Resolving Sm@rtClient Remote Access on SIMATIC HMI Panels

The SIMATIC Sm@rtClient mobile application, paired with the on-device SIMATIC WinCC Sm@rtServer, enables remote operation and observation of Siemens HMI panels from Android and iOS clients. Field engineers frequently encounter connection failures when the HMI sits behind a residential or industrial router that has not been correctly prepared for inbound remote-maintenance traffic. This reference documents the precise configuration, the port semantics for 5900 versus 5800, the IPv4/IPv6 implications, the role of static addressing and dynamic DNS, and the validation procedure that proves the path end-to-end.

1. Problem Description

The reported fault pattern is reproducible and consistent:

• The Sm@rtClient app (Android/iOS) connects successfully to the panel while the mobile device is on the same LAN/subnet as the HMI.
• When the operator leaves the LAN and switches to a cellular or external Wi-Fi network, the Sm@rtClient session terminates immediately, displays "Connection failed", or hangs during the TCP handshake.
• TCP port 5900 is forwarded on the router, but external port-check services (e.g. canyouseeme.org) report the port as CLOSED.
• The router runs in IPv6 mode by default, while the panel is configured with an IPv4 address.

Each of these symptoms points to one or more layers in the network stack not being aligned with the assumptions the Sm@rtServer expects.

2. Architecture: How Sm@rtClient Reaches the Panel

Understanding the data path is essential before changing any router setting. The complete chain is:

1. Sm@rtServer runs as a service inside the HMI runtime (WinCC Comfort/Advanced or Unified RT). It binds a TCP listener on the HMI's IP address, port 5900 (VNC protocol) and optionally port 5800 (HTTP/Java).
2. The Sm@rtClient app initiates an outgoing TCP connection from the mobile device to the public IP address of the router (obtained via DNS), on the externally advertised port (typically 5900).
3. The router performs DNAT (Destination NAT) and forwards the packet to the HMI's private IPv4 address on port 5900.
4. The HMI replies; the router SNATs the response back to the mobile device.

If any step in that chain breaks, the connection fails silently on the client.

3. Port Semantics: 5900 vs 5800

Conclusion: Opening only port 5800 will never allow the mobile Sm@rtClient to connect. You must forward 5900/tcp (and optionally 5800/tcp if you also require desktop browser access).

4. Prerequisites

Before changing router or panel configuration, gather or verify the following items:

• Static IPv4 address on the HMI (e.g. 192.168.1.50/24). Do not rely on DHCP, as router reboots or lease expirations will break the DNAT target.
• Public IPv4 address of the router (visible at whatismyip.com from any device on the LAN).
• DNS name pointing to that public IP (DynDNS, No-IP, or a Siemens-approved dynamic-DNS provider). Required because most ISP residential connections use a dynamic IP.
• Sm@rtServer enabled and configured on the HMI with a strong password (TIA Portal → HMI device → Sm@rtServer).
• Sm@rtClient app installed from the official store: Sm@rtClient on Google Play or Sm@rtClient on the App Store.
• Administrative access to the router to create a port-forwarding (virtual server) rule.

5. Step-by-Step Configuration

5.1 Configure a Static IPv4 Address on the HMI

1. On the panel, open Control Panel → Network and Dial-up Connections → <LAN interface>.
2. Set IP address to a free address outside the router's DHCP range (e.g. 192.168.1.50).
3. Set Subnet mask to 255.255.255.0.
4. Enter the router's address as the Default gateway (e.g. 192.168.1.1) and a LAN DNS server (typically the router itself).
5. Save and reboot the HMI.

Verify on a PC: ping 192.168.1.50 from inside the LAN must respond without loss.

5.2 Enable and Configure Sm@rtServer on the HMI

1. In TIA Portal, open the HMI device configuration.
2. Navigate to Runtime settings → Services → Sm@rtServer.
3. Tick "Activate Sm@rtServer".
4. Define a password (min. 8 characters, mixed case, digit, special character).
5. Optionally restrict source IP ranges and configure Auto-logoff after a defined idle period (recommended 5-15 min for plant-floor security).
6. Download the project to the HMI.

Verify locally: launch Sm@rtClient while on the same Wi-Fi, enter the HMI's LAN IP, and confirm you see the live screen and can operate it.

5.3 Configure Port Forwarding on the Router

1. Log in to the router (typical address 192.168.1.1).
2. Locate Port Forwarding, Virtual Server, or NAT (terminology varies: AVM FRITZ!Box uses Freigaben, TP-Link uses Virtual Servers, Cisco uses Port Address Translation).
3. Create a new rule:

4. Save and reboot the router if required.

5.4 Configure Dynamic DNS (Required for Most Residential Links)

1. Register with a dynamic-DNS provider (No-IP, DynDNS, DuckDNS, or a Siemens-recommended service for industrial sites).
2. Configure the router's Dynamic DNS client with the provider's hostname, username, and password. Most modern routers include native DDNS clients; otherwise run one on a small always-on PC.
3. Verify the DNS name resolves to the current public IP: nslookup yourhost.dyndns.org 8.8.8.8.

6. IPv6 Considerations

A common fault, explicitly cited in the original report, is the router defaulting to IPv6 only on the WAN side. Sm@rtClient v1.x negotiates an IPv4 socket exclusively; it does not perform DNS64/NAT64 translation. The consequences are:

• If the HMI has only an IPv4 address and the WAN is IPv6-only, the inbound packet from the mobile carrier (typically dual-stack or IPv6) cannot reach the HMI.
• If the HMI has only an IPv6 link-local address and the WAN is IPv4, the situation is symmetric and equally broken.

Resolution path:

1. Force the router's WAN interface to IPv4 (or Dual-Stack / IPv4 preferred). On FRITZ!Box this is Internet → Account information → IP address → IPv4 preferred.
2. Confirm the HMI's ipconfig-equivalent shows a valid IPv4 gateway.
3. From a PC on the LAN, run curl -v telnet://<public IP>:5900 to verify the path before involving the mobile device.

7. Verifying the External Port is Open

Use the following sequence to prove the DNAT path is working before involving the Sm@rtClient app:

1. From a PC on the LAN, browse to canyouseeme.org (or yougetsignal.com).
2. Enter port 5900 and click Check.
3. Expected result: Success: I can see your service on <public IP> on port 5900.
4. If the result is Error: Connection refused or Connection timed out:
   • Confirm the HMI is powered and the Sm@rtServer is running (check on the panel: Control Panel → Sm@rtServer → Status = Running).
   • From a LAN PC, run Test-NetConnection 192.168.1.50 -Port 5900 (PowerShell) or nc -zv 192.168.1.50 5900 (Linux/macOS). Both must report open.
   • If the LAN test passes but the external test fails, the port-forwarding rule is the culprit. Re-check rule parameters and reboot the router.
5. Once the external port-check reports success, attempt the Sm@rtClient connection from a mobile device on cellular data, using the DDNS hostname and port 5900.

8. Sm@rtClient Connection String and Parameters

On the mobile app, configure the connection profile as follows:

Tap Connect. The expected sequence is:

1. TLS / VNC handshake (~1-2 s on a clean link).
2. Authentication prompt → enter Sm@rtServer password.
3. Screen paint (~2-5 s on broadband; longer on cellular).

9. VPN as a Secure Alternative

Exposing port 5900 directly on the public Internet is convenient but expands the attack surface. Industrial-security guidance (e.g. IEC 62443) recommends terminating remote-maintenance access in a VPN rather than forwarding raw VNC. Two operational patterns are common:

9.1 Site-to-Site IPsec VPN

The plant router establishes an IPsec tunnel to a corporate concentrator. Operators on the corporate network reach the HMI on its private address 192.168.1.50:5900 as if they were on-site. No inbound port-forwarding to the HMI is required.

9.2 Per-User SSL / OpenVPN Client

The operator runs an OpenVPN or WireGuard client on the mobile device. The VPN server on the plant router pushes a route to 192.168.1.0/24. The Sm@rtClient app uses the HMI's private address (192.168.1.50:5900) over the encrypted tunnel. This is the recommended pattern for field-service technicians.

10. Security Hardening Checklist

• Change the Sm@rtServer password from the TIA Portal default.
• Restrict source IPs in the Sm@rtServer settings (e.g. allow only the corporate VPN subnet).
• Use a non-standard external port (e.g. 25900 mapped internally to 5900) to defeat opportunistic scanners.
• Enable firewall logging on the router and review rejected packets weekly.
• Disable port 5800 unless desktop browser access is required — Java is no longer supported and the applet is a known attack vector.
• Set auto-logoff on the Sm@rtServer to 5-15 min.
• Patch the HMI image per Siemens security advisories; check SIOS quarterly.

11. Troubleshooting Matrix

12. Related Siemens Documentation

• SIOS 109482434 — SIMATIC WinCC [email protected] remote maintenance for SIMATIC HMI
• SIOS 92275245 — Delivery release SIMATIC WinCC Sm@rtClient app
• Sm@rtClient on Google Play
• Sm@rtClient on the Apple App Store