Troubleshooting Ewon Cosy Port Forwarding to an AB PLC

An Ewon Cosy proxy configuration forwards an Allen-Bradley PLC web service successfully, but EtherNet/IP communication from the plant-side Ignition server does not connect. The evidence confirms the port mappings and failed setting changes; it does not establish whether the failure is caused by routing, broadcast-dependent discovery, proxy direction, or the PLC communication path.

Current Ewon Cosy Port Mappings

The configuration enables the proxy with ProxyEnabled=1 and sets ProxyExtItf=0. Because the evidence does not define the numeric meanings of the protocol, side, or interface values, verify those meanings against documentation for the installed Cosy model and firmware before changing them.

Separate Port Forwarding from PLC Discovery

A successful HTTP mapping proves that at least one proxy path reaches the PLC, but it does not prove that EtherNet/IP sessions can traverse the same path. The reported Ignition connection targets port 44818, while the PLC resides on the machine network at 192.168.200.130 and the client resides on the plant network identified as 100.101.

Broadcast-dependent Allen-Bradley discovery is a stated routing concern and should be treated as a hypothesis, not a confirmed root cause. Configure Ignition to address the PLC through the Cosy's plant-facing address and forwarded port directly; do not use discovery results as the sole reachability test.

Troubleshooting Procedure

1. Confirm the exact destination IP and port used by Ignition. The destination should be the Cosy address visible from the plant network with port 44818, not the PLC's private 192.168.200.130 address unless that subnet is explicitly routed.
2. Verify that the rule receiving plant-side traffic forwards to 192.168.200.130:44818. Check the documented meanings of ProxyExtItf, ProxyProto, and ProxySide; the supplied evidence alone cannot confirm that values 0, 1, and 2 select the intended interfaces and protocols.
3. Test a direct connection to the Cosy's forwarded port from the Ignition host. If no connection reaches the Cosy, investigate plant-side routing or filtering. If it reaches the Cosy but no corresponding connection reaches the PLC, investigate proxy selection and forwarding.
4. Capture or inspect traffic on both sides of the Cosy while initiating one Ignition connection. Determine whether traffic arrives on the plant-facing interface, is forwarded to 192.168.200.130:44818, and receives a response.
5. Remove or disable duplicate rules during controlled testing so one protocol-and-direction mapping is evaluated at a time. Preserve the working 8080-to-80 mapping as a reachability reference.

Interpret the Results

No improvement was observed after changing WanPxyPort from 8080 to 44818 or setting WANPxyMode to 10. Those results rule out neither routing nor proxy-rule selection, because the evidence does not define how those settings interact with the six configured rules.

If traffic reaches the PLC and replies return to the Cosy but Ignition still fails, inspect whether the application exchanges addresses or relies on traffic that the routed proxy path cannot carry. If the request never reaches the PLC, correct the selected interface, direction, protocol, or upstream filtering. NAT 1:1 was suggested as a reachability test, but it is unavailable in this installation and therefore is not a required resolution path.

FAQ