S7-1500 Remote Internet Access: SINEMA RC, eWON, and Tosibox Setup

Remote access to a SIMATIC S7-1500 controller and a SIMATIC Comfort HMI panel from a foreign country is now a routine service requirement. The naive approach of attaching a consumer router, registering a NoIP / DynDNS hostname, and forwarding TCP/102 to the S7-1500 (plus TCP/443 to the HMI Sm@rtServer) is widely documented on consumer forums and is functionally possible, but it is unsafe for production machinery. The reference architecture recommended by Siemens, by HMS Networks (eWON), and by Tosibox Oy is always a managed VPN tunnel, with no inbound ports exposed on the cellular/DSL router.

This document compares the three production-grade approaches — SINEMA RC (Siemens), eWON Cosy / Flexy with Talk2M (HMS Networks), and Tosibox — and provides the configuration steps required to upload, download, and online-monitor an S7-1500 project from a TIA Portal V15.1 engineering station. The same techniques are also used to connect a Comfort Panel's Sm@rtServer to a remote Sm@rtClient.

1. Threat Model: Why Direct DDNS + Port Forwarding Is Unsafe

Before selecting a remote-access method, enumerate the threats. The S7-1500 CPU family ships with the following natively exposed services when the PROFINET port is connected directly to the internet through a port-forwarding router:

The S7 protocol uses a static, vendor-defined challenge/response that has been publicly documented since the Stuxnet era. Modern S7-1500 firmware (V2.0 and later) requires a password for the protection level "Complete protection" and supports the "Know-how protection" attribute on blocks, but the underlying S7 communication channel itself is still not encrypted. Once an attacker is on the same TCP/102 conversation as a TIA Portal engineering station, the program upload is essentially trivial.

Search engines such as Shodan, Censys, and ZoomEye continuously scan IPv4 space. Any consumer router with a NoIP / DynDNS hostname that resolves to a public IP is normally indexed within hours. The question "Will search engines index PLC details if I connect to internet?" has a definite answer: yes, within 24–72 hours. This is independent of the DDNS provider; it is the public IP that is indexed.

Direct port forwarding also violates the IEC 62443-3-3 System Security Requirements and the VDI/VDE 2182 guideline. Any production site that must comply with NIS2, ISO 27001, or IEC 62443 cannot accept this topology.

2. Reference Architecture

All three recommended solutions share a common architecture: a hardware VPN endpoint at the remote site, an outbound-only TCP 443 (HTTPS) or UDP 1194 (OpenVPN) connection to a relay cloud, and a software client on the engineering station that establishes the encrypted tunnel. The remote router therefore requires no inbound rules and the firewall can deny everything from the WAN side.

Figure 1 — Typical remote-access architecture. The remote router has no inbound rules; all tunnels are established outbound from the LAN side.

3. SINEMA RC (Siemens)

SINEMA RC is Siemens' purpose-built remote-maintenance platform. The current product line includes:

SINEMA RC uses OpenVPN with TLS 1.2 and either pre-shared keys or X.509 certificates. All remote sites establish outbound TCP 443 or UDP 1194 connections to the server. The client and the server can be located behind NAT. The server itself needs a fixed public IP or a DNS hostname; the remote sites do not.

3.1 Required licences and sizing

SINEMA RC Server is licensed per simultaneous tunnel (SINEMA RC Server — 128 / 256 / 1024). For one foreign-country site the 128-tunnel license (article 6GK1720-1AH01-0BV0) is normally sufficient. The remote SCALANCE M router must have a "SINEMA RC" feature license activated (an option key inserted through the Web-Based Management).

3.2 High-level configuration steps

1. Install SINEMA RC Server on a Windows Server 2016/2019 (or a SIMATIC IPC) in the engineering office. Initial setup wizard generates a self-signed CA or imports an existing one.
2. Open SINEMA RC Server Management, create a Remote Site object. The site is identified by a name and a pre-shared key (PSK) or by a device certificate.
3. At the remote site, on the SCALANCE M-800 (or any SINEMA RC Client): enter the server address (FQDN of the SINEMA RC Server, e.g. vpn.example.com), the site name, and the PSK. The router now establishes the outbound OpenVPN tunnel automatically on power-up.
4. On the engineering station, install SINEMA RC Client and import the user certificate issued by the SINEMA RC Server CA.
5. Connect to the SINEMA RC Server, select the remote site, and click Connect. The client allocates a virtual IP from the configured pool (default 172.16.0.0/16).
6. Launch TIA Portal V15.1, Online → Accessible devices, and the S7-1500 at 192.168.10.10 will appear in the subnet that has been routed through the tunnel.

3.3 TIA Portal V15.1 remote-partner configuration

TIA Portal V15.1 added a Remote Partners section under Online → Remote access. Once the SINEMA RC Client is connected, the engineering station can store a permanent partner definition:

1. In the project tree: Online → Remote access → Manage.
2. Add a partner, name it (e.g. Plant_ForeignSite_01), and select the network interface that the SINEMA RC virtual adapter is bound to.
3. Assign the S7-1500 IP address (192.168.10.10) and the Comfort HMI IP (192.168.10.20) to that partner.
4. From now on, double-clicking the partner opens a secure connection through the tunnel; no manual VPN client interaction is required.

4. eWON Cosy and eWON Flexy (HMS Networks)

HMS Networks sells two remote-access appliances that are very popular with European system integrators:

• eWON Cosy 131 — a compact VPN appliance for one PLC, with built-in 4-port switch, industrial design (24 V DC, DIN-rail), and an Ethernet WAN port. Typical article number: EC6133D (depending on the WAN variant — Ethernet, Wi-Fi, 4G).
• eWON Flexy 201/301 — a modular platform with extension cards (serial MPI/PROFIBUS, 4G modem, dual Ethernet, etc.) for legacy S7-200 / S7-300 / S7-400 networks that need MPI pass-through.

Both devices terminate an OpenVPN tunnel to the Talk2M cloud relay, and the engineering station uses eCatcher to connect. Talk2M is a global, redundant cloud service hosted in Europe and North America. The remote site only opens outbound TCP 443 (HTTPS) to Talk2M.

4.1 Quick-start procedure

1. Create a Talk2M account at ewon.biz/products/talk2m and register a Free+ or Pro account (Pro for production use; SLA, audit logs, MFA).
2. At the remote site, connect the eWON Cosy to the same Ethernet switch as the S7-1500. Power the device. On first boot it obtains an IP via DHCP and is reachable at 10.0.0.53 from the LAN side; use the embedded web interface to set a fixed IP and the WAN parameters.
3. From the LAN, open the eWON web interface, log in as adm, and go to Wizard → Talk2M configuration. The wizard writes the device's activation key and the Talk2M account credentials.
4. On the engineering station, install eCatcher (Windows / macOS / Linux). Log in with the same Talk2M credentials. The eWON appears in the list with a remote ID such as cosy-XXXX-YYYY.
5. Right-click the device, Connect. eCatcher establishes the OpenVPN tunnel; a virtual network interface (typically tap0) is created on the engineering PC.
6. TIA Portal V15.1 sees the S7-1500 transparently at 192.168.10.10.

4.2 MPI/PROFIBUS pass-through with Flexy

For older S7-300 / S7-400 stations that have no Ethernet port, the Flexy 201 with an MPI/PROFIBUS extension card (EFLONEXT-MPI) can be set to Transparent Ethernet Serial mode. TIA Portal can then reach the CPU through EWON IP:Port using a virtual COM port on the engineering side. This is useful when upgrading a foreign plant that was never modernized.

4.3 Authentication and audit

• Talk2M Pro accounts enforce two-factor authentication (TOTP) for the user, and the device itself is identified by a 16-digit activation key that is tied to the account at first boot.
• Every tunnel open/close event is recorded in the Talk2M audit log, with timestamp, user, source IP, and target device.
• Accounts can be restricted per device, so a junior engineer can be granted access to the HMI but not to the S7-1500 CPU.

5. Tosibox (Tosibox Oy)

Tosibox uses a hardware key/lock concept. The Tosibox Lock is the appliance at the remote site; the Tosibox Key is a USB hardware token (or a virtual key in the cloud) on the engineering station. The system can operate in three modes:

1. Peer-to-peer (no cloud) — The Lock has a public IP (or a NoIP-style dynamic DNS), the Key connects inbound through OpenVPN.
2. Cloud relay — Both Lock and Key connect outbound to the Tosibox Hub (cloud or on-premises), and the relay stitches the two tunnels together.
3. On-premises Hub — For air-gapped customers, Tosibox sells a hardware Hub that runs in the engineering office.

The TBL5i industrial Lock and TBKey4 USB Key are the typical hardware pairing. For one remote site, the cloud relay mode is by far the simplest.

5.1 Commissioning Tosibox

1. Insert the Tosibox Key into the engineering PC. Install the Tosibox Key software.
2. At the remote site, connect the Lock's LAN port to the S7-1500 switch, and the WAN port to the internet router.
3. Power the Lock. It obtains an IP via DHCP on the WAN side. From the LAN, browse to 192.168.0.1, set the LAN IP, and create the Lock's master key. This is the only moment when physical access to the Lock is required — the master key is required to add new Keys.
4. Match the Key: insert the Key into the PC, in the Key software click Match Key with Lock by typing the Lock's master key passphrase. The Key is now bound.
5. Plug the Key back into the engineering PC. In the Tosibox Key software, click Connect. The Lock and the Key establish a mutual mTLS session and the Key gets a virtual IP in the 10.10.0.0/16 range.
6. TIA Portal V15.1 reaches the S7-1500 at 192.168.10.10 transparently.

5.2 Why Tosibox for sensitive sites

Tosibox is favoured in pharmaceutical, water-treatment, and defence-adjacent sites because the cloud relay is optional. With an on-premises Tosibox Central Lock (article TBCL) the entire VPN infrastructure runs inside the customer network — no third party is involved in the path between the engineering PC and the S7-1500.

6. HMI Sm@rtServer / Sm@rtClient Integration

For remote operator-screen mirroring, the Comfort Panel's Sm@rtServer option is enabled on the panel itself:

1. In TIA Portal, project tree → HMIs → [Comfort Panel] → Runtime settings → Services → Sm@rtServer: tick Enable, set the port (default 443), configure the user list, and assign a session timeout.
2. Add at least one Sm@rtServer display with the desired start screen and update cycle (typical 1–2 s).
3. Compile and download the project to the Comfort Panel.
4. From the engineering PC, with the SINEMA RC / eWON / Tosibox tunnel active, launch Sm@rtClient on a TIA Portal runtime PC, a second Comfort Panel, or the mobile app (iOS / Android).
5. Enter the HMI's IP (192.168.10.20), the port (443), user name, and password. The remote screen mirrors to the local display.

For the HMI path, the Comfort Panel must be reachable on TCP 443 from the engineering PC. All three VPN solutions route the plant subnet transparently, so no additional configuration is needed. If the panel is exposed through a web proxy, the proxy must support HTTP CONNECT tunneling on 443 (not all corporate proxies do).

7. TIA Portal V15.1 — Detailed Configuration

Below is the step-by-step procedure to configure TIA Portal V15.1 so that a remote S7-1500 appears as a normal online target.

7.1 Prerequisites

• TIA Portal V15.1 (or V16 / V17 for newer firmware) installed on the engineering PC.
• Project for the remote site available locally. Always work with a known-good offline copy; do not rely on the project memory of the PLC.
• One of the VPN solutions from Sections 3–5 installed and the tunnel established.

7.2 Online visibility check

1. Open the project.
2. Online → Accessible devices → [select the virtual network interface used by SINEMA RC / eWON / Tosibox].
3. Click Start search. Expected: the S7-1500 appears as 192.168.10.10 with the configured PROFINET device name, and the Comfort Panel as 192.168.10.20.
4. If nothing appears: ping 192.168.10.10 from a Windows command prompt. If ping fails, the VPN tunnel is not routing the plant subnet. If ping succeeds but TIA Portal does not see the CPU, the S7-1500 firewall (introduced with firmware V2.6) is blocking ISO-on-TCP port 102 from the engineering IP.

7.3 S7-1500 CPU firewall (firmware V2.6 and later)

Since firmware V2.6, the S7-1500 has a built-in stateful firewall. Default rule set denies any IP that has not been explicitly permitted.

1. In TIA Portal, project tree → Devices → [CPU] → Properties → Security → Firewall.
2. Add a rule: source IP = the engineering PC's virtual IP (e.g. 172.16.0.2 for SINEMA RC, or the address the VPN client assigns). Allowed services: S7 communication, Web server, OPC UA (if used).
3. Compile and download the security configuration separately. Right-click CPU → Download to device → Security configuration only.

7.4 Program upload / download workflow

1. Online → Upload from device (software) — pull the running program to the engineering PC. Compare block-by-block to the offline project (Online → Compare offline/online). Investigate every difference; an unknown difference usually means a third party has modified the program.
2. Make the modification, then Online → Download to device. TIA Portal prompts for the CPU's access password. Configure an access level (Full access including fail-safe) in the CPU properties; do not leave the default "No access" for the remote site.
3. Verify online: Online → Go online → Monitor / force. Inspect the diagnostic buffer (Online → Diagnostics → Diagnostic buffer) for any new fault entries caused by the download.
4. Sign the program blocks (Properties → Block → Know-how protection / signature) and archive the project as a baseline.

8. Cybersecurity Hardening Checklist

9. Verification and Commissioning Procedure

After installation, run the following verification steps before relying on the remote connection for production support.

1. External scan. From a network outside the remote site (e.g. from a cloud VM), run an nmap against the public IP of the remote router. Expected: All 1000 ports closed/filtered. If any port (especially 102, 443, 22, 161) is open, the router is misconfigured.
2. DDNS hostname resolution. If a NoIP / DynDNS hostname is used only for management of the SCALANCE / eWON / Tosibox Lock from the LAN, disable remote management from the WAN side. The DDNS is needed for the appliance to learn its own public IP, not for inbound access.
3. Tunnel up/down cycle. Disconnect and reconnect the internet on the remote site 5 times. Verify the tunnel re-establishes automatically. SINEMA RC default re-connect is 30 s; eWON Cosy default is 60 s; Tosibox default is 30 s.
4. Latency check. From a Windows command prompt on the engineering PC, run ping -t 192.168.10.10 for 5 minutes. Typical RTT: 80–250 ms over 4G, 30–80 ms over DSL. Jitter > 50 ms will cause TIA Portal "Online" sessions to drop.
5. Throughput check. Upload a 2 MB project to the S7-1500 and time it. Expected: 10–60 s over 4G, 4–15 s over DSL. If upload takes > 5 min, the cellular signal is poor; relocate the antenna or use an external directional antenna.
6. Fail-safe behaviour. Trigger an emergency stop on the plant. Verify the CPU fault is visible in TIA Portal Online → Diagnostics within 5 s.
7. Audit log review. Confirm the Talk2M / SINEMA RC / Tosibox audit log records the test connection with the correct user name and timestamp.

10. Troubleshooting Matrix

11. Method Selection Guide

12. Frequently Asked Questions