Connecting to Siemens LOGO! 8 via VPN: OpenVPN Setup Guide

Overview

Remote access to a Siemens LOGO! 8 (LOGO! 8.1, 8.2, 8.3, and the current 8.4 hardware platform) is a frequent requirement for OEMs, system integrators, and end users who need to monitor, program, or troubleshoot installations at sites where the PLC is deployed on a private LAN. Because LOGO! 8 only exposes standard Ethernet services (LOGO! web server, S7 communication on port 102, and Modbus TCP on port 502), a site-to-client VPN tunnel is the cleanest and most defensible way to reach it without exposing the device directly to the public internet.

This reference describes three production-validated approaches:

1. OpenVPN between a remote engineering PC and an industrial cellular/Ethernet router at the LOGO! site (e.g., Teltonika RUT240 / RUT950 / RUT951).
2. IPsec site-to-site tunnel between two industrial routers when multiple LOGO! devices or a full LAN must be reached.
3. LOGO! CIM (Communication Interface Module) with the Siemens SGLAN (Siemens Global Live Access Network) remote service, which tunnels via outbound TCP/443 to a Siemens relay.

Each approach is described in the official Siemens application note "Setting up a Secure VPN Connection between a PC and LOGO! 8", which is the canonical reference for OpenVPN + LOGO! 8. Basic LAN commissioning of the LOGO! is covered in Siemens LOGO! PLC: Initial Network Connection.

LOGO! 8 Network Capabilities and Services

Before selecting a VPN strategy, identify the services you must reach. All LOGO! 8 base modules from 6ED1052-***08-0BA1 (8.0) through 6ED1052-***08-0BA3 (8.3) and the LOGO! 8.4 variants expose the following TCP/UDP services on the Ethernet RJ45 port:

The LOGO! 8 has no built-in VPN client or server. It behaves as a standard Ethernet/IPv4 device on the local subnet. Therefore all tunneling must be terminated by an external device such as an industrial 4G/Ethernet router, a managed switch with VPN, or the LOGO! CIM module.

VPN Protocol Selection

Choose the protocol based on the upstream network, the security posture, and the firmware features of the router.

For the scenario "a single engineer accessing a single LOGO! 8 over an LTE link at a customer site" — the canonical case — OpenVPN on a Teltonika RUT-series router is the most common production configuration and is the path documented by Siemens.

Reference Topology

The standard pattern is road-warrior: the engineering PC runs the OpenVPN client, the on-site router runs the OpenVPN server, and the LOGO! sits on the LAN side of the router. Once the tunnel is up, the PC sees the LOGO! as if it were on the local subnet.

The OpenVPN server pushes a route for the LOGO! subnet (192.168.1.0/24) to the client so that only PLC traffic is tunnelled, and the client continues to use its own ISP for general browsing. This split-tunnel arrangement keeps latency low and reduces the bandwidth bill on the cellular link.

Prerequisites

• One LOGO! 8 base module (any 0BA8 variant) with a configured IP address, default gateway, and the web server enabled.
• LOGO! Soft Comfort (LSC) V8.3 or later installed on the engineering PC, matching the LOGO! firmware generation.
• An industrial cellular router with OpenVPN server capability. Validated hardware: Teltonika RUT240, RUT950, RUT951, RUTX11, or RUTX12. The router must be running firmware RUT2XX_R_00.01.14 or newer (or the equivalent RUT9xx/RUTX branch) so that OpenVPN runs on a current OpenSSL 1.1.x or 3.x base.
• An active SIM card with a public IPv4 address, or a fixed public IP from the MNO. If the carrier uses CGNAT (most consumer LTE plans), request a public IP or switch the OpenVPN listener to TCP 443 to traverse strict NAT.
• The OpenVPN client on the engineering PC (OpenVPN GUI 2.5.x or 2.6.x for Windows, or the Tunnelblick/Native client on macOS/Linux).
• A dynamic-DNS hostname pointing at the router's WAN IP (e.g., site-a-logo.dyndns.org) unless the MNO issues a static IP. The RUT series includes a built-in DynDNS client.

Step-by-Step: OpenVPN Road-Warrior to LOGO! 8

1. Commission the LOGO! on the local network first. From the LOGO! onboard display, navigate to Network > IP Address and assign a static address such as 192.168.1.50/24. Set the subnet mask to 255.255.255.0 and the default gateway to 192.168.1.1 (the router). Under Web Server Access, enable the web server and assign a strong password (8–32 chars, mixed case, at least one digit).

2. Verify local reachability. From a PC on the same LAN, browse to http://192.168.1.50. The LOGO! status page should load. From LOGO! Soft Comfort, choose Tools > Transfer > PC ↔ LOGO! and confirm that LSC discovers the device. This step must succeed before any VPN is configured; a VPN cannot fix an underlying addressing problem.

3. Insert the SIM and bring up the RUT router. Power the router from 9–30 VDC, attach the LTE and Wi-Fi antennas, and connect the LOGO! to a LAN port. From a PC attached to another LAN port, open the router's WebUI at https://192.168.1.1. Default credentials are admin / admin01 — change them on first login.

4. Configure the WAN interface. In Network > Interfaces > Mobile, enable the mobile interface, enter the APN provided by the carrier (e.g., internet for many European MNO profiles), and check that an IPv4 is acquired. Note the WAN IP — it is the address the OpenVPN client will dial.

5. Configure a DynDNS updater. Under Services > Dynamic DNS, select a provider (No-IP, DynDNS, or custom), enter the hostname, username, and password. Confirm that the public IP resolves to the hostname using nslookup site-a-logo.dyndns.org from a remote host.

6. Generate the OpenVPN keys and certificates. On the RUT WebUI, go to Services > VPN > OpenVPN. Click Add new instance, set Role = server, name it tap-logo or tun-logo, and select TUN topology with Generate next to the certificate fields. The router produces a CA certificate, a server certificate, a Diffie-Hellman parameter set, and a TLS-auth key. Save each artifact to a separate .crt, .key, and .pem file.

7. Configure the OpenVPN server parameters. Recommended values for a LOGO! 8 site:

   Parameter	Value	Notes
   Protocol	UDP	Use TCP 443 only if CGNAT blocks UDP
   Port	1194	Default OpenVPN
   Topology	subnet (TUN)	Cleanest routing for S7 broadcast filtering
   VPN subnet	10.8.0.0/24	Tunnel address space
   Push routes	192.168.1.0/24	Tell the client how to reach the LOGO!
   Push DNS	192.168.1.1	Optional; helps the client resolve local names
   Authentication	TLS / certificate + username	Two factors, no static key
   Cipher	AES-256-GCM	AEAD, hardware-accelerated on RUTX
   Hash	SHA-256	Matches current OpenSSL defaults
   TLS-auth	Enabled (key direction 0)	Defeats unauthenticated DoS on UDP 1194
   Keepalive	10 60	Ping every 10 s, restart after 60 s
   Max clients	4	LOGO! sessions are light

8. Export the client configuration package. From the same WebUI page, click Generate client config. The router produces a .ovpn profile containing the CA, client cert/key, TLS-auth, and the remote site-a-logo.dyndns.org 1194 udp line. Download it to the engineering PC.

9. Install and start the OpenVPN client. On Windows, place the .ovpn file in C:\Users\<user>\OpenVPN\config\. Right-click the OpenVPN GUI tray icon and choose Connect. A green icon indicates the tunnel is up. Verify the assigned address with ipconfig — the tap0 or tun0 adapter should show 10.8.0.2/24.

10. Add the LOGO! route explicitly if needed. When split-tunnel does not work as expected, force the route on the PC:

    route ADD 192.168.1.0 MASK 255.255.255.0 10.8.0.1 METRIC 1 IF <interface_id>
      # Linux equivalent
      sudo ip route add 192.168.1.0/24 via 10.8.0.1 dev tun0

11. Test the end-to-end path. From the PC with the tunnel up:

    ping 192.168.1.50
    curl -u admin:<password> http://192.168.1.50/> logo_status.html
    # Open LOGO! Soft Comfort, choose PC <-> LOGO!, scan the network

    All three commands should succeed. A successful ping confirms that ICMP traverses the tunnel; a successful curl confirms that the LOGO! web server responds; a successful LSC scan confirms that the S7 port (TCP 102) is reachable.

Alternative: LOGO! CIM with SGLAN

The LOGO! CIM (Communication Interface Module, order number 6BK1700-0BA20-0AA0 for the LOGO! 8 generation) connects to the left side of a LOGO! 8 base module and provides additional Ethernet ports plus a tunnel client to the Siemens SGLAN relay. The CIM initiates an outbound TLS session to the Siemens relay — no inbound firewall rule is required, and CGNAT is not an obstacle.

Typical use case: an OEM needs to read a data log or push a program update to a fleet of LOGO! installations without involving the customer's IT team or installing a customer-managed router.

Setup of CIM/SGLAN is performed in the SGLAN portal under Plant > Add Device using the device's MAC address (printed on the CIM housing) and the activation key included in the packaging. Once the outbound tunnel is established, the LOGO! appears in the SGLAN topology view and can be reached from LOGO! Soft Comfort over the relay.

Performance and Latency Considerations

The LOGO! web server is implemented as a single-threaded HTTP service on the base module's microcontroller. It tolerates only a handful of concurrent requests and the first page load after a tunnel brings the page over the LTE link can take 4–10 seconds — this is normal and is unrelated to the VPN. The web interface is also slow on the local LAN, by design.

Tips to keep the experience responsive:

• Use a TCP OpenVPN session with keep-alive 10 60 so that NAT timeouts on the carrier do not drop the tunnel during pauses in the LSC transfer.
• Enable OpenVPN data compression (lz4-v2) on the RUT. The LOGO! web pages are highly compressible text.
• Disable IPv6 on the OpenVPN server. LOGO! 8 only speaks IPv4, and dual-stack tunnels add handshake overhead on resource-constrained RUT240 hardware.
• For LOGO! Soft Comfort program downloads, schedule transfers during off-peak hours; a 256 KB program over a 20 ms RTT LTE link completes in 3–6 s inside the tunnel.
• Set the LOGO! web server's Refresh interval to 5 s or longer when polling over LTE — 1 s refreshes will saturate the cellular uplink.

Security Hardening

1. Replace the default RUT admin password and the default LOGO! web server password immediately. The LOGO! password is set under Web Server Access > Password on the LOGO! display or via the LOGO! WebConfig tool.
2. Use certificate-based authentication for OpenVPN instead of static keys. A leaked static key grants permanent access.
3. Enable the router's firewall block on inbound WAN for everything except UDP 1194. Disable ICMP echo on WAN to hide the router from opportunistic scans.
4. Restrict OpenVPN clients with a CCD (client-config-dir) file that pushes a fixed tunnel IP and a tightly scoped route, so a compromised client certificate cannot pivot to other LAN segments.
5. Enable SYSLOG forwarding on the RUT to a central log server; the LOGO! has no native syslog, so the router log is the only forensic record.
6. Patch the router firmware quarterly. Teltonika publishes security advisories on its wiki; subscribe to the RUT firmware RSS feed.
7. If you must traverse strict corporate firewalls, switch the OpenVPN listener to TCP 443 and use the tls-crypt-v2 feature to prevent DPI from identifying the protocol.

Troubleshooting Matrix

Verification Checklist

• LOGO! responds to ping 192.168.1.50 from a PC on the same LAN.
• LOGO! web server loads at http://192.168.1.50 on the LAN with credentials.
• LOGO! Soft Comfort discovers and uploads a program on the LAN.
• RUT router has a public WAN IP and a working DynDNS hostname.
• OpenVPN client connects and the tun/tap adapter gets an address in 10.8.0.0/24.
• ping 192.168.1.50 succeeds through the tunnel.
• LOGO! web page loads in < 15 s through the tunnel.
• LOGO! Soft Comfort discovers the device through the tunnel and uploads a test program.
• Modbus TCP read of a known VM address (e.g., VW0) returns the expected value.
• Router firewall log shows no unexpected inbound connections.

Reference Documentation

• Siemens application note 109747067: Setting up a Secure VPN Connection between a PC and LOGO! 8
• Siemens LOGO! PLC: Initial Network Connection (DigiKey TechForum)
• LOGO! 8 System Manual, Siemens order number 6ED1052-1**08-0BA* (bundled with the device)
• Teltonika RUT9xx / RUTX OpenVPN configuration wiki — Services → VPN → OpenVPN section
• OpenVPN 2.6 community reference — --tls-crypt-v2, --data-ciphers options

FAQ