Connecting to a PLC from anywhere

VPN
1

Hi guys,

I’m trying to figure out how to connect to a (Usually AB, sometimes Omron or Beckhoff) PLC with internet connection from any location. My laptop has a VPN connection back to the office, and I was told that would be used in the process. Any resources or websites that explains this would be greatly appreciated!

2

First off, the PLC doesn’t need Internet access. Internet on the plant floor is a terrible idea unless you have a really good IT department, and even then I’d still recommend not doing it. You need a VPN server or router on the plant network that is connected to the Internet. Best practice would be two NICs on the server, one for plant network (LAN side of router), and one for Internet/Business network (WAN side of router). You’ll connect to that VPN server with your laptop remotely and it’ll be like you’re on the plant network.

If there’s already a machine on their network running TeamViewer, there is an option to just open a VPN connection rather than remotely controlling the machine.

Edit: Also recommend that you show the customer how to turn the VPN connection on and off. They should only enable it when you need remote access and shut it down when you’re done. That way if anything wonky ever happens, they can’t accuse you of causing the problem.

3

We use a thing called an eWon Cosy 131. It can have an incorporated 3G/4G modem or use site available internet for connection. Allows you to VPN in and access all devices on the network. The models with the modem incorporated can even share internet to devices on the network over Ethernet for example an HMI so you can VNC/Teamviewer straight in without connecting to the VPN. Great little units.

4
5

eWON

Explanation:
There are two ways to connect remotely to a PLC, the way that requires permission from a customer IT guy and the way that doesn’t. I could tell you all about port forwarding and whatnot, but it’s never going to work because customer IT comes in three flavors: incompetent, absent, or self-righteous paranoid and you’ll never get them to let you set it up.

So, you need a product that uses hole punching and the most known is eWON. There are others, and I think Contemporary Controls has decided to take on eWON as well, which should provide really cheap options, but I’ve only used eWON and it works great. They run internet to the wan port and it just works, if they get all paranoid about it, they can just disconnect the cable.

6

Are you a student?

If not, what PLC are you connecting to? Do you have the software?

VPN connection will only get you so far.

7

Use an eWON or similar product. They offer a fairly straightforward solution that uses outbound connections over ports 443 and 1196 so that your IT department usually doesn’t have to do anything. If you want, I can probably get you a discount on one as well. PM me if you’d like.

This should be all you need

8

You could use a 9300-RADES module. It requires a phone line, but you will be able to ‘dial in’ to the RADES module using your computer and the PLC will be connected to the RADES module with an ethernet cable.

RADES Quick Start

RADES Manual

9

With a modem connected to a PLC, is there any way to monitor an input from the web? I’m thinking about a home-automation style DIY irrigation system that could check a weather forecast online. For example, if the chance of precipitation today is greater than 75%, then do not water the lawn this morning. I’m becoming somewhat PLC competant, but quite illiterate with html. Any resources out there?

10

We use sierra wireless Raven XE cell modems, no need to interface at all with any plant internet. If cell service is not available then we use a COSY with wired enet.

11

Just stumbled across this. A bit late for a response but it’s an interesting topic and I will put my 2 cents here .Have been exploring this for the last few years to apply on PLC based systems in the field. In the process, I’ve tried or looked into most of the options mentioned in this thread.

There seem to be a number of other solutions out there and there are various aspects to how their services are differentiated. This makes it harder to pick one unless you can define your requirements and use cases clearly.Some of the things to define:

  1. How many users will need to access it simultaneously
  2. Will mobile device access be required- for example, I often require access( from a mobile device) to a HTML5 WebVisualization located on the PLC. With some providers( like eWon) there is a mobile client that can be used. If this is required, check on item 1 above for limitations in this aspect too.
  3. How much data is being passed through for program downloads …etc…

Another solution out there is HMS’s Netbiter. The solution I am liking now is InHand Networks for the following reasons:

  1. I am able to access the PLC HTML5 pages via a secure login directly without having to route through the 3rd party provider network and a paid data service.
  2. For more secure work, like program downloads, the VPN connection can be used and is paid by usage time.
  3. Both of the above can be done without changing gateway configurations.

There also seem to be custom service providers out there like ei3 that seem provide end to end support in a more customized way.

If you’re willing to put time and effort into setting up your own network, Cradlepoint or Sierra Wireless may be able to provide the components required for the connectivity portion.

So, in summary, lots of options. It is important to be clear on what you need from a requirements perspective( user access,ongoing cost, amount of data…) or the options will be harder to compare/differentiate.

12

I too had this question once. After much googling I found the answer:

*Check my post history for confirmation of this.

13

Here’s Phoenix Contact’s technical paper on it. (pdf warning)

14

Look into an M guard.

15

I use Siemens so I use their teleservice adapter - it gives you a VPN connection through the site at which the PLC is located. The PLC/drives/remote IO all sit on their own network and the teleservice adapter gives me a connection onto that network without the need of an additional computer. Other manufacturers make similar ones - you didn’t originally state which brand you use.

16

can you ping the plc when onsite?
if so then vpn from home and try to ping.
if you cannot then network admin has to set up proper routes to the plc vlan/subnet.
vpn purpose is to connect you to the local network, and your pc will obtain an additional ip address. make sure your home lan and work network are different subnets, otherwise both ips your pc now has leased might conflict.

17

You’ll connect to that VPN server with your laptop remotely and it’ll be like you’re on the plant network.

Does this require TeamViewer? We would like to avoid additional software if possible.

18

EWON’s tunneling is supposed to be really good.

19

I work for a controls company. We usually deal with AB PLCs but also Omron, beckhoff, etc every now and then.

20

After a lot of research, they look like the best contender and probably the likely choice. Although apparently Secomea is the only product of its kind to pass an independent 3rd party security audit, and unlike some others, hasn’t been hacked by Malware, or subject to the Heartbleed vulnerability… Security is a big one.