Configuring Omron NS Terminal for Remote PLC Internet Access

Overview

The Omron NS-series HMI does not support direct CX-Programmer programming across the public Internet. To program a CS/CJ PLC from a remote town, terminate the CX-Programmer session on the PLC's Ethernet module (CS1W-ETN21 or CJ1W-ETN21), and keep the NS HMI on a local NT Link 1:N connection to the PLC's built-in RS-232C port. This reference documents the firmware prerequisites, IP addressing, FINS routing, router port forwarding, NS conversion table, and CX-Programmer driver configuration required to make the topology work end-to-end.

Network Architecture

The end-to-end topology separates the long-haul (Internet) leg from the local HMI leg. The PC running CX-Programmer reaches the PLC's Ethernet card across the WAN; the NS terminal is treated as a downstream device that talks to the CPU only on a short serial cable. This split isolates the NS from the routed path entirely and makes the PLC the single point of contact for remote engineering.

All cross-Internet traffic is encapsulated in FINS/UDP. The NS panel never receives an IP packet from the Internet; it exchanges FINS frames with the CPU only over the local serial link.

Prerequisites

Verify the hardware and firmware match the minimum levels below before changing any parameter. Mixing older firmware with a routed FINS gateway is the most common cause of "communications error" responses.

Router Port Forwarding

FINS-over-UDP uses port 9600. Forward this single UDP port from the router's WAN address to the PLC's LAN IP. Do not forward TCP 9600 unless you have also enabled FINS/TCP on the ETN21; mixing the two transport options on the same forwarder causes framing errors.

1. Log into the router and create a static NAT / port-forward entry:

2. Confirm that no other device on the LAN is responding on UDP 9600. Two FINS servers on the same forwarded port will steal each other's responses.
3. Add a firewall rule that allows UDP 9600 inbound only from the engineering PC's public IP, if your router supports source-IP filtering. This prevents drive-by FINS scans from the Internet.

ETN21 Ethernet Module Configuration

Configure the ETN21 through CX-Programmer's Ethernet Unit Setup tool, or via the PLC's I/O table online edit. Three parameters are critical for routed FINS.

IP Router Table

The IP router table tells the ETN21 where to send FINS replies that are addressed to nodes on other networks. For a single-router, single-LAN topology, a default route is sufficient.

IP Address : 0.0.0.0
Router IP Address : 192.168.1.100

Replace 192.168.1.100 with the router's LAN address. The ETN21 will use this entry as the next hop for any FINS destination that is not on its own /24.

Local Routing Table

Identify the ETN21's own network number so CX-Programmer can address it. The default network number assigned to an Ethernet unit is 7 for a CS/CJ system, but you can change it; just keep the same value in CX-Programmer.

PLC Serial Port (NT Link 1:N) Configuration

The NS HMI talks to the CPU through the PLC's built-in RS-232C port. NT Link 1:N allows one PLC port to multiplex up to 16 NS panels. The NS is reached through FINS network numbers 111 (port A) and 112 (port B).

1. In the PLC Setup, navigate to Serial Port 1 (or Serial Port 2 if port A is used for another device).
2. Set the following values:

Serial Port Mode        : NT Link 1:N
Baud                    : 115200 bps (or highest common rate with the NS)
MAX NT Link Unit Number : 2

The MAX NT Link Unit Number = 2 setting widens the per-device timeout. With the default value of 1, the NS may miss polls while the CPU is busy servicing remote CX-Programmer traffic, producing intermittent "PLC No Response" alarms on the HMI.

3. Add a local routing table entry on the CPU so FINS frames addressed to network 111 (NS on port A) or 112 (NS on port B) are forwarded to the serial port:

Set the NS's own FINS node number in the NS project (System Menu → Comm. Settings). A node below 126 is required by FINS.

NS Terminal Ethernet Conversion Table

The NS supports an Ethernet conversion table that maps a remote PLC's IP address to a destination FINS node. This is used when the NS itself is communicating with a remote PLC over Ethernet, but for the local-NT-Link configuration described here, the NS does not need a remote IP entry. It does, however, need a static IP and correct FINS parameters.

1. From the NS System Menu, choose Comm. Settings → Ethernet.
2. Set the NS to a static IP on the same /24 as the ETN21, for example:

IP Address  : 192.168.1.10
Subnet Mask : 255.255.255.0
Default GW  : 192.168.1.100

3. If the NS project uses an Ethernet conversion table to point at a remote (Internet-side) PLC, populate one row per remote PLC, pairing the remote PLC's public IP with the destination FINS node (last octet of the PLC IP, 5 in this example).

CX-Programmer Connection Settings

With the PLC and router configured, set up the CX-Programmer driver on the engineering PC.

1. Put the engineering PC on the same /24 as the PLC ETN21, for example 192.168.1.50, mask 255.255.255.0, no default gateway. (If you are testing locally before going over the Internet, you must still be on the same subnet.)
2. In CX-Programmer, open Change PLC → Network Type → Ethernet (FINS/UDP).
3. On the Settings tab, enter the FINS addresses:

FINS Source Network      : 7
FINS Source Node         : <workstation node, 1..125, not equal to PLC node>
FINS Destination Network : 7
FINS Destination Node    : 5

4. On the Driver tab, enter the IP address of the router's WAN:

IP Address : 65.13.44.12
Port       : 9600
Protocol   : UDP

5. If the Workstation Node shown in CX-Programmer exceeds 126, uncheck Auto-Detect and type a node manually in the range 1..125. It must not collide with the PLC node.
6. Click Test Connection. A successful FINS/UDP exchange returns "Connected" within 2-3 seconds.

Connecting to the NS Through the PLC

CX-Programmer cannot talk to the NS directly over the Internet. To transfer or back up the NS project, you must either connect a laptop locally to the NS USB port (NS-CXDesigner via USB) or remote-desktop/VPN into a workstation on the LAN that can reach the NS at 192.168.1.10. The PLC's routing table you added in the previous step allows the NS to remain reachable from any node on network 7 (including the engineering PC), so once the engineering PC is on the LAN you can reach the NS at FINS node NS_node on network 111 or 112.

Verification and Diagnostics

Run through the checks below in order. Each step isolates a layer of the stack.

1. ICMP path. From the engineering PC, ping the router WAN address (65.13.44.12). If this fails, the WAN path or your own firewall is the problem.
2. UDP path. Use a UDP test tool (e.g. ncat -u 65.13.44.12 9600) to confirm the router forwards the port. You should see traffic reach the PLC's LAN IP.
3. FINS/UDP exchange. From CX-Programmer, click Work Online. A successful connect populates the I/O table.
4. NS comm health. On the NS screen, the corner indicator should remain green or the alarm banner absent. If NS shows "PLC No Response", raise the MAX NT Link Unit Number to 2 and confirm the routing table entry for network 111 or 112.
5. Long-haul stability. Leave the connection idle for at least 30 minutes. Idle FINS sessions over WANs tend to fail when NAT timers expire; configure the router's UDP NAT timeout to a value larger than the ETN21's keep-alive interval (default 0 s = off).

VPN Alternative

If your site-to-site traffic must traverse the Internet regularly, a VPN is the recommended approach. It eliminates FINS exposure to the public Internet and lets CX-Programmer, CX-Designer, and the NS behave exactly as on a local LAN.

1. Install matched VPN routers (e.g. IPsec site-to-site) at the engineering PC site and the PLC site.
2. Assign the PLC LAN a routable subnet behind the VPN tunnel; for example 10.10.10.0/24 with the PLC ETN21 at 10.10.10.5 and the NS at 10.10.10.10.
3. On the engineering PC, set the route so 10.10.10.0/24 goes through the VPN tunnel interface.
4. In CX-Programmer, point the driver IP at 10.10.10.5 (the PLC) instead of the WAN. No port-forwarding, no FINS exposure, no static NAT.

VPN also resolves the static-IP pain: with the tunnel providing addressing, the LAN-side devices can revert to DHCP without breaking CX-Programmer's FINS assumptions.

Troubleshooting Matrix

Safety and Operational Notes

• Always confirm the PLC is in Program mode or that outputs are forced off before uploading/downloading over a WAN. A download during a faulted process can leave outputs in undefined states.
• Document the public IP, FINS node, and port-forward entry in the site's network register. Lost entries are a common source of after-hours support calls.
• Record the ETN21 firmware version. Downgrading is not supported and can silently break FINS/IP routing.
• If you must support multiple remote sites, give each PLC a unique last octet (node) and unique public IP, and document them in the CX-Programmer project as named connections.

FAQ