Siemens LOGO! 0BA7 Remote Access via GPRS Modem Setup

Overview

Remote access to a Siemens LOGO! 0BA7 deployed at an unmanned site (lift stations, reedbed blowers, dosing skids, agricultural bins) is normally handled by opening ports on the customer's router or assigning a fixed WAN IP. Both options are frequently unavailable: the customer will not expose the LAN to the public Internet, and the ISP assigns an address via DHCP. Connecting a GPRS/UMTS/HSPA modem to the LOGO! Ethernet port moves the cellular link into the equipment cabinet and isolates the LOGO! from the customer's network.

This reference covers the practical architectures for connecting a GPRS modem to a LOGO! 0BA7, the part numbers that actually work over Ethernet, the IP addressing options (public dynamic, private APN, GRE/L2TP VPN), and the field commissioning procedure. It also documents the pitfalls of the IMO-1 / MOROS path (serial-only, 0BA6 and below) and the constraints of low-cost USB dongles.

LOGO! 0BA7 Ethernet Interface Capabilities

The LOGO! 0BA7 (6ED1052-xxx08-0BA0 series, BM base module with Ethernet) provides a 10/100 Mbit/s RJ45 port and a built-in Ethernet/Web server. Relevant services exposed on the LAN interface:

• Web server on TCP/80 (LOGO! 0BA7 firmware >= V1.04.00): read I/O, VM addresses, change operating mode, set network inputs NI1..NI8.
• LOGO!Soft Comfort V8 programming / online access on TCP/1352 (S7ONLINE) and TCP/102 (ISO-TSAP).
• SNTP client (UDP/123) and Modbus TCP server on TCP/502 (configurable enable on 0BA7 Standard and higher; verify per Siemens LOGO! 0BA7 system manual).
• No NAT, no firewall, no PPP/PPPoE client.

Because the LOGO! is a passive Ethernet node, it cannot initiate a tunnel or terminate a VPN. The GPRS modem (or a small router in front of it) must provide the WAN interface, the IP layer, and any address translation.

Remote Access Architecture Options

Three cellular architectures are viable for a LOGO! 0BA7. Each differs in cost, latency, and exposure to the public Internet.

Option 1 is the closest match to the original poster's question: connect a GPRS modem that has an Ethernet LAN port to the LOGO! 0BA7 RJ45. The modem dials the cellular APN and exposes the LOGO! on a private subnet (typically 192.168.1.x) with its own NAT. Remote clients reach the LOGO! through port forwarding on the modem, via SMS wake-up, or through an optional GRE/IPsec tunnel.

Hardware Selection: GPRS / GSM / HSPA Modems

The decisive question is the physical interface to the LOGO!. The 0BA7 has only Ethernet; therefore the modem must expose Ethernet, not RS-232. The frequently cited Insys IMO-1 / MOROS family and the Phoenix Contact PSI-GPRS/GSM-MODEM/RS232-QB (order code 2313106) are RS-232 only and will not communicate with the 0BA7's Ethernet port without an external protocol converter. They are useful for LOGO! 0BA5/0BA6 with the AS-i CM module or with the LOGO! RS-232 expansion, but not for an Ethernet-attached 0BA7.

Recommendation: for a 24/7 cabinet deployment feeding a LOGO! 0BA7 over Ethernet, the Moxa OnCell 5104-HSPA or the Sierra Wireless GX450 are the lowest-risk choices because the Ethernet switch is integrated, the firewall and port-forwarding GUI is built in, and the firmware is qualified for industrial temperature ranges. The Phoenix Contact PSI-GPRS/GSM-MODEM/RS232-QB is a good SMS gateway component but must be paired with an Ethernet-attached host (RPi or router) to be useful with the 0BA7.

Cellular IP Addressing Architectures

Once the modem is selected, decide how the LOGO! will be reached. The three working models for a small fleet are summarized below.

Public dynamic IP with DynDNS

Most M2M SIMs receive a private RFC 1918 address behind the carrier's CGN (carrier-grade NAT). Without a public IP, port forwarding from the public Internet into the modem is impossible. Workarounds:

1. Order a SIM with a public static IP from the M2M provider (typical surcharge 5-15 EUR/month in EU markets).
2. Configure the modem's DynDNS client (No-IP, Dyn, DuckDNS) against the carrier-assigned dynamic IP. This only works if the carrier does not CGN.
3. Terminate the connection at a relay broker the modem dials outbound (see Option 3 below).

Private APN with corporate VPN

An M2M provider issues a private APN (custom APN name, e.g. logo.m2m.provider.com) and routes all SIM traffic into a corporate VRF. The remote operator reaches the LOGO! by joining the same VPN (IPsec or WireGuard) from a workstation or an Android/iOS client. This is the only architecture that exposes neither the modem nor the LOGO! to the public Internet.

Outbound tunnel to a relay broker

If neither a static IP nor a private APN is available, have the modem open an outbound TCP/443 or TCP/8883 connection to a cloud relay (e.g. a self-hosted MQTT broker, a remote.it agent, a Cloudflare Tunnel). The relay assigns the LOGO! a stable hostname. No inbound firewall holes are required; both ends connect outward.

Configuration Procedure: Moxa OnCell 5104 with LOGO! 0BA7

The procedure below is the most common industrial deployment. Substitute the equivalent screens for Insys, Sierra, or Phoenix Contact routers; the parameter names are similar.

Prerequisites

• LOGO! 0BA7 BM with firmware V1.04.00 or newer (Web server and Modbus TCP enabled; verify in Siemens LOGO! 0BA7 manual entry ID 109751122).
• LOGO!Soft Comfort V8.0 or newer on a Windows engineering station.
• Moxa OnCell 5104-HSPA with firmware 1.7 or newer.
• M2M SIM with public static IP, OR private APN, OR a relay broker reachable on TCP/443 outbound.
• Patch antenna on the cabinet top; SMA male, 50 ohm, quad-band (e.g. Taoglas TG.22.0111).

Step-by-step

1. Configure the LOGO! Ethernet parameters in LOGO!Soft Comfort.
   • IP address: 192.168.1.10
   • Subnet mask: 255.255.255.0
   • Gateway: 192.168.1.1 (this is the modem's LAN IP)
   • Enable Web server access: Tools → Ethernet Connections → Web Server Access → check Allow Web server access.
   • Download the program to the LOGO! and cycle power.
2. Wire the modem.
   • Insert the SIM (chip side down, contact pins engage).
   • Connect the antenna to the SMA bulkhead on top of the cabinet. Route the coax so it exits the cabinet within 50 cm of the bulkhead to keep feedline loss low.
   • Patch a Cat5e/Cat6 cable from the modem's LAN1 port to the LOGO! 0BA7 RJ45.
   • Apply 24 V DC. Observe the modem's CELL LED; steady green within 60 s indicates registration on the home PLMN.
3. Configure the modem's LAN side.
   • Browser to the modem's default IP (192.168.1.1 for OnCell).
   • Set LAN IP to 192.168.1.1/24, disable DHCP server (the LOGO! is static) OR enable DHCP with a reservation for 192.168.1.10 = MAC of LOGO!.
   • Apply, log in again from the new address.
4. Configure the cellular WAN.
   • Cellular → APN: enter the SIM provider's APN string. Username/password if required by the APN.
   • Authentication: PAP or CHAP as the carrier requires (most M2M APNs use PAP).
   • PDP type: IPv4. Most M2M SIMs do not support dual-stack IPv6 today.
   • Save and observe the IP assigned by the carrier. Note: this is the WAN IP; the LOGO! will sit behind it.
5. Open the inbound ports.
   • Firewall → Port Forwarding: external TCP/80 to 192.168.1.10:80 (LOGO! Web server).
   • If LOGO!Soft Comfort remote programming is required: external TCP/1352 (S7ONLINE) and TCP/102 (ISO-TSAP) to 192.168.1.10.
   • For Modbus TCP polling by an HMI/SCADA: external TCP/502 to 192.168.1.10:502.
   • If you use a private APN with a corporate VPN, the forwarding table can be relaxed and the corporate firewall carries the rules.
6. Enable SMS wake-up.
   • OnCell has SMS Command features. Configure an authorized phone number (E.164) and a keyword such as REBOOT. This is useful when the operator needs to power-cycle the LOGO! from the Android App perspective.
7. Bind the SIM's public IP to a hostname.
   • Dynamic DNS → enable, service provider (No-IP/Dyn/DuckDNS), hostname (e.g. pump-station-7.ddns.org).
8. Verify from the public side.
   • From a phone on a different cellular network, browse to http://pump-station-7.ddns.org. The LOGO! Web server page should appear.
   • Open the LOGO! App, add a connection pointing to pump-station-7.ddns.org:80, log in with the LOGO! Web password.

Configuration Procedure: Low-cost Raspberry Pi + USB Dongle

If the budget cannot support an industrial router, the field-proven alternative is a Raspberry Pi running an SSH reverse tunnel or a WireGuard peer. The Pi attaches via USB to a Huawei E3372 or similar LTE dongle, and via Ethernet to the LOGO! 0BA7.

Prerequisites

• Raspberry Pi 3B+ or 4 with Raspberry Pi OS Lite (Bookworm) or OpenWrt 23.05.
• USB LTE dongle in HiLink mode (cdc_ether) or modem mode (option / qmi_wwan).
• SIM with public dynamic IP or, preferably, outbound-only tunnel.

Steps

1. Set the dongle to HiLink with huawei_cdc_ncm or to modem mode with usb_modeswitch.
2. Configure wvdial or NetworkManager with APN, PAP/CHAP credentials.
3. Configure the Pi's eth0 with static IP 192.168.1.1/24 and run dnsmasq as a DHCP server; the LOGO! may keep a static IP 192.168.1.10 for simplicity.
4. Enable IP forwarding: sysctl -w net.ipv4.ip_forward=1 and add masquerade: iptables -t nat -A POSTROUTING -o wwan0 -j MASQUERADE.
5. Install openssh-server and autossh. Create an outbound tunnel: autossh -M 0 -N -R 8080:192.168.1.10:80 [email protected]. The operator then reaches the LOGO! on http://relay.example.com:8080.
6. Alternative: install wireguard on the Pi and on the operator's laptop; assign 192.168.50.3 to the Pi and 192.168.50.4 to the laptop; remove the SSH tunnel.
7. Restart, verify the wwan0 link is up after reboot, and that the autossh tunnel reconnects after a cellular outage.

AT Command Programming Reference

When using a serial modem (Phoenix Contact PSI-GPRS/GSM-MODEM/RS232-QB (2313106), OSTENT SIM800-based dongle, or a Sierra Wireless module in serial mode) with a host that runs the TCP/IP stack (RPi, industrial PC), the host controls the modem with AT commands over /dev/ttyUSB0 at 115200 8N1.

Common error codes returned by SIMCOM and Quectel modules (which the Phoenix Contact PSI is built on):

SMS Gateway Alternative

If the LOGO! only needs alarms (high level, pump trip, mains fail) and a few setpoint changes, an SMS gateway is sufficient. A Phoenix Contact PSI-GPRS/GSM-MODEM/RS232-QB or an OSTENT SIM800 dongle can be attached to an RPi; smstools3 or gammu-smsd runs in the background. The RPi reads the LOGO!'s VM addresses via Modbus TCP on TCP/502 and translates them to SMS. Setpoint changes arrive as inbound SMS, parsed and written back to the LOGO! over Modbus. This architecture survives 2G-only SIMs and does not require any public IP.

Security Hardening

• Change the LOGO! Web password from the default LOGO; do this in LOGO!Soft Comfort under Tools → Ethernet Connections → Web Server Access → Password.
• Disable S7ONLINE access (TCP/1352, TCP/102) on the cellular modem if remote programming is not part of the contract. Leave only TCP/80 (Web) and TCP/502 (Modbus) forwarded.
• Use a private APN or a VPN instead of public port forwarding when the operator handles more than one site.
• Lock the SIM with a PIN, but ensure the modem is configured to send AT+CPIN on boot.
• Restrict the modem's Web admin UI to the LAN interface only; never expose it on the WAN.
• Apply the cellular modem vendor's firmware updates; older firmware versions on OnCell and Insys devices have had CVE-listed IPsec issues.

Verification Procedure

1. From an LTE phone on a different carrier, browse to http://<hostname>. The LOGO! Web page should load in < 5 s.
2. Open the LOGO! App, connect to <hostname>:80, log in, toggle a network input NI1. The corresponding VM bit and the wired output should change state within 1 s.
3. Disconnect the WAN antenna. Confirm the LOGO! continues to run the local program (cellular outage must not stop the pumps).
4. Reconnect the antenna. Confirm the autossh or WireGuard tunnel (if used) reconnects within 60 s.
5. Power-cycle the cabinet and confirm the cellular link and the LOGO! Web server are both reachable within 90 s of cold start.
6. Inject a 24 V power-loss test of 30 s; verify the SIM re-registers (LED steady) and the link returns.

Troubleshooting Matrix

Spare Parts and Re-order Notes

• LOGO! 0BA7 BM 230RCE: Siemens 6ED1052-1FB08-0BA1 (230 V AC supply, relay outputs, Ethernet).
• LOGO! 0BA7 BM 24CE: Siemens 6ED1052-1MD08-0BA1 (24 V DC supply, solid-state outputs).
• Moxa OnCell 5104-HSPA: order code OnCell 5104-HSPA-US/EU/AP (region-specific SKU; verify band lock against operator).
• Phoenix Contact PSI-GPRS/GSM-MODEM/RS232-QB: order code 2313106.
• Quad-band antenna with SMA male: e.g. Phoenix Contact 2313891 or Taoglas TG.22.0111.
• M2M SIM with public IP: check with local M2M aggregators (in EU: 1NCE, Tele2 M2M, Vodafone M2M, DTAG M2M).

Field-Commissioning Checklist

• [ ] SIM inserted, PIN removed or stored in modem profile.
• [ ] Antenna fitted on cabinet top, coax < 1 m, connectors torqued.
• [ ] CSQ ≥ 10 at commissioning; record CSQ value on the test sheet.
• [ ] LOGO! static IP 192.168.1.10/24, gateway 192.168.1.1.
• [ ] Modem LAN IP 192.168.1.1/24, DHCP disabled or reserved.
• [ ] Port-forwarding rule TCP/80 → 192.168.1.10:80 verified.
• [ ] LOGO! Web password changed from default.
• [ ] DynDNS hostname or VPN tunnel validated from a phone on a different carrier.
• [ ] Cold-start test passed (90 s to online).
• [ ] 30 s power-loss test passed (link recovers).