IOT2000 to S7-1500 PLCSIM: Fix ECONNRESET in Node-RED

Problem Overview

When commissioning a SIMATIC IOT2000 (IOT2020 or IOT2040) as an edge gateway against an S7-1500 PLCSIM instance, the Node-RED flow using node-red-contrib-s7 from st-one-io repeatedly reports Error connecting to PLC: Error: read ECONNRESET. The error appears in the Node-RED debug sidebar every poll cycle, the S7 status indicator stays red, and no tags are read from the simulated controller. The error is confirmed in the public issue tracker at st-one-io/node-red-contrib-s7 issue #18 and in the Siemens SiePortal support thread 1075097.

ECONNRESET is the Node.js wrapper for the underlying BSD socket error (errno 54 on Linux, WSAECONNRESET 10054 on Windows): the TCP peer sent an RST (Reset) flag, immediately tearing down the connection. In the S7 protocol stack this means the ISO-on-TCP transport on TCP port 102 was started by the IOT2000, the three-way handshake completed, but the very first S7 communication setup frame was answered with a Reset.

This article consolidates the official Siemens guidance and field-verified workarounds to isolate the root cause, reconfigure the TIA Portal PG/PC interface, route the PLCSIM traffic to the correct Windows network adapter, open the firewall on TCP 102, enable PUT/GET on the simulated CPU, and select a compatible version of the Node-RED S7 node.

System Context and Architecture

The IOT2000 family ships with a Siemens-supported Yocto Linux Example Image that includes Node-RED pre-installed. Communication with a SIMATIC S7 controller is handled by the node-red-contrib-s7 palette, which speaks ISO-on-TCP (RFC 1006) on TCP port 102 using the proprietary S7Comm layer.

Supported IOT2000 Hardware

Protocol Stack Used by the S7 Node

Reference Network Topology

Root Cause Analysis

The ECONNRESET in this configuration is the result of one of four overlapping root causes, ranked by frequency in field reports. All four produce an identical symptom in the Node-RED debug sidebar, so the diagnosis must be performed in the order listed below.

Cause 1 - PLCSIM Bound to the Wrong Windows Network Adapter

PLCSIM V13 through V17 installs a Softbus driver and a set of virtual TAP adapters. The S7 server inside PLCSIM listens on the IP address of whichever Windows network adapter the user has selected in Set PG/PC Interface. If the IOT2000 reaches the PC on the physical Ethernet adapter (e.g., 192.168.0.10) but the S7ONLINE access point is bound to a TAP, Hyper-V, or VMware virtual adapter (169.254.x.x or 192.168.x.x on a different subnet), the TCP connection from the IOT never reaches a listening socket. The host TCP/IP stack answers the inbound SYN with a RST, and the IOT node reports ECONNRESET within milliseconds.

Cause 2 - Windows Firewall or Endpoint Protection Blocking TCP 102

Windows Firewall is enabled by default on every Windows 7 / 10 / 11 workstation, and PLCSIM does not auto-create an inbound allow rule for TCP 102. Combined with corporate endpoint protection suites (Symantec Endpoint Protection, McAfee Total Protection, Trend Micro, CrowdStrike Falcon with network filtering), the RST can come from the firewall itself rather than from PLCSIM. ICMP (ping) succeeds because the firewall only blocks TCP, not ICMP. This is the single most common reason a working ping is paired with a failing S7 connection.

Cause 3 - Standard PLCSIM (V13-V15) Is Local-Only Without a Bridge

The integrated PLCSIM in TIA Portal V13, V14 and V15 uses a Softbus implementation that, by default, only accepts S7 connections that originate on the same Windows host. To accept inbound ISO-on-TCP traffic from an external device such as the IOT2000, the engineer must either:

• Upgrade to PLCSIM Advanced (TIA Portal V16+), or
• Install and run an S7-Softbus-to-TCP bridge on the engineering host (such as the well-known NetToPLCSim utility) that proxies the external TCP 102 connection to the local Softbus.

If neither bridge is in place, the local Softbus will respond to the inbound SYN with an RST, producing the ECONNRESET on the IOT side even though ping works and the local TIA Portal connection to PLCSIM is fully functional.

Cause 4 - Node-RED S7 Node Version / Firmware Mismatch

The node-red-contrib-s7 node from st-one-io implements the S7Comm user-data format as defined by the Wireshark dissector. Newer firmware versions of S7-1500 CPUs (V2.5 and later) reject the legacy TPKT header negotiation used by the older 0.x and 1.x lines of the S7 node. The CPU responds to the setup communication with a Reset, which Node.js surfaces as ECONNRESET. Per the public issue tracker entry, the recommended fix is to upgrade to node-red-contrib-s7 2.x or later, and to confirm the connection is pinned to the firmware-appropriate rack/slot combination.

Prerequisites

1. Windows 10 / 11 or Windows Server 2016+ as the engineering host running PLCSIM.
2. TIA Portal V13 SP1, V14, V15, V15.1, V16, V17, or V18 with the matching PLCSIM installed. The exact build parity between TIA Portal and PLCSIM is mandatory; mismatched versions produce silent Reset behaviour.
3. SIMATIC IOT2000 with the latest Siemens Example Image (V3.3.x or later for IOT2040, V2.6.x for IOT2020), available in the Siemens SiePortal under SIMATIC IOT2000 downloads.
4. Node.js 10.x or 12.x on the IOT2000 (preinstalled by the Example Image), and the node-red-contrib-s7 palette 2.0.3 or later.
5. Administrator rights on the Windows host for PG/PC interface configuration and Windows Firewall changes.
6. Static IP addresses on both the IOT2000 and the engineering PC, on the same /24 subnet.

Step-by-Step Resolution

Step 1 - Verify the Physical Network

Confirm that the IOT2000, the engineering PC running PLCSIM, and any switch in between are all on the same IP subnet, and that the link is up.

From the IOT2000 shell (via Putty over USB or SSH):

ip addr show eth0
ping -c 4 192.168.0.10   # IP of the PLCSIM host

Successful ICMP echo replies confirm Layer 3 reachability. If ping fails, fix the network before continuing; no amount of PLCSIM tuning will recover a broken Layer 3 path.

Step 2 - Configure the TIA Portal PG/PC Interface

1. Open the Windows Control Panel and launch Set PG/PC Interface.
2. Select S7ONLINE (STEP 7) -> PLCSIM S7-1200/S7-1500 as the access point. This is the only entry the integrated PLCSIM uses for TIA Portal V13 through V15.
3. If multiple entries appear (a TAP adapter, a Hyper-V virtual switch, a VMware bridge, a WSL adapter, or a VPN virtual adapter), open the properties and bind the entry to the physical Ethernet adapter through which the IOT2000 is reachable.
4. Click OK and confirm the dialog warning that you are changing the S7ONLINE access point.

Step 3 - Verify the PLCSIM Network Interface Binding

1. Start PLCSIM from TIA Portal (Online -> Simulation -> Start) and load the S7-1500 project.
2. In the PLCSIM project tree, open the Network tab of the simulated CPU. Confirm the IP address shown matches the IP you pinged from the IOT2000. For S7-1500 PLCSIM the default is a 192.168.0.x address unless the project explicitly overrides it in the device configuration.
3. If the IP is greyed out or shows 0.0.0.0, close PLCSIM, repeat Step 2, then restart PLCSIM so the new binding is picked up.

Step 4 - Open Windows Firewall on TCP 102

PLCSIM does not auto-register an inbound firewall rule. Create one explicitly:

1. Open Windows Defender Firewall with Advanced Security.
2. Click Inbound Rules -> New Rule.
3. Rule type: Port, Protocol: TCP, Specific local port: 102.
4. Action: Allow the connection, Profile: Domain, Private, Public (restrict later if corporate policy requires it).
5. Name: PLCSIM ISO-on-TCP 102 (S7Comm).

Verify the rule is active from an elevated command prompt:

netsh advfirewall firewall show rule name="PLCSIM ISO-on-TCP 102 (S7Comm)"

If the rule is enabled and the ECONNRESET persists, run netstat -ano | findstr :102 on the Windows host. A listening entry on the bound adapter confirms PLCSIM is accepting connections; absence of a listener confirms the binding is wrong (repeat Step 2).

Step 5 - Configure the Node-RED S7 Node

1. Open the Node-RED editor on the IOT2000 (default: http://<iot-ip>:1880).
2. Drag the s7 node onto the canvas and open its configuration dialog.
3. Set Connection > IP address to the PLCSIM host IP (e.g., 192.168.0.10).
4. Set Port to 102.
5. Set Rack to 0 and Slot to 1. This is the canonical S7-1500 (and S7-1200) PLCSIM rack/slot pair. Using rack 0 slot 0 is the legacy S7-300/400 pair and is silently rejected by S7-1500 PLCSIM, causing a Reset.
6. Set Mode to Single variable, any area for the first tag, then deploy.

Reference Rack and Slot Table for S7 PLCSIM

Step 6 - Enable PUT/GET on the S7-1500 Project

1. In TIA Portal, open the S7-1500 device configuration.
2. Navigate to Properties > Protection & Security > Connection mechanisms.
3. Ensure Permit access with PUT/GET communication from remote partner is checked. Without this, the CPU silently drops the S7 setup communication and the S7 node receives ECONNRESET.
4. Recompile and download the project to PLCSIM, then restart PLCSIM so the new protection settings take effect.

Verification

1. Open the Node-RED debug sidebar. The S7 status indicator should turn green within 2 seconds of deploy.
2. Inject a debug payload and confirm msg.payload contains the simulated value (e.g., a counter from the S7-1500 program).
3. On the IOT2000 shell, capture TCP 102 traffic with tshark -i eth0 -Y "tcp.port == 102" -V and verify the COTP connection-request (CR) is followed by a COTP connection-confirm (CC) and S7 setup communication.
4. On the Windows host, run netstat -ano | findstr :102 and verify an ESTABLISHED state for the connection to the IOT2000 IP.
5. Re-deploy the Node-RED flow several times; the connection must come back up automatically within the configured reconnect interval (default 2 s).

Connection State Machine

Advanced Troubleshooting Matrix

Alternate Path: PLCSIM Advanced (TIA V16+)

Starting with TIA Portal V16, PLCSIM Advanced is a standalone application that emulates a full S7-1500 CPU inside a virtual machine and accepts inbound TCP/102 from any host on the network without the Softbus local-only limitation. To migrate:

1. Install PLCSIM Advanced V16, V17, or V18 from the Siemens SiePortal.
2. Start the PLCSIM Advanced instance and load the S7-1500 program via the Online -> Start Simulation command in TIA Portal.
3. Assign a static IP in the PLCSIM Advanced Virtual Ethernet Adapter properties that is reachable from the IOT2000.
4. Re-test the Node-RED S7 node. The S7 setup communication now traverses a real Windows TCP listener and ECONNRESET is eliminated, provided the firewall rule from Step 4 is in place.

Field-Proven Caveats and Edge Cases

Multiple TIA Portal versions: Installing TIA V15 and V16 side-by-side on the same Windows host creates two independent S7ONLINE access points. Confirm that the active access point matches the PLCSIM build that is currently running. The Control Panel applet remembers the last selection across reboots, which is a frequent source of phantom Resets after a TIA upgrade.

VPN clients: Cisco AnyConnect, GlobalProtect, FortiClient, and similar VPN agents inject a virtual TAP adapter with metric 1 that often pre-empts the physical Ethernet. Bind the S7ONLINE access point to the physical adapter, not the VPN virtual adapter, even when the VPN is disconnected.

Docker and WSL2: The vEthernet (WSL) and Hyper-V virtual switches ship with metric 1 and capture inbound traffic to the host's primary IP. Disable the vEthernet adapter or set a higher metric (Interface Metric = 100) when running PLCSIM with an IOT2000 in the same subnet.

S7-1500 firmware parity: The PLCSIM build always carries the firmware of the TIA Portal version that installed it. PLCSIM V15 is internally a V2.6 firmware; PLCSIM V17 is a V2.9 firmware. Match the S7 node to the firmware, not to the TIA Portal marketing version.

Node-RED systemd service: On the IOT2000 Example Image, Node-RED is supervised by systemd. After upgrading node-red-contrib-s7 in the palette manager, run systemctl restart node-red so the new module is loaded by the running daemon.

Recommended Long-Term Configuration

For production-style commissioning, lock down the configuration with the following settings to prevent the ECONNRESET from reappearing after a reboot or a TIA Portal update.

• Reserve a static DHCP entry for the IOT2000 and the engineering PC in your router.
• Disable the S7ONLINE access point's auto-selection in Set PG/PC Interface.
• Add a Windows Scheduled Task that re-applies the inbound firewall rule for TCP 102 on every reboot.
• Pin node-red-contrib-s7 to a tested version in package.json on the IOT2000 (e.g., "node-red-contrib-s7": "2.0.3").
• Enable Windows Event Forwarding for S7-relevant sources so a Reset is traceable in the security log.

Frequently Asked Questions