Remote access and VPN

7 min readLive

VPN setup for securely monitoring FabyaVision from outside the plant network (from home or the office): scenarios, a WireGuard example, FabyaVision settings, commissioning test and troubleshooting.

Approach

The remote monitoring server is read-only and does not use HTTPS; therefore it is not exposed directly to the internet (port 8080 is not forwarded on the router). The secure way is to set up a VPN to the plant: the administrator first connects to the VPN and then opens the address on the local network in the browser (http://<Live PC'sinin IP adresi>:8080). This guide is intended for the service engineer who performs the installation and for the customer's IT manager.

On its side, FabyaVision additionally performs a source address check: the server accepts connections only from private addresses (local network and VPN) and from this computer; a request from an address on the internet receives 403 even if the router is opened by mistake.

Component	Task
Administrator device	VPN client (phone, laptop).
Internet	Encrypted VPN tunnel (UDP 51820 for WireGuard).
VPN gateway	The router / firewall in the plant, or a small computer.
Live PC	Monitoring server at `http://<IP>:8080`; it connects to the PLCs over a separate network.

VPN gateway options

State	Recommended solution
The plant has a VPN-capable router / firewall (MikroTik, Fortinet, Zyxel, pfSense, Ubiquiti …)	The built-in WireGuard / OpenVPN / IPsec feature of the device
Device has no VPN support	WireGuard on a small computer (Raspberry Pi, mini PC, Windows Server)
No fixed public IP; behind a GSM modem / CGNAT	Tailscale (WireGuard-based, opens no ports) or ZeroTier; installed on the Live PC or on the gateway computer

If there is a public IP, a static IP or a DDNS name (e.g. tesis.firma.com) is used; only the VPN port is opened to the internet.

WireGuard example (gateway PC / Linux)

Let the plant network be 192.168.10.0/24, the VPN network 10.8.0.0/24 and the Live PC 192.168.10.20. This is an example; replace them with your own addresses and keys.

Server (/etc/wireguard/wg0.conf):

[Interface]
Address    = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <sunucu özel anahtarı>
# VPN istemcisi yalnızca Live PC'nin 8080 portuna erişsin
PostUp   = sysctl -w net.ipv4.ip_forward=1
PostUp   = iptables -A FORWARD -i wg0 -d 192.168.10.20 -p tcp --dport 8080 -j ACCEPT
PostUp   = iptables -A FORWARD -i wg0 -j DROP
PostUp   = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -d 192.168.10.20 -j MASQUERADE

[Peer]   # Üretim müdürü - telefon
PublicKey  = <istemci açık anahtarı>
AllowedIPs = 10.8.0.2/32

Client (phone / laptop):

[Interface]
Address    = 10.8.0.2/32
PrivateKey = <istemci özel anahtarı>

[Peer]
PublicKey  = <sunucu açık anahtarı>
Endpoint   = tesis.firma.com:51820
AllowedIPs = 192.168.10.20/32     # yalnızca Live PC (yöneticinin internet trafiği VPN'den geçmez)
PersistentKeepalive = 25

Thanks to the MASQUERADE line, the Live PC sees the local address of the gateway, not the address of the VPN client; no return route needs to be added on the Live PC. If you prefer to add a route, specify the local address of the VPN gateway as the gateway for 10.8.0.0/24 on the Live PC.

FabyaVision settings

Turn on monitoring
In Studio: Remote monitoring › General › Browser monitoring: On, port (default 8080).
Define a user
Browser users: a separate user and a strong password for each administrator (not guessable; at least 10 characters recommended). A user without a password cannot log on.
Set the permitted addresses
General › Access (VPN) › Allowed addresses:
- Local network and VPN (private addresses) (default): if the VPN pool is in a private block (10.x, 172.16–31.x, 192.168.x, Tailscale 100.64.x), no additional setting is needed.
- If the VPN pool is in a public block (e.g. 203.0.113.0/24), it is added to the Access Networks tab.
- Stricter: Only those in the “Access Networks” list; the VPN subnet (10.8.0.0/24) and the required local subnets (the network of the TVs) are entered in the list. No address that is not in the list can connect.
- If From anywhere (not recommended) is selected, Check project warns: the server is opened directly to the Internet and there is no HTTPS.
Consider the TV addresses
TV addresses (/tv1 … /tv8) are passwordless by default: anyone who knows the address and is on an allowed network can open them. Since only administrators enter the VPN, this is normally not a problem. If you want administrators to open the TV displays with a password as well, set Network TVs on the TVs watch without password tab to Off. In strict mode, both the VPN subnet (for administrators) and the local subnet of the TVs are entered in the list.
Add the firewall permission
On the Live computer, system menu › Remote monitoring… › Add firewall permission (Windows asks for administrator approval). Details: Remote monitoring.

The Remote monitoring window in Live shows the browser addresses, the networks permitted to access, the number of rejected connections and the last rejected address. If a VPN client cannot connect, add the network of that address to Access Networks.

Firewall and network rules

From the internet to the plant, only the VPN port (UDP 51820 for WireGuard) is opened. 8080 and the PLC ports (S7: 102, Modbus: 502 …) are never forwarded.
The VPN client must not be able to reach anything on the Live PC other than TCP 8080 (no access to the PLC network). The iptables rules in the example enforce this.
It is recommended to keep the Live PC in a VLAN / DMZ separate from the PLC network and the office network.
Generate a separate VPN key for each device; if a phone is lost or an employee leaves, only that key is deleted.
Install operating system updates on the gateway and the Live PC regularly; the VPN management interface must not be reachable from the internet.

Commissioning test

From inside the plant
http://<Live PC>:8080 opens, the user logs on, and the screens appear live.
With the VPN off
The phone is switched to mobile data; with the VPN off, the address does not open (timeout). This confirms that there is no direct access from the internet.
With the VPN on
The VPN is turned on; the same address opens, the user logs on and live values flow.
Check in Live
In the Remote monitoring window, the viewer count increases; Rejected connection is 0.
Try it in strict mode
An attempt from an address that is not in the list returns 403 — Bu adresten erişime izin verilmiyor and the rejected counter increases.
Wrong password
5 attempts with a wrong password: that address is put on hold for 60 seconds.

Troubleshooting

Symptom	Possible cause	Solution
VPN connected, page does not open (timeout)	No Windows Firewall permission	Live › Remote monitoring › Add firewall permission
Same symptom	No return route: the Live PC does not know the VPN network	Add `MASQUERADE` or add a route for `10.8.0.0/24` on the Live PC
`403 Bu adresten erişime izin verilmiyor`	The VPN pool is in a public address block, or is not on the list in strict mode	Add the last rejected address shown in the Live window to Access Networks
The login page appears, but login does not succeed	The browser user has no password / the password is wrong	Enter the password again in the Browser users table
Small screen on the phone	The screen size is large	Hold the phone in landscape orientation; the screen is scaled (zooming is free)
VPN does not connect over mobile data	The network provider restricts UDP / port is closed	OpenVPN TCP 443 or Tailscale

Limitations and points to note

There is no HTTPS; exposing it to the internet without a VPN means that passwords are sent in plain text.
The VPN configurations in this section are examples; also refer to the documentation of the VPN product you use. Perform the commissioning test (above) for every installation.
When monitoring from a phone, the screen is scaled from the size it was designed for; screens designed separately for small displays are easier to read.