For IT teams and network administrators. Short version: displays only make outbound connections, to 7007.me on TCP 443.
What to allow
| Direction | Protocol | Port | Destination | Purpose |
|---|---|---|---|---|
| Outbound from the display | TCP (HTTPS/TLS) | 443 | 7007.me | Registration, polling, status, content download |
No inbound port needs to be opened to the displays. No VPN is required.
Why other guides say 7001 or 7002
On a self-run MagicInfo server, the default ports are 7001 (plain) and 7002 (encrypted). Guides written for those servers, and some other hosts, tell you to open those ports. Our hosted server is reached on 443 with TLS on. Opening 7001 or 7002 does nothing for it.
Display settings that match
- Server address:
7007.me - TLS: "Use" (on older models this setting is called SSL)
- Port: 443
Notes for firewall and proxy admins
- Allow by hostname if your firewall supports it. Use the name
7007.me, not an IP address: the address behind the name can change, so do not pin it. - TLS inspection or TLS-decrypting proxies can break the connection, because the display will not trust a re-signed certificate. Exempt
7007.mefrom inspection. - DNS: displays must be able to resolve
7007.me. Block lists and filtering DNS services should not block it. - Time: the display needs a correct clock (NTP or manual) for TLS to work. Allow NTP (UDP 123) outbound if you rely on network time. The display keeps its own clock; the server sends it UTC only.
- IPv6:
7007.mehas no IPv6 address (checked 2026-10-16), so the display needs working IPv4. - Captive portals (hotel or guest Wi-Fi with a login page) block displays. Use a wired or business connection.
- Connections are long-lived polling. Short idle timeouts on NAT or firewall sessions can cause reconnects but should not break service.
How to test
From a computer on the same network as the display, open https://7007.me/ in a browser. A page response of any kind (including "not found") shows the name resolves and port 443 is open. This does not prove the display itself can connect; confirm on the display (see the troubleshooting checklist).
Quick answer for your IT contact
"Allow outbound TCP 443 to 7007.me from the signage VLAN. No inbound rules. Do not TLS-inspect that hostname."