VIGIL MESH
LoginCréer un compte

Documentation

Remote PLC access without port forwarding

Getting back online with a PLC installed on the other side of the country, without opening a single port: that is what remote PLC access with VIGIL-MESH delivers. Your engineering workstation behaves as if it were plugged into the workshop switch: TIA Portal, EcoStruxure Control Expert or Studio 5000 talk to the overlay address of the gateway serving the PLC — while the PLC's ports stay closed to the Internet.

Programming a PLC remotely, as if you were local

A program download, an online diagnosis, a variable to force: most PLC interventions do not require standing in front of the cabinet — they require being on the same network as the controller. That is exactly what the mesh does: it extends the machine network to your engineering workstation, under strict control.

Your tools, unchanged

TIA Portal, Control Expert or Studio 5000 connect by entering an address, exactly as they would for a controller on the local network.

Hands-on access without a site VPN

No VPN to have installed at the customer's, no account on their firewall: the gateway only makes outbound connections.

Compartmentalised by ACL

Every access is nominative: this technician, this gateway, this port. The rest of the network does not exist for them.

This page focuses on hands-on PLC access. The bigger picture — market gateway boxes, real LAN, scenarios — lives on Industrial remote maintenance.

The agent lives on a site gateway, never inside the PLC

Let us be precise, because this is the key point: the VIGIL-MESH agent does not install inside the PLC. It runs on an operating system — a Windows or Linux industrial PC, an NVIDIA Jetson, a Linux box — sitting on the same machine network as the controller. And often that machine already exists: it is the line's HMI or supervision PC.

  • The PLC does not change: no firmware, no program, no network configuration. It stays within its perimeter, as validated by its manufacturer.
  • PLC ports stay closed to the Internet: S7 (102/TCP), EtherNet/IP (44818), Modbus (502) are only reachable through the mesh, by the peers the ACL authorises, via the gateway.
  • Access is machine by machine: no “subnet router” opening a whole /24 — each reachable device is reachable because a gateway serves it and a rule allows it.
Console inventory: the workshop gateway is active, with its stable overlay address and its actions menu.
  1. The workshop gateway in the inventory — online (green dot).
  2. Its stable overlay address: that is what TIA Portal, Control Expert or Studio 5000 will target.
  3. Suspending or revoking the gateway immediately cuts all remote access to the workshop.
The enrolled gateway, with the overlay address your engineering tools will use.

Siemens, Schneider, Rockwell: hands-on, step by step

  1. 1
    Enroll the machine-network gatewayAn industrial PC or Linux gateway in the workshop gets the agent, a stable overlay address and a MagicDNS name.
  2. 2
    Authorise the S7 flowWrite the ACL: your engineering workstation (or the automation group) to the gateway, port 102/TCP (ISO-on-TCP). Everything else stays denied by default.
  3. 3
    Target the address in TIA PortalWhen going online, enter the gateway's overlay address (or its MagicDNS name) rather than using “Accessible devices”, which relies on local broadcast.
  4. 4
    Download, diagnose, forceOnline view, hardware diagnostics, project download: the session behaves as if you stood at the cabinet, inside an end-to-end encrypted tunnel.

Security: least-privilege ACLs, audit, end-to-end encryption

  • Deny by default: without an explicit rule, no flow passes. Rules name identities (machine, group, tag), never public addresses — see policies and ACLs.
  • Least privilege: the automation group reaches the workshop gateway on port 102 — not the whole site, not the other customers.
  • End-to-end encryption: every session travels over QUIC/TLS 1.3 on Ed25519 keys, with hybrid post-quantum key establishment; the relays (vigies) are structurally blind.
  • Audit and revocation: accesses are logged; revoking a technician or a gateway cuts access immediately — at the end of a contract as well as during an incident.

Frequently asked questions

Do we need to install anything inside the PLC?
No, nothing. The PLC keeps its firmware, its program and its network configuration. A gateway on the same machine network — industrial PC, Jetson, Linux box — carries the agent and relays the authorised flows.
Will TIA Portal find the PLC with “Accessible devices”?
Generally not: that search relies on a local layer-2 broadcast (PROFINET DCP) which does not cross the overlay. Type the gateway's overlay address or MagicDNS name directly — the connection itself works normally.
Are ports 102, 44818 and 502 visible from the Internet?
No. No inbound port is open, neither on the PLC nor on the gateway: the gateway only makes outbound connections. Those ports are only reachable through the mesh, for the identities the ACL explicitly authorises.
What if the site only has a 4G connection or sits behind CGNAT?
It works: the gateway's outbound connections traverse NAT, CGNAT and mobile links. If no direct path can be established, a structurally blind relay carries the session — encrypted end to end, without holding the keys.
What latency should we expect for remote programming?
It depends on the path and on the site's link (fibre, 4G): the mesh prefers a direct connection as soon as NAT traversal succeeds, and falls back to a relay otherwise. We do not publish a single figure: measure on your site — a ping to the gateway is enough.
Read nextRemote Modbus and SCADA access →