What your site needs in place for MeshTrack to run.
The tracking mesh itself is wireless and battery-powered. What the site provides is the backbone behind it: a wired path from the gateways to the network, a stable internet connection, and — for an on-site deployment — a server that stays up around the clock. This sets out those requirements so IT, electrical and operations teams can prepare the site before commissioning.
Internet
Stable, redundant connectivity
Cloud-hosted: every position report crosses the link, so it needs a second path with automatic failover. On-site: the link carries Sethala's monitoring and alert delivery.
Gateways
Enterprise Ethernet or fibre
Wired PoE connections to every gateway are preferred. Where cabling is impractical, enterprise-grade managed Wi-Fi coverage at the gateway is acceptable.
Anchors
Battery operated, placed anywhere
No power or data cabling. Anchors are installed wherever monitoring is needed — haulages, workshops, stores, refuge bays, pit perimeters.
On-site server
Dedicated, powered 24/7/365
For an on-site deployment, a server or VM to the specified resources — on backup power and on the network. Sethala monitors it remotely in real time under the SLA.
Topology
From a tag on a machine to a screen in the control room.
Left of the site core, both deployment models are identical — the Wirepas 2.4 GHz mesh runs with no cabling and no mains. The model you choose determines only where the platform runs and what the internet link carries.
No server on site
The MeshTrack platform, dashboards, alerts and API run in the Sethala cloud. Gateways send position data out over the internet on MQTT/TLS (8883) and HTTPS (443). The internet link is part of the tracking path, so it needs a primary fibre plus an automatic-failover link.
Tracking keeps running if the internet drops
A dedicated on-site server or VM runs the platform on the site LAN (1 GbE), UPS- and generator-backed for 24/7/365 uptime. The internet link (443 outbound to the Sethala NOC) carries only monitoring, alert delivery and off-site backups — Wi-Fi is a fallback, not the primary path.
Requirements
Layer by layer — what must exist, and who provides it.
Where the two deployment models differ, items are marked CLOUD or ON-SITE; unmarked items apply to both.
Tags & anchors
Field layer
- Anchors are battery operated — no power cabling, no network drop. Place them wherever monitoring is needed: haulages, workshops, stores, lamp rooms, refuge bays, pit perimeters.
- Spacing of 10–15 m for sub-5 m positioning; 25 m is the absolute limit for mesh connectivity only. A tracked tag must sit inside a polygon of more than three anchors.
- Every level, shaft station and separate structure needs its own grid — coverage does not pass through rock or slab. Anchors at every exit and access-control point provide the unauthorised-removal alert.
- IP67 industrial housings; intrinsically safe (ATEX / IECEx) variants specified where the hazardous-area classification requires them.
Gateways
Mesh to network
- Enterprise Ethernet or fibre to each gateway is preferred — PoE (802.3af/at) from a managed switch, or a fibre media converter with local 12–24 V DC.
- Where cabling is impractical, enterprise-grade Wi-Fi (WPA2/3-Enterprise, managed controller, verified signal at the mount) is acceptable. Consumer or ad-hoc Wi-Fi is not.
- Minimum one gateway per level or building; Sethala specifies two per level for redundancy. One gateway serves up to 30,000 m², checked against tag count and reporting cadence.
- DHCP or static IP on a VLAN that can reach the platform. No inbound connections to a gateway are required.
Site network
Core, VLAN & firewall
- A dedicated VLAN for MeshTrack gateways (and the on-site server), routed through the site firewall.
- CLOUD — outbound from the gateway VLAN to the Sethala cloud on TCP 8883 (MQTT/TLS) and TCP 443. Nothing inbound from the internet.
- ON-SITE — gateways reach the server on TCP 8883; operator workstations on TCP 443. The server reaches Sethala outbound on TCP 443 only. Nothing inbound from the internet.
- NTP and DNS available to gateways and server (*.sethala.com, *.meshtrack.co.za). Underground: the gateway VLAN rides the mine's fibre backbone or leaky-feeder overlay to the shaft-station switches.
Internet
Site to Sethala
- CLOUD — all position data is sent to the cloud. The link is part of the tracking path: if it drops, the control room goes blind until it returns. Business-grade service with redundancy is required — two independent links with automatic failover at the firewall.
- ON-SITE — tracking does not depend on the internet; it runs on the site LAN. The link lets Sethala monitor the server, deliver alerts (SMS / email / push), push updates and take off-site backups. A stable business-grade link with a backup path (LTE/5G is adequate) is required.
Compute
Where the platform runs
- CLOUD — hosted and operated by Sethala. No server, storage or backup equipment on site. Operators use a modern browser; no client installation.
- ON-SITE — a dedicated physical server or a VM with reserved resources (VMware, Proxmox or Hyper-V), sized per project (see spec below). 1 GbE to the site core, fixed IP and DNS name so the web interface is served over HTTPS with a valid certificate.
- ON-SITE — online 24/7/365. Maintenance windows are agreed in advance; unplanned downtime is a tracking outage for the whole site.
Power
Keeping the backbone up
- Tags and anchors: battery — nothing to provide.
- Gateways: PoE from switches that are on UPS. A switch that loses power takes every gateway behind it — and that section — off the map.
- Site core (switching, firewall, internet CPE): UPS with generator or mine emergency-power changeover.
- ON-SITE — server: dual power supplies on a UPS sized for at least 30 minutes, generator-backed, with clean-shutdown signalling.
Monitoring & SLA
Remote operations
- CLOUD — Sethala monitors the platform continuously; gateway heartbeat exposes a site-side outage immediately, in the control room and at Sethala.
- ON-SITE — Sethala monitors the server, its resources and service metrics in real time, remotely, under the SLA — CPU, memory, disk, container health, message throughput and gateway heartbeat.
- ON-SITE — remote access is an outbound-only encrypted tunnel from the server to Sethala; no inbound firewall rule and no VPN account on the customer side. Nightly encrypted backups are pushed off site. Alerts go out by email, SMS, push, Telegram or webhook into the mine's own systems.
Internet link
Stable and redundant matters more than fast.
Mesh telemetry is small. What the platform needs from the internet link is consistency: low loss, steady latency, and a second path that takes over on its own.
| Option A · Cloud — link carries tracking | Option B · On-site — link carries monitoring | |
|---|---|---|
| Service class | Business fibre with SLA, dedicated to the site (not shared with guest or contractor Wi-Fi) | Business-grade fibre or fixed wireless |
| Bandwidth | 20 / 20 Mbps minimum symmetrical; more where dashboards are viewed off site | 10 / 10 Mbps minimum; nightly off-site backup completes within the window |
| Latency to cloud | < 150 ms round trip, steady | < 250 ms round trip |
| Packet loss | < 1 % sustained | < 2 % sustained |
| Redundancy | Required. Second link on independent infrastructure, automatic failover, tested quarterly | Strongly recommended. LTE/5G failover is adequate — it protects alert delivery and Sethala's response |
| If the link drops | Gateways cannot deliver reports; live map and alerts pause until the link returns | Tracking and in-app alerts continue; SMS/email alerts, monitoring and backups resume when it returns |
Worked example
reporting every 10 s across 4 gateways
position + sensor reports, all gateways
~200 bytes per report incl. MQTT + TLS
uncapped, or ≥ 100 GB plan on the backup link
On-site server · Option B
A machine that is never switched off.
Baseline for up to ~1,000 tags with 12 months of history — final sizing per the Deployment & Handover Record. Sign-in still needs the internet even on site: user authentication is issued by Sethala's identity service so accounts, roles and revocation are handled centrally.
Baseline specification
- Form
- Dedicated 1U/2U rack server, or a VM with resources reserved (not shared or ballooned)
- CPU
- 8 vCPU x86-64, 2.5 GHz or faster
- Memory
- 32 GB RAM
- Storage
- 500 GB NVMe / SSD on redundant storage (RAID 1/10 or resilient datastore)
- Network
- 2 × 1 GbE, fixed IP, DNS name for the web interface
- Operating system
- Ubuntu Server 24.04 LTS — installed and hardened by Sethala
- Larger sites
- Multi-shaft or > 2,500 tags: 16 vCPU · 64 GB · 1 TB, quoted per project
- Location
- Server room or IT cabinet: dust-controlled, cooled, physically secured
Firewall rules the server needs
- LAN → srv TCP 443 — operator browsers, web app and API
- GW → srv TCP 8883 — gateways, MQTT over TLS (1883 only inside the gateway VLAN)
- srv → WAN TCP 443 — Sethala identity (sign-in), monitoring, alert delivery, updates, off-site backup
- srv → WAN UDP 123 NTP · UDP/TCP 53 DNS
- srv → WAN Outbound-only encrypted management tunnel to Sethala (WireGuard, UDP 51820, falls back to 443)
- WAN → srv None. No port forwarding, no public IP, no customer VPN accounts required
Gateway connectivity
Wired is preferred. Enterprise Wi-Fi is acceptable.
Preferred — wired
- Medium
- Cat6/6A Ethernet ≤ 90 m from a managed access switch, or single-mode fibre with a media converter for longer runs and underground backbones
- Power
- PoE 802.3af/at from the switch (budget ≥ 15 W per gateway), or local 12–24 V DC where fibre is used
- Switching
- Managed switch, gateway ports in the MeshTrack VLAN, on UPS-backed power
- Mounting
- 3–4 m high, clear of large metal masses, within the anchor grid it serves; IP-rated enclosure underground
Acceptable — enterprise Wi-Fi
- Standard
- 802.11ac/ax on a managed controller; WPA2/3-Enterprise or a dedicated PSK SSID per site
- Coverage
- ≥ −65 dBm and ≥ 25 dB SNR at the gateway mounting point, confirmed by survey before installation
- Power
- Local mains via a UPS-backed circuit or 12–24 V DC — Wi-Fi gateways are not PoE-fed
- Not acceptable
- Consumer routers, mesh extenders, guest SSIDs, captive portals, or links that share an access point with public traffic
Sizing rule. Minimum one gateway per level, building or separate structure; Sethala designs two per level so a single gateway failure does not blind the level. One gateway serves up to 30,000 m² and is checked against the tag count and reporting cadence in the placement plan.
Power
Three tiers — only one of them yours to worry about.
Field devices
Nothing to install- Anchors: internal battery, multi-year life at standard cadence; replacement scheduled from the platform's battery reporting.
- Tags: battery; level reported per asset with a low-battery alert.
- No electrical work in the workings.
Gateways & network
Customer- Gateways powered by PoE from the access switch, or local 12–24 V DC where fibre is used.
- Access switches, core and firewall on UPS; generator or emergency-power changeover for extended outages.
- Internet CPE (fibre ONT / LTE router) on the same protected supply — a live server with a dead router still cannot alert anyone.
On-site server
Option B- Dual redundant PSUs on separate UPS-fed circuits where available.
- UPS runtime ≥ 30 min at load, with USB/network signalling for an orderly shutdown before batteries are exhausted.
- Generator-backed feed so the server rides through mine power events without a restart.
Underground. Gateway and switch enclosures follow the mine's IP rating, ventilation and hazardous-area requirements. Power and data to those enclosures are the mine's electrical scope; Sethala specifies each gateway's power and port needs per location in the placement plan.
Checklist
Site readiness checklist.
Commissioning is scheduled once every applicable item is confirmed. Work through this with the mine's IT and electrical leads.
Network
- Gateway VLAN created and routed through the firewall CUSTOMER
- PoE switch port (or fibre + local DC) at every gateway position on the placement plan CUSTOMER
- Where Wi-Fi is used: enterprise Wi-Fi coverage verified at each gateway mount with a site survey CUSTOMER
- Outbound TCP 8883 and 443 permitted from the gateway VLAN to Sethala cloud CLOUDCUSTOMER
- Server firewall rules applied (443 from LAN, 8883 from gateways, 443/123/53 outbound, nothing inbound from WAN) ON-SITECUSTOMER
- DNS and NTP reachable from the gateway VLAN CUSTOMER
Internet
- Primary business-grade link installed and meeting the latency and loss targets CUSTOMER
- Second, independent link with automatic failover — tested by pulling the primary CLOUDCUSTOMER
- Backup link (LTE/5G acceptable) with automatic failover ON-SITECUSTOMER
Server (Option B)
- Dedicated host or reserved-resource VM provisioned to the agreed specification ON-SITECUSTOMER
- Fixed IP, DNS name and 1 GbE connection to the site core ON-SITECUSTOMER
- Ubuntu 24.04 installed and hardened, platform deployed, monitoring connected ON-SITESETHALA
- First off-site backup completed and restore verified ON-SITESETHALA
Power
- Access switches feeding gateways, core network and internet CPE on UPS with generator changeover CUSTOMER
- Server on UPS ≥ 30 min with shutdown signalling, generator-backed feed ON-SITECUSTOMER
Field
- Anchor placement plan signed off against the mine's survey drawings SETHALA / PARTNER
- Site access, escorts and hazardous-area classification confirmed for every install location CUSTOMER
- Gateways mounted, powered and reporting heartbeat to the platform SETHALA / PARTNER
Figures are indicative until confirmed in the Deployment & Handover Record. Anchor and gateway sizing follows the published Wirepas smart-tracking installation guidelines. Meshtrack · A Sethala (Pty) Ltd platform.
Ready to plan a deployment?
Let's assess your site.
Send us your site drawings and network topology and we'll help you scope the gateway grid, the internet link and — if you need it — the on-site server, before anything is ordered.