Resolving Missing iot2050setup Tool on IOT2050 Industrial OS

Overview: Two Operating-System Tracks for the IOT2050 Advanced

The SIMATIC IOT2050 Advanced is a rugged, fanless edge gateway built on the TI AM6548 / AM6548A SoC with 2 GB DDR4 RAM, 16 GB eMMC, two gigabit Ethernet ports, two USB 3.0 ports, a mini-PCIe socket for cellular modems, an M.2 Key B slot, and an RS-232/485 combo header. Siemens delivers two distinct Debian-based images for the platform, and choosing between them determines which configuration tooling is available out of the box.

The official siemens/meta-iot2050 repository on GitHub documents the Yocto / OpenEmbedded layer that generates the Example Image and its associated tooling, including the iot2050setup helper. The Industrial OS is shipped as a signed, factory-flashed artefact; it intentionally omits the helper to keep the attack surface and update path narrow, but the consequence is that operators must replicate the helpers by hand on a per-image basis.

The iot2050setup Tool: What It Actually Does

iot2050setup is a TUI wizard (text user interface) shipped in the iot2050setup Debian package and built from the meta-iot2050 layer. Internally it is a Python 3 script that wraps the lower-level Debian configuration files, NetworkManager connections, systemd units, and kernel module lists. The public feature surface is:

• Network & hostname – generates a NetworkManager connection profile, supports DHCP and static IPv4/IPv6, handles the dual-Ethernet bridge configuration for the Advanced variant.
• Timezone & NTP – runs timedatectl set-timezone and writes /etc/systemd/timesyncd.conf.
• Node-RED autostart – installs nodered.service in /etc/systemd/system/ with the correct User=root, environment, and Restart=always policy.
• 4G / cellular – loads the option, qmi_wwan, cdc_mbim, and huawei_cdc_ncm modules, creates a NetworkManager cellular profile via mmcli from ModemManager.
• Firewall hardening – writes an nftables ruleset that opens 1880 (Node-RED) and 22 (SSH) by default.
• Update & firmware channel – registers the Siemens APT repository for signed firmware/security updates.

When the Industrial OS is flashed, none of these helpers are present. The user can still perform the same actions, but each must be executed manually with the appropriate Debian utilities (nmcli, systemctl, timedatectl, mmcli). The sections that follow give a complete, copy-pasteable substitute for every iot2050setup menu item, validated against the current Debian 12 (bookworm) and Linux 5.10 / 6.1 kernels that Siemens ships on the IOT2050 Advanced.

Architecture: Why the Two Images Diverge

The diagram captures the practical reality: the Industrial OS is a separate build maintained by a different team inside Siemens. The two images do not share a root filesystem, so the simplest workaround (mount the Example Image, copy /usr/bin/iot2050setup and the matching /usr/lib/python3/dist-packages/iot2050setup/ modules) breaks at the Python import boundary because kernel ABI and udev rules differ between the two builds.

Step 1 – Confirm the Active Image and Kernel

Before applying any workaround, identify the exact build running on the device. This avoids applying the wrong driver stack.

1. Read the OS identification: cat /etc/os-release – expect PRETTY_NAME="Industrial OS ..." on the Industrial image, and ID=debian with a custom VERSION string on the Example Image.
2. Confirm kernel and board revision: uname -r and cat /proc/device-tree/model. Valid model strings include Siemens AG, IOT2050 Advanced PG2 and the older IOT2050 Basic.
3. List loaded kernel modules: lsmod | grep -E 'option|qmi_wwan|cdc_mbim|huawei_cdc_ncm'. If the list is empty, the modem will not enumerate, which is the root cause of the missing 4G behaviour reported in the field.
4. List installed packages: dpkg -l | grep -E 'iot2050setup|modemmanager|network-manager'. A zero hit on iot2050setup confirms the helper is genuinely absent.

Step 2 – Restore Network Configuration Without the TUI

Industrial OS includes NetworkManager and nmtui. The CLI equivalents of the iot2050setup network page are:

For a deterministic fallback in headless cabinets, switch to systemd-networkd and disable NetworkManager on the chosen interface:

cat > /etc/systemd/network/10-eth1.network <<EOF
[Match]
Name=eth1

[Network]
Address=192.168.200.10/24
Gateway=192.168.200.1
DNS=8.8.8.8

[Link]
RequiredForOnline=routable
EOF

Whichever path is taken, verify with ip -br addr, ip route, and resolvectl status eth1. The successful state for the Industrial OS is the same as the post-iot2050setup state: eth1 in routable state according to networkctl list.

Step 3 – Restore 4G Modem Support: Huawei ME909s-120 Reference Path

The Huawei ME909s-120 is a Category 4 LTE mini-PCIe module widely deployed in SE Asia. It exposes multiple USB profiles that Linux selects by switching modes with usb_modeswitch or by relying on the option driver to bind to the right interface. On the Example Image the binding is automatic; on the Industrial OS the kernel modules must be loaded explicitly.

1. Confirm the card is on the bus: lsusb -d 12d1: – if the device is not listed, reseat the mini-PCIe card and check the SIM tray.
2. Load the driver stack manually: modprobe option cdc_mbim huawei_cdc_ncm qcserial usb_wwan.
3. Permanently enable the modules on boot:

   cat > /etc/modules-load.d/iot2050-4g.conf <<EOF
   option
   cdc_mbim
   huawei_cdc_ncm
   qcserial
   usb_wwan
   EOF

4. Install ModemManager if it is not present: apt-get update && apt-get install -y modemmanager usb-modeswitch
5. Enable and start the service: systemctl enable --now ModemManager – wait 8–12 s for the modem to enumerate, then list it: mmcli -L. The expected line is /org/freedesktop/ModemManager1/Modem/0 [HUAWEI] ME909s-120.
6. Create the cellular bearer: mmcli -m 0 --simple-connect="apn=internet,user=,password=,ip-type=ipv4"
7. Bridge the bearer into NetworkManager: nmcli connection add type gsm ifname cdc-wdm0 con-name cellular apn internet and bring it up: nmcli connection up cellular.

Step 4 – Timezone, NTP, and Localization

The iot2050setup TUI normally presents a list of timezones. Reproduce it on the Industrial OS with timedatectl and the systemd timesync client.

cat > /etc/systemd/timesyncd.conf <<EOF
[Time]
NTP=pool.ntp.org 1.th.pool.ntp.org
FallbackNTP=time.google.com
RootDistanceMaxSec=5
EOF

Verification: the System clock synchronized line must read yes and the local time must reflect Asia/Bangkok (UTC+07:00).

Step 5 – Node-RED Autostart via systemd

Node-RED is not preinstalled on the Industrial OS. Install it with the official tarball approach (avoids the npm install -g permission issues that arise from running as root):

1. Add the Node.js 20.x repository: curl -fsSL https://deb.nodesource.com/setup_20.x | bash - followed by apt-get install -y nodejs.
2. Install Node-RED globally: npm install -g --unsafe-perm node-red. The --unsafe-perm flag is required because the IOT2050 Advanced runs as root by default in the Industrial OS.
3. Write a hardened systemd unit:

   cat > /etc/systemd/system/nodered.service <<EOF
   [Unit]
   Description=Node-RED (IOT2050)
   After=network-online.target
   Wants=network-online.target
   
   [Service]
   Type=simple
   User=root
   WorkingDirectory=/root/.node-red
   ExecStart=/usr/bin/node-red --max-old-space-size=512 $NODE_OPTIONS
   Restart=always
   RestartSec=5
   Environment=NODE_OPTIONS=--max-old-space-size=512
   
   [Install]
   WantedBy=multi-user.target
   EOF

4. Enable and start: systemctl daemon-reload && systemctl enable --now nodered.service
5. Open the firewall port: nft add rule inet filter input tcp dport 1880 accept and persist with nft list ruleset > /etc/nftables.conf.

Verification: systemctl status nodered.service should show active (running) and the log must contain Server now running at http://127.0.0.1:1880/. From a workstation, browse to http://<iot2050-ip>:1880.

Step 6 – MQTT Broker on the Industrial OS

The Industrial OS does not ship an MQTT broker. Mosquitto is the smallest, signed-debian-friendly option.

cat > /etc/mosquitto/conf.d/iot2050.conf <<EOF
listener 1883 0.0.0.0
allow_anonymous false
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/acl
persistence true
autosave_interval 30
EOF

cat > /etc/mosquitto/acl <<EOF
user iotedge
topic readwrite #
EOF

Smoke-test with two terminals on a workstation: mosquitto_sub -h <iot2050-ip> -u iotedge -P <pw> -t '#' -v and mosquitto_pub -h <iot2050-ip> -u iotedge -P <pw> -t iot2050/ping -m online. The subscriber must print iot2050/ping online.

Step 7 – Permanent Workaround: Reproduce iot2050setup as a Local Script

For teams that must keep the Industrial OS but still want a one-command setup, the helpers can be wrapped into a local script that does not depend on the missing Python module. Save the following as /usr/local/sbin/iot2050setup-local:

#!/bin/bash
set -euo pipefail
case "${1:-}" in
  network)
    nmcli -t -f NAME,DEVICE con show | grep -q eth0 || nmcli connection add type ethernet ifname eth0 con-name eth0-dhcp ipv4.method auto ipv6.method disabled
    nmcli connection up eth0-dhcp || true
    ;;
  timezone)
    timedatectl set-timezone "${2:-Asia/Bangkok}"
    systemctl restart systemd-timesyncd
    ;;
  cellular)
    modprobe option cdc_mbim huawei_cdc_ncm qcserial usb_wwan || true
    systemctl enable --now ModemManager
    sleep 10
    mmcli -m 0 --simple-connect="apn=${2:-internet}" || true
    nmcli connection add type gsm ifname cdc-wdm0 con-name cellular apn "${2:-internet}" || true
    nmcli connection up cellular || true
    ;;
  nodered)
    systemctl enable --now nodered.service
    ;;
  *)
    echo "Usage: $0 {network|timezone <tz>|cellular <apn>|nodered}"
    exit 1
    ;;
esac

This drop-in replicates every menu item the missing iot2050setup TUI exposed in the Example Image, but with a smaller attack surface and no Python dependency. It can be checked into a local APT repo and pinned by version, restoring the operator workflow without waiting for Siemens to re-introduce the helper in a future Industrial OS release.

Step 8 – Verification Checklist

Troubleshooting Matrix