Browser monitoring

While browser monitoring is on, Live starts a small web server on its computer; the default port is 8080. The viewer enters the address of the Live computer in the browser (for example http://192.168.1.20:8080), logs on with a user name and password, and sees the pages with the same appearance as in Live, with data refreshed about once per second.

On the login screen, if Remember me (30 days) is selected, the session is valid for 30 days, otherwise for 12 hours. If a user is deleted or the password changes, the session becomes invalid.

• The system menu is simplified: pages, connection states, language, theme, interface language, font size and log out.
• Scripts, scheduled tasks and drivers run only in the Live program.
• Camera images and PDF Viewer files are delivered through the server, with a session.
• A page that requires authorization opens according to the session on the Live computer; until an authorized user logs on in Live, an authorization message appears instead of the page.
• If Web access › Viewable from browser / TV is switched off in the page properties, the page does not appear in the viewer’s list and is skipped in the TV sequence.

The server looks at the address the connection comes from. The Allowed addresses setting offers three options:

A rejected request receives a 403 response. If there are 5 failed logins from the same address within 10 minutes, that address is put on hold for 60 seconds. Passwords are stored in the project file as a SHA-256 hash. The origin of the request is checked, and the session cookie has HttpOnly and SameSite=Strict set. TV addresses have no password by default; for details see the TV and multi-monitor page.

For devices on the network to connect, Windows Firewall needs an inbound connection permission for this program and port. Add firewall permission does this: first the settings authorization is checked, then Windows administrator approval (UAC) is requested. The rule that is added is named “FabyaVision Uzaktan Izleme”; if the port changes, the old rule is deleted and a new one is added.

In Live, the system menu › Remote monitoring… window refreshes the server status every two seconds: status and number of viewers, browser and TV addresses (with Copy buttons), networks allowed to connect, the number of rejected connections, the last rejected address and the firewall state. If the port is used by another program, Live reports it; the server then runs on a random port bound to this computer only, so choose another port in the project.

To monitor over the internet, set up a VPN to the plant. The administrator first connects to the VPN, then opens the address on the local network in the browser. Only the VPN port is opened to the internet (UDP 51820 for WireGuard); the monitoring port and the PLC ports are not forwarded. FabyaVision also checks the source address: a request from an address on the internet receives 403 even if the router is opened by mistake.

• Define a separate browser user for each administrator, with a password that cannot be guessed and has at least 10 characters.
• If the VPN address pool is in a private block, no extra setting is needed; if it is in a public block, add it to the Access Networks list. In strict mode, enter the VPN subnet and the local network of the TVs in the list.
• Let the VPN client reach only the monitoring port on the Live computer, with no access to the PLC network.
• Keep the Live computer in a VLAN or DMZ separate from the PLC network and the office network. Generate a separate VPN key for each device.