LwM2M device management over private delivery
Updated
LwM2M lets you manage NB-IoT and LTE-M devices (configuration, firmware updates, diagnostics) over CoAP on UDP; on a private APN the server and the devices talk on private addresses, without NAT and without internet exposure. The protocol comes from the Open Mobile Alliance; an open-source server is Eclipse Leshan.
Status: Coming soon (checked 26 October 2026) · Notify me when available
Ports and transport
| Scheme | Transport | Default port | Source |
|---|---|---|---|
coap:// | UDP, no security | 5683 | RFC 7252 |
coaps:// | UDP with DTLS | 5684 | RFC 7252 |
Why private delivery suits LwM2M
- No NAT timeouts. Over the internet, a device behind carrier NAT loses its UDP mapping while it sleeps, and the server can no longer reach it until it registers again. On a private APN the device keeps a private address that routes straight to your server.
- No exposed UDP port. The server listens on a private address; internet scanners never see it.
- Fits sleeping devices. Devices in PSM or eDRX wake, send their registration update, and go back to sleep; queue mode on the server holds requests until then.
Set-up checklist
- Server: run Leshan (or a commercial LwM2M server) on a private IP in your cloud or datacenter.
- Firewall: allow UDP 5684 (and 5683 only for tests) from the SIM address range.
- Device: set the LwM2M server URI to
coaps://<private address>:5684and provision its DTLS credentials (pre-shared key or certificate). - Bootstrap (optional): an LwM2M bootstrap server on the same private network can hand out server addresses and credentials at first start.
- Test registration with one SIM, then a firmware update on a small group before the whole fleet.
More on the protocols: LwM2M, CoAP. MQTT instead: your own MQTT broker. The SIMs: IoT SIM cards.
Frequently asked questions
What is LwM2M used for?
LwM2M (Lightweight M2M, from the Open Mobile Alliance, now OMA SpecWorks) is a device management protocol on top of CoAP: registration, configuration, firmware update, location and connectivity statistics, with DTLS security.
Which ports does LwM2M use?
CoAP's default ports: UDP 5683 without security and UDP 5684 with DTLS (coaps), as defined in RFC 7252.
Why is a private APN useful for LwM2M?
LwM2M runs over UDP, and devices that sleep for hours lose their NAT mappings on public networks. On a private APN without NAT, each device keeps a fixed private address that the server can reach, and no internet scanner can.
Is there an open-source LwM2M server?
Yes. Eclipse Leshan provides Java libraries for LwM2M servers and clients, built on the Californium CoAP and Scandium DTLS implementations.