Secure Remote Access in Machine - Ewon WAN and LAN on same subnet behind Compact

This guide explains how to remotely access a Siemens PLC through Talk2M when using an Anybus Defender Compact and an Ewon configured with the same-subnet workaround.

APPLICABLE PRODUCTS

Anybus Defender Compact 1004 - NAT/FW

Ewon Cosy+

Ewon Flexy

Connect a PLC to Talk2M Through an Ewon Using the Same LAN/WAN Subnet

Purpose

This guide explains how to remotely access a PLC through an Ewon and Talk2M when the Ewon WAN network and PLC network must use the same IP subnet.

The working topology uses:

• Anybus Defender Compact
• Ewon connected through its WAN port
• Ethernet switch
• PLC connected to the same switch as the Ewon WAN
• eCatcher and Talk2M for remote access
• A virtual machine connected through the host PC running eCatcher

This configuration uses the Ewon same-subnet workaround with KillLAN=1.

Important limitation

This is a workaround for situations where the Ewon WAN and PLC must remain in the same subnet.

When KillLAN=1 is enabled:

• The Ewon LAN interface is disabled.
• The configured Ewon LAN IP becomes a dummy routing address.
• The PLC and Ewon WAN must be connected to the same Ethernet network.

The Ewon LAN IP will normally not respond to ping.

1. Network topology

Use the following physical connection:

The Ewon LAN port should remain disconnected.

Example addressing:

Network:                       15.15.15.0/24

Subnet mask:                255.255.255.0

Compact LAN:              15.15.15.1

Ewon WAN:                   15.15.15.2

Ewon dummy LAN:       15.15.15.3

PLC:                               15.15.15.15

The switch is required because the Ewon WAN port and PLC must be connected to the same protected network behind the Defender.

2. Configure the Ewon WAN interface

Configure the Ewon WAN interface with an unused address in the PLC subnet. Go to Setup -> Wizards -> Internet and follow the guide.

Example:

WAN IP address:         15.15.15.2

Subnet mask:              255.255.255.0

Default gateway:         15.15.15.1

Verify that the Ewon can connect to the internet and Talk2M through the Defender.

3. Configure the Ewon dummy LAN address

Configure the Ewon LAN interface with another unused address in the same subnet. Go to Setup -> System -> Communication -> General -> Eth1 LAN

Example:

LAN IP address:           15.15.15.3

Subnet mask:               255.255.255.0

This address is used internally by the same-subnet workaround.

4. Configure the Ewon COM parameters

Open the Ewon configuration page and navigate to the COM configuration parameters. Go to Setup -> System -> Storage -> Tabular edition -> Edit COM cfg

Apply the following parameters:

KillLAN     = 1

WANItfProt  = 2

FwrdToWAN   = 1

NATItf      = 2

These settings are used to enable the same-subnet routing workaround.

After changing the parameters:

1. Save the configuration.
2. Restart the Ewon.
3. Allow the Ewon to reconnect to Talk2M.
4. Disconnect and reconnect eCatcher before testing.

Parameter purpose

KillLAN = 1

Disables the Ewon LAN interface.

Because of this setting, devices must not be connected through the Ewon LAN ports.

WANItfProt = 2

Controls protection and access behavior on the Ewon WAN interface.

FwrdToWAN = 1

Enables the required forwarding behavior toward the WAN-side network.

NATItf = 2

Enables the required NAT behavior for remote access.

5. Connect the switch

Connect a small unmanaged or industrial Ethernet switch to the protected side of the Defender Compact.

Connect both of the following devices to the switch:

Ewon WAN port

PLC Ethernet port

Do not connect the PLC to the Ewon LAN port.

Do not connect the Ewon LAN port back to the same switch.

The final physical arrangement should be:

6. Configure the PLC

Configure the PLC with:

PLC IP address:   15.15.15.15

Subnet mask:      255.255.255.0

7. Configure the Anybus Defender Compact

The Defender must allow the Ewon to:

• Reach the internet.
• Establish its Talk2M VPN connection.
• Communicate with the PLC on the protected network.
• Communicate with the network gateway.

The following communication must work locally:

Ewon WAN 15.15.15.2 → PLC 15.15.15.15

Ewon WAN 15.15.15.2 → Gateway 15.15.15.1

Ewon WAN 15.15.15.2 → Talk2M services

Go to Settings -> NAT and activate LAN to WAN

Go to Settings -> Packet filter -> Rules -> LAN > WAN

And make two rules:

HTTPS

Source: 15.15.15.2

Destination: Any

Protocol: TCP

Destination port: 443

Action: Allow

VPN

Source: 15.15.15.2

Destination: Any

Protocol: UDP

Destination port: 1194

Action: Allow

ICMP may also be allowed temporarily for troubleshooting.

8. Connect using eCatcher

On the host PC:

1. Start eCatcher.
2. Sign in to the Talk2M account.
3. Select the Ewon.
4. Connect to the Ewon VPN.
5. Wait until eCatcher shows that the connection is active.

Test the Ewon WAN address:

ping 15.15.15.2

Then test the PLC:

ping 15.15.15.15

Do not use 15.15.15.3 as a test. It is the disabled dummy LAN address and is not expected to reply.

9. Connect a virtual machine through the host PC

If eCatcher runs on the host but the PLC software runs inside a virtual machine, use a host-only network between the host and VM.

Example VM network:

Host VMnet address:                192.168.137.1

VM address:                                   192.168.137.10

Subnet mask:                               255.255.255.0

Enable Windows connection sharing from the Talk2M adapter to the VMware host-only adapter.

Inside the VM, add a route for the PLC network:

route -p add 15.15.15.0 mask 255.255.255.0 192.168.137.1 metric 5

Verify the route:

route print

Test communication:

ping 192.168.137.1

ping 15.15.15.2

ping 15.15.15.15

The route to 15.15.15.0/24 should use the host-only address as the gateway.

10. Test Siemens communication

From the host or VM, test Siemens S7 communication using TCP port 102:

telnet 15.15.15.15 102

A blank Telnet window normally indicates that the TCP connection was accepted.

A connection error indicates that:

• The PLC is not reachable.
• TCP port 102 is blocked.
• The PLC is not listening.
• The Defender is blocking the traffic.
• Talk2M permissions are blocking access.

In TIA Portal, connect directly to:

15.15.15.15

Do not depend on PROFINET Accessible Devices discovery through Talk2M.

PROFINET DCP discovery is Layer 2 traffic and normally does not pass through a routed Talk2M VPN connection.

11. Troubleshooting

Reply from 15.15.15.2: Destination host unreachable

When pinging 15.15.15.3, this is expected because the Ewon LAN interface is disabled by KillLAN=1.

Do not test the dummy LAN address.

Test instead:

ping 15.15.15.2

ping 15.15.15.15

Ewon responds, but PLC does not

Check:

• PLC Ethernet cable.
• PLC link LEDs.
• PLC IP address.
• PLC subnet mask.
• Switch port.
• Defender rules.
• Duplicate IP addresses.
• Whether the PLC is still connected to the disabled Ewon LAN port.

The PLC must be connected to the switch on the Ewon WAN side.

Host can reach PLC, but VM cannot

Check the VM route:

route print

Recreate it if necessary:

route delete 15.15.15.0

route -p add 15.15.15.0 mask 255.255.255.0 192.168.137.1 metric 5

Also verify that Windows Internet Connection Sharing is still enabled on the Talk2M adapter.

Ping works, but TIA Portal does not connect

Test:

telnet 15.15.15.15 102

If port 102 fails, check the Defender firewall and PLC communication settings.

If port 102 works, configure TIA Portal to connect directly to the PLC IP address.

Discovery does not work

This is expected.

Talk2M provides routed IP communication. Siemens PROFINET discovery uses Layer 2 DCP traffic and normally cannot cross the VPN.

Use the PLC IP address directly.

© HMS Networks AB 2026