Configuring SIMATIC IOT2000 Ethernet for Internet and Node-RED

Overview

The SIMATIC IOT2000 is Siemens' intelligent industrial IoT gateway designed to bridge field-level machinery with IT systems and cloud platforms. Two hardware variants exist: the IOT2020 with a single 10/100 Mbit/s Ethernet port and the IOT2040 with two Gigabit Ethernet ports (eth0 and eth1). Both run a customized Intel Galileo/Yocto Linux image (based on Debian) with Node-RED pre-installed for rapid application development. This reference documents how to enable outbound internet connectivity on either variant so that additional Node-RED nodes (e.g., node-red-contrib-s7, node-red-contrib-opcua) can be installed through npm.

Hardware Identification and Port Layout

Confirm the exact variant before configuring any interface file. The IOT2020 has only one RJ45 (LAN) and one USB 2.0 host port. The IOT2040 adds a second RJ45 and exposes an mPCIe slot for optional WiFi/3G/4G cards. Knowing the port count determines which configuration strategy is viable.

On the IOT2040 the left port (X1, eth0) is the default management/engineering port used by the iot2000setup tool and is typically configured with a static address. The right port (X2, eth1) is intended for the upstream/corporate network. Do not place both ports in the same broadcast domain unless you intend to use bridging.

Prerequisites

1. Serial console or SSH access. Use PuTTY (Windows) or ssh (Linux/macOS) to reach the device. The default credentials for the IOT2000 image are root / root (change immediately on first login).
2. IP plan for the management port. Default static: 192.168.200.1/24 on eth0 (IOT2040) or single eth0 on IOT2020.
3. Network with outbound internet. Either a DHCP-enabled router/switch or a documented static configuration including default gateway, subnet mask, and at least one reachable DNS server.
4. Physical cabling. Cat 5e or better for Gigabit (IOT2040). Use the correct port as identified above.
5. Node-RED runtime pre-installed on the IOT2000 image (verify with systemctl status node-red).

Method 1 - Configuring Ethernet with the iot2000setup Tool

The IOT2000 ships with a TUI setup tool that is the recommended, safe way to change network parameters. The tool validates inputs and regenerates the /etc/network/interfaces file consistently.

1. Log in via SSH or serial console.
2. Run iot2000setup at the shell prompt (or invoke it from the diagnostic web page on port 8443 if enabled).
3. Navigate to Network Configuration → eth0 (and eth1 on IOT2040).
4. Select DHCP if connecting directly to a router; or Static and enter IP address, Subnet mask, Default gateway, and DNS server (use commas to separate multiple DNS entries).
5. On the IOT2040, configure only eth1 for internet and leave eth0 on its management address so SSH remains reachable.
6. Save and reboot. The tool will rewrite /etc/network/interfaces and bring the interfaces up at boot.

Method 2 - Manual Configuration via /etc/network/interfaces

For deployments that do not allow the setup tool (locked-down images, scripted provisioning) edit the Debian network file directly. The syntax follows the upstream Debian Network Configuration reference.

Open the file with elevated rights:

For the IOT2040 with a static management port on eth0 and DHCP uplink on eth1:

# /etc/network/interfaces -- IOT2040 sample
auto lo
iface lo inet loopback

# Management port -- keep static so SSH is predictable
auto eth0
iface eth0 inet static
    address 192.168.200.1
    netmask 255.255.255.0

# Upstream / internet port -- DHCP from router
auto eth1
iface eth1 inet dhcp

For a fully static uplink (corporate network with no DHCP), replace the eth1 stanza with:

auto eth1
iface eth1 inet static
    address 192.168.10.50
    netmask 255.255.255.0
    gateway 192.168.10.1
    dns-nameservers 192.168.10.1 8.8.8.8

Reload the configuration without rebooting:

Method 3 - Direct Laptop Bridge (Field Setup)

When no router is available, bridge the wireless NIC of an engineering laptop with its Ethernet adapter, then connect the IOT2000's uplink port to the laptop. The laptop's WiFi provides internet, and the IOT2000 reaches it through the bridged Ethernet.

1. On Windows: Control Panel → Network and Sharing → Change adapter settings, select both WiFi and Ethernet, right-click → Bridge Connections.
2. On Linux: install bridge-utils and create a br0 bridge that includes eth0 and wlan0, then enable IP forwarding and NAT (e.g., iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE).
3. Connect the IOT2000's eth1 (IOT2040) or eth0 (IOT2020) to the laptop's Ethernet port using a straight-through or crossover cable (most modern NICs auto-MDI/MDIX).
4. Configure the IOT uplink port for DHCP so it obtains an address from the laptop's bridge. Most OS-bridge stacks run a DHCP server (Windows ICS, dnsmasq on Linux) by default.

DNS Resolution and /etc/resolv.conf

Even with a correct IP, gateway, and mask, npm install and apt-get update will fail silently if DNS does not resolve. Verify the resolver configuration:

Expected output for a static setup:

nameserver 192.168.10.1
nameserver 8.8.8.8

On modern Debian-based images the file may be managed by resolvconf or systemd-resolved; the entries then come from the dns-nameservers directive in /etc/network/interfaces. If /etc/resolv.conf is empty or points to 127.0.0.1, ensure resolvconf is installed and re-trigger it:

apt-get install -y resolvconf
resolvconf -u

Verify name resolution end-to-end:

ping -c 3 8.8.8.8       # Layer-3 reachability
ping -c 3 www.siemens.com # DNS resolution check
nslookup registry.npmjs.org

If the first ping succeeds but the second fails, the issue is DNS only, not routing. Add a public resolver (8.8.8.8, 1.1.1.1) to /etc/resolv.conf as a workaround.

WiFi / Cellular Alternatives (IOT2040 Only)

The IOT2040's mPCIe slot accepts tested USB WiFi adapters and 2G/3G/4G modems. Common supported chipsets include Realtek RTL8188 and Atheros AR9271. Siemens maintains a compatibility list that maps vendor IDs to supported modes (client, managed, monitor).

1. Insert the mPCIe card while the device is powered down.
2. Boot and verify the kernel module loaded: lsmod | grep rtl8188 (or the appropriate driver).
3. Use iot2000setup → Network Configuration → wlan0 to scan and connect to an SSID, entering PSK as needed.
4. Alternatively edit /etc/network/interfaces with a wpa-ssid and wpa-psk stanza referencing wlan0.
5. Test with iwconfig wlan0 (link quality) and ping an external host.

Installing Node-RED Nodes After Connectivity is Established

With outbound internet and working DNS confirmed, install S7 and OPC UA nodes from the Node-RED palette:

cd /usr/lib/node_modules/node-red
npm install node-red-contrib-s7
npm install node-red-contrib-opcua
systemctl restart node-red

Or, from the Node-RED web UI (default http://<iot-ip>:1880), use Menu → Manage palette → Install and search the flow library.

Verification Checklist

Troubleshooting Matrix

Security Hardening After Internet is Enabled

1. Change the default root password: passwd.
2. Disable root SSH login in /etc/ssh/sshd_config by setting PermitRootLogin no, then systemctl restart sshd.
3. Generate an SSH key pair on the engineering workstation and install the public key via authorized_keys.
4. Update the firmware image to the latest Siemens release for CVE patches.
5. Restrict the Node-RED admin UI (settings.js → adminAuth) with at least a bcrypt-hashed user.
6. Enable Node-RED's HTTPS (httpsNodeRed) and disable httpNodeAuth bypass.
7. If exposing Node-RED to a wider network, put it behind a reverse proxy (NGINX, Caddy) with TLS and IP allow-listing.

Operational Notes

The IOT2000 image is based on a Yocto-built Debian variant. Package versions are intentionally pinned; running apt-get dist-upgrade is not supported and can break Node-RED or the Siemens-specific services. Apply updates only through Siemens-released SD card images or firmware packages.

For production deployments, treat the IOT2000 like any other industrial controller: deterministic addressing, documented VLAN, restricted outbound destinations, and a backup of the /etc directory captured with tar -czf etc-backup.tgz /etc after a working configuration is achieved. Restore on a replacement device with scp + tar -xzf to keep MTTR low.