Configuring CJ1M-CPU12-ETN Remote Ethernet Access via NAT

1. Overview

The CJ1M-CPU12-ETN is a CJ-series CPU unit with an integrated 100Base-TX Ethernet function. The integrated ETN function communicates using the Omron FINS (Factory Interface Network Service) protocol over UDP/TCP, the same protocol set used by the separate CJ1W-ETN21 Ethernet unit, so remote programming, HMI polling, and peer-to-peer (P2P) data exchange are all supported without adding a backplane module. The unit measures 90 mm × 65 mm (H × D) and fits the standard CJ-series footprint, which is the smallest class for an Ethernet-equipped CJ CPU.

This article documents the complete procedure for reaching a CJ1M-CPU12-ETN across the public Internet — for example, a CX-Programmer workstation in Europe communicating with a CJ1M CPU installed on a machine in China. The approach is built on three pillars:

1. A static public IP address (or fixed DNS name) on the remote-site router.
2. NAT/PAT (port forwarding) on the remote-site router targeting the PLC's local IPv4 address on UDP/TCP port 9600.
3. Matching FINS node, IP address, and port settings inside the PLC and CX-Programmer.

2. Prerequisites

Verify the following items before starting configuration.

3. Network Architecture

The end-to-end topology is straightforward: a CX-Programmer PC reaches a public IP on the remote site's firewall/NAT router, which forwards FINS traffic to the CJ1M-CPU12-ETN's private address. Because FINS is a connectionless UDP service by default, the firewall rule must allow inbound UDP on the configured FINS port. If the application uses FINS/TCP (used for online editing of large program transfers), add a matching TCP rule.

Three address spaces must be reconciled: the office PC's private address, the remote PLC's private address (192.168.1.100), and the remote router's public static IP. FINS uses an addressing scheme that includes both an IP address and a FINS node number; both must agree on each side or routing will silently fail.

4. PLC-Side Ethernet Configuration

Connect CX-Programmer to the CJ1M via USB or serial locally to perform the following setup. Open PLC > Edit > I/O Table and Unit Setup, locate the CPU's built-in ETN section, and write the following parameters.

5. CX-Programmer Remote Connection Setup (Office Side)

On the engineering PC in Europe, configure CX-Programmer to address the PLC through the public IP rather than directly to its private address.

1. Launch CX-Programmer and select PLC > Change Connection Method.
2. Set Network Type to Ethernet (FINS/UDP).
3. Set the Destination IP Address to the remote router's public static address, e.g. 203.0.113.20.
4. Set the Destination Port to 9600 (must match the PLC's FINS UDP port).
5. Set the FINS Source Node to a unique number on the local network (e.g. 10) and the FINS Destination Node to the value programmed in the PLC (e.g. 1).
6. Define an IP routing table entry in CX-Integrator or via the ETN's routing table so the local FINS node knows how to reach the destination FINS node through the public IP.
7. Click Test Connection. A successful test returns the CPU model and unit version within 2–3 seconds.

The same change-connection dialog accepts FINS/TCP for sites where UDP is blocked. CX-Programmer version 9.7 or later is recommended for stable FINS/TCP keep-alive handling on long WAN links.

6. Router NAT / PAT Configuration (Remote Site)

The remote-site router must translate inbound traffic to the public IP into traffic to the PLC's private IP. Most consumer/SMB routers call this Port Forwarding, Virtual Server, or NAT/PAT. Configure the following rule:

Setting External IP to 0.0.0.0 allows any source — useful when the office side has a dynamic IP. If the office side has a fixed IP, restrict the rule to that IP for defence-in-depth. Save and reboot the router if the firmware requires it for the rule to activate.

7. Static IP and DNS

The single most important requirement for reliable remote access is a static public IP address on the remote-site router. Without it, the destination address programmed in CX-Programmer becomes invalid every time the ISP renews the lease. Three practical options exist:

1. Dedicated business static IP — request from the local ISP at the machine site (typical in industrial parks in China).
2. DDNS — register with a DDNS provider supported by the router (No-IP, DynDNS, or vendor-specific); the router updates the hostname every 60 seconds.
3. VPN — provision an IPsec or WireGuard tunnel to the remote LAN and treat the PLC as a local node; CX-Programmer then uses 192.168.1.100 directly. This avoids exposing FINS to the Internet entirely.

For greenfield deployments a VPN is the most secure path; for retrofit projects where the customer cannot install new equipment, a static IP plus NAT/PAT is the lowest-cost option.

8. FINS Routing Tables

FINS uses a three-level address: Network . Node . Unit. The CJ1M-CPU12-ETN exchanges FINS over IP by mapping the IP network to a FINS network number. The IP routing table inside the ETN function must contain entries for both the local network (auto-filled) and the remote FINS node, with the destination IP listed as the gateway or final IP depending on topology.

Refer to W441-E1-03, Section 5 — FINS Routing for the full table syntax. An incorrect routing table is the most common cause of "Test Connection" timing out even when the router rule is correct.

9. Verification Procedure

After programming both ends, validate connectivity in this order:

1. Ping the public IP from the office PC. If this fails, the problem is upstream of the PLC — DNS, ISP routing, or firewall.
2. Test UDP 9600 from the office PC using a tool such as nc -uv 203.0.113.20 9600 or Wireshark. A single FINS command sent from CX-Programmer should appear as a UDP packet arriving at the PLC.
3. Use CX-Programmer's "Test Connection" under Change Connection Method. A success message returns CPU model, unit version, and DIP-switch info within 3 seconds.
4. Go online, read the I/O table, and confirm the unit version matches the hardware label.
5. Trigger a small read from the work area (e.g. D0) to confirm end-to-end application traffic.

10. Troubleshooting Matrix

11. Migration to CJ2M

The CJ1M family has been formally discontinued; the active replacement is the CJ2M series with built-in Ethernet (CJ2M-CPU3x-ETN) or EtherNet/IP (CJ2M-CPU3x-EIP). The migration tool CX-Programmer File > Change PLC Model converts the program and I/O table, but the Ethernet configuration must be re-entered because the ETN parameters move from the CPU to a separate CJ2M-EIP21 or built-in EtherNet/IP block on the CJ2M. Refer to the official Omron Discontinuation Notice for CJ1M for part numbers, end-of-life dates, and recommended successors.

The remote-access procedure is identical: static IP at the remote site, NAT/PAT 9600 → PLC private IP, matching FINS node in CX-Programmer. For new designs, prefer EtherNet/IP over FINS — EtherNet/IP traverses NAT transparently using TCP 44818 and is supported natively by modern SCADA packages.

12. Security and Hardening

Exposing FINS on UDP/TCP 9600 to the Internet is convenient but introduces risk. Recommendations for production systems:

• Replace public NAT/PAT with a site-to-site VPN; treat the remote network as a private extension.
• Restrict the NAT rule's source IP to the office subnet if the office has a static IP.
• Disable unused FINS services in the ETN setup (e.g. FTP server, HTTP server if not used).
• Use the PLC's built-in password and project-protection features in CX-Programmer to prevent unauthorised uploads.
• Log WAN-side access on the router and review weekly for unexpected source IPs.

These controls are especially relevant when the machine site is in a regulated jurisdiction and the engineering office is in a different country.

13. Reference Specifications

Full datasheet: CJ1M-CPU1@-ETN Datasheet (Omron Europe). Detailed setup manual: W441-E1-03 CJ1M CPU Units with Ethernet Functions.