Raspberry Pi Connect is the official secure remote access service from Raspberry Pi Ltd, allowing you to SSH or VNC into your devices without exposing ports to the public internet. However, a remote access service is only as reliable as the physical hardware keeping it online. For always-on deployments—like remote weather stations, 3D printer farms, or edge AI cameras—relying on a USB-C wall wart and flaky Wi-Fi is a recipe for dropped sessions.
This guide walks through the physical wiring diagram of a rock-solid Raspberry Pi 5 paired with an 802.3at Power over Ethernet (PoE+) HAT. We will trace the power and data paths node-by-node, map the exact terminals, and verify the wiring with a multimeter before you ever run the rpi-connect software installation.
The Physical Path: Tracing Power and Data for Pi Connect
To understand how to install Raspberry Pi Connect reliably, you must first understand the physical layer delivering power and network connectivity. When using a PoE+ HAT, a single Cat6 cable carries both 48V DC power and Gigabit Ethernet data. Here is the node-by-node trace from the source to the load.
- Source (PoE+ Switch): An 802.3at compliant switch injects 48V DC onto the Ethernet spare pairs (pins 4,5 and 7,8) or data pairs (pins 1,2 and 3,6).
- RJ45 Jack & Magnetics: The cable enters the PoE+ HAT's RJ45 jack. The schematic symbol here is a center-tapped transformer (magnetics module). This provides galvanic isolation for the high-frequency data pairs, blocking common-mode noise while allowing AC data signals to pass.
- Active Bridge Rectifier: The 48V DC power is routed through an active MOSFET bridge (represented by four N-channel MOSFET symbols arranged in an H-bridge). Unlike a standard diode bridge, this minimizes voltage drop and heat dissipation.
- Flyback Transformer (Isolation Stage): The 48V enters the primary winding of a flyback transformer (symbolized by two inductors with a core line and polarity dots). This is the most critical safety node: it galvanically isolates the 48V source from the 5V Pi side, preventing high-voltage transients from frying your board.
- DC-DC Buck Controller & Output: The secondary winding feeds a rectifier and filter capacitors, outputting a regulated 5.1V DC. This travels through the HAT's 4-pin power header directly into the Raspberry Pi 5's 5V rail.
- Load (Pi 5 PMIC): The 5.1V enters the Pi 5's DA9098 Power Management IC (PMIC), which distributes power to the BCM2712 CPU, RAM, and peripherals, keeping the board online for your Connect session.
If you are reading the official PoE+ HAT schematic, the polarity dots on the flyback transformer indicate the phase relationship between the primary and secondary windings. The Zener diode symbol across the primary winding represents the snubber circuit, which absorbs voltage spikes when the MOSFET switches off, protecting the silicon from inductive kickback.
Terminal and Pin Mapping Table
The official Raspberry Pi PoE+ HAT connects to the Pi 5 via two distinct physical interfaces: the standard 40-pin GPIO header (for data and control) and a dedicated 4-pin PoE power header (for high-current 5V delivery). Below is the exact terminal mapping.
| HAT Function / Pin | Pi 5 Physical Pin | Signal / Voltage | Polarity & Ground Path Notes |
|---|---|---|---|
| PoE 5V Out (+) | 4-Pin Header (Pins 1 & 2) | +5.1V DC (up to 5A) | Positive Rail: Feeds directly to the Pi 5 USB-C power input circuit internally. |
| PoE GND (-) | 4-Pin Header (Pins 3 & 4) | 0V (Ground) | Return Path: Ties to the Pi's main ground plane. Note: This ground is isolated from the Ethernet cable shield. |
| Fan PWM Control | GPIO 40-Pin (Pin 32 / GPIO 12) | 3.3V Logic PWM | Drives the HAT's 25mm cooling fan. Active high. |
| Fan Tachometer | GPIO 40-Pin (Pin 33 / GPIO 13) | 3.3V Logic Pulse | Feedback loop for fan RPM monitoring. |
| I2C SDA / SCL | GPIO 40-Pin (Pins 3 & 5) | 3.3V I2C | Used by the HAT's onboard microcontroller for power negotiation and fan curves. |
Explicit Ground Path Analysis: A common point of confusion is the ground reference. The 48V DC ground from the PoE switch does not connect to the Raspberry Pi's ground plane. The flyback transformer on the HAT breaks that DC path. The Pi's ground plane is established solely by the secondary side of the HAT's power supply. This means if you connect an oscilloscope probe's ground clip to the Pi's GPIO ground, and the probe's earth ground to the building's mains earth, you will not short out the 48V PoE source. The isolation protects both your equipment and your measurement tools.
Verifying the Wiring with a Multimeter
Before seating the Pi 5 onto the HAT standoffs and applying network power, you must verify the HAT's output. A misconfigured passive PoE injector can send 24V or 48V straight into the 5V rail, instantly destroying the PMIC and the BCM2712 SoC.
- Isolate the Load: Do not connect the Raspberry Pi 5 to the HAT yet. Mount the HAT on its standoffs, but leave the 4-pin power header and 40-pin GPIO unseated from the Pi.
- Inject Power: Plug the Cat6 cable from your 802.3at PoE+ switch into the HAT's RJ45 jack. The HAT's onboard LED should illuminate, indicating successful 802.3at handshake and power negotiation.
- Verify Open-Circuit Voltage: Set your digital multimeter to DC Voltage (20V range). Place the red probe on Pin 1 of the HAT's 4-pin power header and the black probe on Pin 3 (Ground). Expected Reading: 5.10V ± 0.05V. If you read 48V, unplug immediately; you are using a non-compliant passive injector.
- Verify Ground Isolation: Set your multimeter to Continuity/Resistance mode (Ω). Place one probe on the metal shielding of the RJ45 jack (Ethernet shield ground) and the other on Pin 3 of the 4-pin power header (Pi DC ground). Expected Reading: OL (Open Loop) or >1 MΩ. If you read near 0 Ω, the HAT's isolation has failed or you are using a counterfeit board. Do not proceed.
- Load Test (Post-Assembly): Once verified, seat the Pi 5, boot the system, and back-probe the 5V test pads (TP1 and TP2 on the Pi 5 board) while the system is under load. The voltage should not drop below 4.9V during peak CPU bursts.
Software Handoff: Enabling the Connect Service
With the physical layer verified and the Pi 5 booted via PoE+, you can now install the software layer. Raspberry Pi Connect relies on a lightweight daemon that establishes an outbound WireGuard tunnel to the Raspberry Pi relay servers, eliminating the need for port forwarding.
Open your terminal (via local SSH or direct keyboard) and run the following commands:
# Update package lists and install the Connect daemon
sudo apt update
sudo apt install rpi-connect
# Sign in to your Raspberry Pi ID account
rpi-connect signin
The rpi-connect signin command will output a URL and a 6-character verification code. Navigate to connect.raspberrypi.com on your main PC, enter the code, and assign a name to your device. Because your Pi is hardwired via PoE+, this connection will persist through power flickers and router reboots, provided your switch restores PoE quickly.
Frequently Asked Questions
How do I install Raspberry Pi Connect on a headless Pi Zero 2 W without Ethernet?
The Pi Zero 2 W lacks a native Ethernet port and cannot use a standard PoE HAT. To use Raspberry Pi Connect on this board, you must rely on Wi-Fi or wire a USB-to-Ethernet adapter via a micro-USB OTG cable. Install the OS via Raspberry Pi Imager, pre-configuring your Wi-Fi SSID and enabling SSH in the userconf settings. Once booted, SSH in over the local network and run sudo apt install rpi-connect. Note that Wi-Fi dropouts will interrupt your Connect VNC sessions, so ensure a strong 2.4GHz signal at the deployment site.
Why does my Raspberry Pi Connect session drop when using a passive 24V PoE injector?
Passive PoE injectors do not perform the 802.3af/at handshake; they simply force voltage onto the Ethernet pairs. If you use a 24V passive injector with a Pi 5 PoE+ HAT, the HAT's undervoltage lockout (UVLO) circuit will detect that the input is below the required 36V threshold and shut down the DC-DC converter. The Pi will brownout, reboot, and drop the Connect session. Always use an active 802.3at (PoE+) switch or injector that outputs 48V and negotiates power draw.
Can I wire a cellular LTE HAT instead of Ethernet for Raspberry Pi Connect?
Yes, Raspberry Pi Connect works over any IP connection, including cellular. If you are wiring a Waveshare SIM7600 or Sixfab LTE HAT, the power path traces from the Pi's 5V rail to the HAT's buck converter, then to the SIM module. Ensure your power supply can deliver at least 3A, as LTE modules draw up to 2A peak during transmission bursts. Once the cellular PPP or QMI interface is established and routing traffic, the rpi-connect daemon will tunnel out over the cellular network just as it would over Ethernet.
