0

Summary

I've got a PLC that has a static IP I can't change and a gateway that can't be set. I need to be able to talk to the PLC over TCP on my corp network. Seems like a good candidate for NAT...

Scenario

I've added a TC-Link ER605 router in front of the PLC with a network matching the network for the PLC (192.168.1.1/24) and I've got the WAN configured to a subnet on my network (10.15.70.19/24). I've created a NAT rule (virtual Server) shown below.

enter image description here

When I try to connect to the PLC from the WAN side (10.15.70.19:502), it times out.

When I'm plugged into the LAN side I can open a connection to 192.168.1.88:502 no problem.

Potential Problem

I think the problem is that the packets can get to the PLC, but the PLC doesn't have a gateway and doesn't know where to send the packets back. I've confirmed this by substituting a laptop for the PLC and running Wireshark. I'm not sure what else to try here.

Any help or insight into my assumptions would be appreciated.

Improve this question

2 Answers 2

Reset to default
1

I misunderstood this originally, but the problem here is that a virtual server is for DNAT and it seems like what you actually need is SNAT.

With the setup you have now, lets say your machine is 10.15.70.100.

When the traffic from your machine hits the router at 10.15.70.19:502, what happens is the router sees a packet going from

10.15.70.100 --> 10.15.70.19:502

changes that to

10.15.70.100 --> 192.168.1.88:502

and sends it on its merry way.

When the PLC receives that, it is going to be trying to respond to 10.15.70.100, but because it doesn't have a default gateway it can't do that.

If this PLC is connected to the same network as your PC normally, then as @joeqwerty said you could just use a secondary IP address in 192.168.1.0/24 and everything would be fine.

If you want to do it this way with the router and NAT, then all you'd have to do is reverse the router ports, and add a route on your PC to use the router to get to the PLC.

Make it so that the LAN port is on the 10.15.70.0/24 network, and the WAN port is on 192.168.1.0/24, and create a route on your machine saying 192.168.1.0/24 via 10.15.70.<router interface>

With the other settings on the router at pretty much default, what will happen in this case is the router will see:

10.15.70.100 --> 192.168.1.88

change that to

192.168.1.<router address> --> 192.168.1.88

and send it along.

Then when the PLC wants to respond, it can respond to the router at 192.168.1.x which it will be fully capable of doing.

Improve this answer
4
  • Oh man, this is a great idea. Trying it now, I'll report back. Thanks!
    – MikeSchem
    Nov 9, 2022 at 21:34
  • Well this was some great out of the boxing thinking and it works!
    – MikeSchem
    Nov 9, 2022 at 22:41
  • It's very counterintuitive for me to have the LAN address of a gateway on the lan of another gateway.
    – MikeSchem
    Nov 9, 2022 at 22:45
  • 1
    Cool, glad you got it sorted.
    – A. Trevelyan
    Nov 10, 2022 at 3:49
1

Add an additional ip address to the Advanced TCP/IP settings of the TCP/IPv4 protocol of the network adapter on your computer for the same network the PLC is using. This requires that your network adapter is configured with a static ip address... if it isn't then temporarily assign a static ip address to your network adapter.

This doesn't require the PLC to have a default gateway.

For instance, if the PLC ip address is 192.168.1.1/24 then assign 192.168.1.2/24 as an additional ip address on your network adapter. This will allow your computer to communicate directly with the PLC. This will not interrupt network communication on your "primary" network.

Improve this answer
1
  • Thanks for the idea, unfortunately I actually do need to do this over a router not directly plugged into it.
    – MikeSchem
    Nov 9, 2022 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .