Configuring Remote Web Access to WinCC Flexible Runtime

System Architecture Overview

This reference covers a SIMATIC S7-300 station connected to a supervisory PC running SIMATIC WinCC flexible 2008 Runtime, where an external operator needs browser-based remote access over the public internet. The architecture combines an S7-300 CPU, an Ethernet communications processor CP 343-1 (6GK7 343-1EX11-0XE0) firmware v2.0, a WinCC flexible Runtime PC, and a router/firewall at the plant boundary. Remote operator panels are reached through the WinCC flexible "Smart Access" web server rather than through direct port-forwarding to the S7-300.

The topology is intentionally split so the engineering workstation, the HMI runtime, and the controller each sit on their own subnet. This isolates broadcast domains, simplifies firewall rule sets, and lets the Smart Access web server act as the single broker between TCP/IT traffic from the internet and the S7 communication on ISO-on-TCP port 102 behind it.

Hardware Identification and Components

The CP 343-1 at firmware v2.0 introduces an integrated 2-port real-time switch so the CPU, the engineering PG, and the WinCC PC can all be daisy-chained on a single PROFINET segment without an external managed switch. Always pin the CP firmware with STEP 7 V5.5 + SP4 (or TIA Portal V13+) before commissioning; mismatched firmware is the most common cause of random ISO-on-TCP timeouts.

Network Topology and IP Addressing

Use a private address space that does not overlap with corporate or home networks, e.g. 10.10.0.0/16 split as follows:

The CPU and CP are on different subnets and joined by a backplane connection; the CP bridges onto the Ethernet side. The WinCC flexible "HMI IE" interface in the PC station is the S7 connection endpoint, not a separate physical adapter; it must be assigned a free IP inside the Plant LAN so STEP 7 routes S7 communication through the CP.

WinCC Flexible Smart Service vs Smart Access

WinCC flexible 2008 (SP2 and later) introduced two distinct remote features. Conflating them is the root of most "page does not exist" errors:

The user's symptom — entering the WinCC Runtime PC IP into a field and seeing "no page exists" — happens because Smart Service is not a web HMI server. To expose the runtime as a web page you must enable Smart Access on the WinCC flexible project (Project > Runtime Settings > Services > Smart Access) and select a TCP port (default 443). The IP you enter in the browser is then the WinCC Runtime PC's IP, not the CPU or CP.

Why Direct Internet Access Fails

Three technical reasons stop a default setup from being reachable over the public internet:

1. RFC 1918 private addressing. 192.168.x and 10.x are filtered by every ISP. Without NAT or a public IP, the remote client has no path to the runtime PC.
2. Single static WAN IP is not enough. Even with a static public IP assigned to the SCALANCE, the WinCC PC is hidden behind NAT. Port forwarding WAN:443 → 10.10.10.50:443 works for one service, but exposes the entire HMI control surface to the internet and triggers every vulnerability scanner within minutes.
3. Smart Access defaults to local authentication. The built-in user list is small (Administrator / User groups); without integrating Active Directory, brute-force protection is limited. Exposing it raw is operationally unsafe.

The clean answer is a VPN termination at the plant boundary. The remote PC joins the plant LAN as if it were locally attached, then opens the Smart Access URL through that tunnel. The runtime never sees a non-VPN connection, and no inbound ports are open on the WAN.

Remote Access via VPN with SCALANCE

The SCALANCE S615 (6GK5 615-0AA00-2AA2) is purpose-built for OT environments: industrial temperature range, DIN-rail mount, hardware-accelerated IPSec, and a Security Configuration Tool that lets you define firewall rules per interface. It supports both OpenVPN (lightweight, ideal for road-warrior laptops) and IPSec (preferred when the peer is another SCALANCE).

VPN topology variants

Firewall and Port Configuration

Lock down the SCALANCE with the principle of least privilege. Recommended rule set, applied through the Security Configuration Tool:

Explicitly drop everything else. Smart Access must terminate on the WinCC Runtime PC; the SCALANCE should never forward raw TCP 102 to the CP 343-1, because S7 communication has no application-layer authentication.

Step-by-Step: Enabling Smart Access for Web Remote Operation

Prerequisites: WinCC flexible 2008 SP2 or later, Microsoft IIS or built-in WinCC web server enabled, Runtime license with Smart Access option.

1. Open the WinCC flexible project in the Engineering Station.
2. Navigate to Project → Runtime Settings → Services.
3. Tick Smart Access. Select HTTPS port (default 443) and HTTP fallback port (default 80) only if needed.
4. Define user groups: Project → Users → User Administration. Create at minimum an "Administrator" and a "Remote_Operator" group with the appropriate authorizations.
5. Compile the project and transfer it to the Runtime PC.
6. On the Runtime PC, open the WinCC flexible Runtime loader. Confirm "Smart Access: Active" appears in the status bar.
7. From a browser on the same LAN, navigate to https://10.10.10.50. The Smart Access login page must appear.
8. Log in as Administrator and validate that a tag change on the web client is reflected in the running HMI.

Project setting values

Step-by-Step: Configuring SCALANCE S615 as OpenVPN Server

Prerequisites: TIA Portal V16 or Security Configuration Tool V4, admin access to the S615, a static public IP or DDNS name on the WAN.

1. Connect the engineering PG to the S615 LAN port, open the Security Configuration Tool, and discover the device at 10.10.10.1.
2. Set the WAN interface to external / untrusted zone, LAN to internal / trusted.
3. Create a new VPN connection: VPN → Connections → New, type OpenVPN, role Server.
4. Generate a 2048-bit RSA key and Diffie-Hellman parameters. Export the server certificate and the CA certificate.
5. Define the VPN address pool, e.g. 10.10.100.0/24, and DNS for the plant LAN.
6. Push routes to clients so the Smart Access subnet is reachable: push "route 10.10.10.0 255.255.255.0".
7. Generate a client .ovpn profile with embedded certificates and deliver it (out-of-band) to the remote operator.
8. Apply the firewall table described above. Save and reboot the S615.

OpenVPN server configuration (excerpt)

port 1194
proto udp
dev tun
server 10.10.100.0 255.255.255.0
push "route 10.10.10.0 255.255.255.0"
push "route 10.10.20.0 255.255.255.0"
keepalive 10 60
tls-version-min 1.2
cipher AES-256-GCM
auth SHA256
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3

Client .ovpn (excerpt)

client
dev tun
proto udp
remote vpn.plant.example.com 1194 udp
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-version-min 1.2
cipher AES-256-GCM
auth SHA256
verb 3
<ca>
<!-- paste CA certificate here -->
</ca>
<cert>
<!-- paste client certificate here -->
</cert>
<key>
<!-- paste client private key here -->
</key>

Verification and Commissioning

1. From the remote PC, connect to the OpenVPN profile and confirm an IP from the VPN pool (e.g. 10.10.100.42) is assigned.
2. Ping the WinCC Runtime PC: ping 10.10.10.50. A reply proves the tunnel and firewall rules R1/R3 are passing.
3. Open a browser to https://10.10.10.50. The Smart Access login page must load without TLS warnings (assuming the CA cert is trusted).
4. Log in as Remote_Operator. Toggle a digital output from the web client. Verify the physical output changes at the S7-300 I/O.
5. Confirm the WinCC flexible Runtime log shows the connection: Diagnostic → Smart Access → Active sessions.
6. From the WAN side, run nmap -Pn -p 443 vpn.plant.example.com. The only open port should be 1194/UDP (OpenVPN); TCP 443 must remain invisible to the public scan because traffic is tunneled, not forwarded.
7. Document the configuration: export the SCALANCE backup, archive the WinCC flexible project, store the client .ovpn in a password manager.

Security Best Practices for OT/IT Convergence

• Defense in depth. VPN at the perimeter, firewall on the SCALANCE, host firewall on the WinCC PC, application-layer authentication in Smart Access.
• No static WAN IP on the CP or CPU. Only the SCALANCE should hold the public address.
• Patch hygiene. Subscribe to Siemens ProductCERT advisories for CP 343-1 and WinCC flexible; firmware updates must be staged on a bench before plant rollout.
• Audit logging. Forward SCALANCE syslog to a SIEM; Smart Access logs to a CSV the WinCC Runtime PC must archive nightly.
• Account lifecycle. Remove user accounts on personnel change. Disable the built-in "Administrator" account after creating a named admin.
• Network segmentation. The Smart Access client must never reach the controller subnet directly. Always proxy through the WinCC Runtime PC, which holds the only S7 connection to the CPU.
• Fail-closed. If the VPN tunnel drops, the S615 must drop established sessions, not silently fall back to a clear-text path.

Troubleshooting Matrix

References for Further Engineering

• SIMATIC HMI WinCC flexible 2008 Runtime User Manual
• SIMATIC WinCC Unified PC
• Options for WinCC Engineering and Runtime systems (TIA Portal)

Frequently Asked Questions