recommended
The Rosepetal router connects the Panel PC and the Controller's management interface. Its WAN interface connects to the company network; a 4G uplink can also be used when agreed for the project.
This scenario offers the most flexibility, including 4G connectivity during installation while the company network connection is being prepared. Mobile connectivity remains subject to site approval, coverage and an active data plan.
The four standard connectivity services have distinct roles:
| Service | Device / scope | Users / purpose |
|---|---|---|
| Google Cloud | Controller — outbound HTTPS/TLS on TCP 443 | Rosepetal Platform interaction and system updates |
| Cloudflare Tunnel | Rosepetal web software on the Controller | Customer and remote support |
| RustDesk | Remote desktop on the Panel PC | Remote support |
| Tailscale | Remote maintenance of the Controller, including SSH | Remote support |
See the standard remote-access scenario for the firewall rules for all four services.
Standard example with four cameras:
Reference addressing and connections:
| Equipment | Interface | IP |
|---|---|---|
| Router | WAN (RJ45 1 Gbps, DHCP or fixed IP) | Client-defined |
| Router | LAN | 10.10.100.1 |
| Panel PC | RJ45 1 Gbps to router | 10.10.100.150 |
| Rosepetal Controller | USB 1 Gbps adapter to router | 10.10.100.100 |
| Rosepetal Controller | RJ45 2.5 Gbps to internal switch (camera network 1) | 10.10.1.100 |
| Rosepetal Controller | USB 2.5 Gbps adapter to internal switch (camera network 2) | 10.10.2.100 |
| cam1 / cam2 | Internal switch | 10.10.1.10 / 10.10.1.11 |
| cam3 / cam4 | Internal switch | 10.10.2.12 / 10.10.2.13 |
Restricted scenario — company switch
For controlled environments where an external router is not permitted, the Panel PC and the Controller's management interface connect directly to a company switch. The Controller retains its dedicated connections to the internal camera switch; the cameras are not connected to the company switch.
Addressing must be agreed before shipment
The Panel PC and the Controller's company-facing interface obtain their addresses through DHCP, or the customer's IT team must provide the fixed IP configuration before the system is shipped. For fixed addressing, provide both IP addresses, subnet mask, gateway and DNS servers, together with any VLAN or switch-port requirements.
| Equipment / scope | Connection | Addressing |
|---|---|---|
| Panel PC | Company switch | Company DHCP or fixed IP supplied before shipment |
| Controller — management interface | Company switch | Company DHCP or fixed IP supplied before shipment |
| Controller — camera interfaces | Internal camera switch, 2.5 Gbps | 10.10.1.100 and 10.10.2.100 |
| cam1 / cam2 | Internal camera switch | 10.10.1.10 / 10.10.1.11 |
| cam3 / cam4 | Internal camera switch | 10.10.2.12 / 10.10.2.13 |
This scenario offers fewer commissioning and connectivity options: there is no Rosepetal router or independent 4G uplink in this topology. Installation and remote support depend on the company network being ready and the required access being allowed by IT.
Offline scenario — no internet
For the most restrictive sites, where no internet access is available and the Panel PC is supplied and installed by the customer. The Panel PC connects to the company network, which has no internet access, and the Controller connects only to the Panel PC through a direct point-to-point link. The Controller has no connection to the company network and no internet access.
Remote support is performed through the customer's VPN (virtual private network) or VDI (virtual desktop infrastructure) to the Panel PC. From that session, the Rosepetal web interface on the Controller is reached over the direct link. Cloudflare Tunnel, RustDesk, Tailscale and Google Cloud are not used in this scenario.
Customer-provided Panel PC and remote access
The customer supplies and installs the Panel PC with two network interfaces: one for the company network and one dedicated to the direct link with the Controller. The customer also provides the VPN or VDI access used by Rosepetal support to reach the Panel PC, together with the access procedure and any scheduling constraints, before commissioning.
| Equipment / scope | Connection | Addressing |
|---|---|---|
| Panel PC — company interface | Company network (customer-managed) | Company DHCP or fixed IP |
| Panel PC — Controller interface | Direct link to the Controller, RJ45 1 Gbps | 10.10.100.150 |
| Controller — management interface | Direct link to the Panel PC | 10.10.100.100 |
| Controller — camera interfaces | Internal camera switch, 2.5 Gbps | 10.10.1.100 and 10.10.2.100 |
| cam1 / cam2 | Internal camera switch | 10.10.1.10 / 10.10.1.11 |
| cam3 / cam4 | Internal camera switch | 10.10.2.12 / 10.10.2.13 |
The direct link uses the Rosepetal reference addresses with fixed IPs and no gateway; the Panel PC must not route or bridge traffic between the company network and the Controller.
Without internet access from the Controller, Rosepetal Platform interaction and system updates are not available online. Image export, model deployment and software updates are handled on-site, or through files transferred via the Panel PC, as agreed for the project. Installation and remote support depend on the customer's VPN or VDI access being ready.
Choosing a scenario
| Capability | Standard | Restricted | Offline |
|---|---|---|---|
| Management connection | Rosepetal router LAN | Company switch | Direct link Panel PC ↔ Controller |
| Management addresses | Rosepetal reference scheme | Company DHCP or agreed fixed IPs | Rosepetal reference scheme on the direct link |
| Panel PC | Supplied by Rosepetal | Supplied by Rosepetal | Supplied and installed by the customer |
| Controller internet access | Yes, through the router | Yes, through the company network | No |
| Remote support | Cloudflare Tunnel, RustDesk and Tailscale | Cloudflare Tunnel, RustDesk and Tailscale | Customer VPN or VDI to the Panel PC |
| Rosepetal Platform and system updates | Online, via Google Cloud | Online, via Google Cloud | On-site or via file transfer, as agreed |
| Independent 4G during installation | Available when approved and provisioned | Not included in this topology | Not included in this topology |
| Internal camera switch | Yes | Yes | Yes |
| External router required | Yes | No | No |
Design criteria
- The management network is kept separate from the camera networks (
10.10.1.x,10.10.2.x), split across two 2.5 Gbps interfaces of the Controller to maximize capture bandwidth. In the standard scenario, management uses10.10.100.x; in the restricted scenario, it uses company-assigned addresses; in the offline scenario, the direct Panel PC ↔ Controller link uses10.10.100.xwith fixed IPs. - The Controller is the only device present in both scopes; the cameras have no internet access. Do not bridge or route the camera networks onto the company network.
- In the offline scenario, the Controller has no interface on the company network. The Panel PC is the only device present in both the company network and the Controller link, and it must not route or bridge between them.
- In the standard scenario, the router gets internet from the client through its RJ45 1 Gbps WAN interface, using DHCP or a fixed IP.
- In the restricted scenario, IT must allow the Panel PC to reach the Controller's web interface and provide the required outbound connectivity for the selected remote-access method.
- In the offline scenario, IT must provide the VPN or VDI access to the Panel PC used for remote support, and agree the procedure for system updates and model deployment without internet access.
- Confirm that the reference camera networks do not overlap with company routes before installation; agree alternative addressing if necessary.
The physical network layout and the remote-access method are separate choices. See IT configuration for remote access for the standard Google Cloud + Cloudflare Tunnel + RustDesk + Tailscale service combination. Google Cloud connectivity is required for Rosepetal Platform interaction and system updates in the standard and restricted layouts. The offline layout has no cloud connectivity and relies on the customer's VPN or VDI for remote support.
Select any diagram to open it at full size.