IoT Guide

Remote Access to Beckhoff TwinCAT PLC via 4G VPN

Remotely access your Beckhoff CX, EK, and BK controllers via TwinCAT 3, the ADS/AMS protocol, and OPC UA. Industrial 4G VPN Router: A Complete Guide.

Quick answer
L’Remote access to a Beckhoff PLC (CX, EK, BK) uses a proprietary protocol ADS/AMS on TCP port 48898 for TwinCAT 3, or OPC UA for SCADA integration. Via a 4G VPN tunnel, TwinCAT 3 Remote Manager connects remotely to the Beckhoff runtime, enabling programming, diagnostics, and monitoring without having to travel.

Beckhoff TwinCAT: A PC-Based PLC for Remote Access​

Beckhoff stands out from traditional PLC manufacturers thanks to its PC-based architecture: CX controllers and industrial PCs run TwinCAT Runtime on Windows IoT or Windows 10/11. This approach offers significant advantages for remote access:

  • Windows Network Connectivity: Remote Desktop, file sharing, web access—all Windows tools are available
  • TwinCAT 3 Remote Manager: a dedicated tool for managing remote connections
  • Native OPC UA: built-in OPC UA server; no third-party middleware required
  • Python, .NET, C++: the Windows development ecosystem enables sophisticated IoT integrations

ADS/AMS Protocol: How It Works​

The ADS (Automation Device Specification) protocol is TwinCAT’s proprietary communication layer. Here are its key concepts:

AMS Net ID: Each TwinCAT device is identified by an AMS Net ID in the format a.b.c.d.e.f (6 bytes). By convention, it is often derived from the IP address: an IP address of 192.168.1.10 results in an AMS Net ID of 192.168.1.10.1.1.

ADS Ports: Within a device, each TwinCAT runtime or service is accessible via an ADS port number (851 for PLC Task 1, 852 for PLC Task 2, etc.).

ADS Route: For a TwinCAT client to communicate with a remote runtime, you must create an ADS route—an entry in the routing table that associates an AMS Net ID with a network IP address.

For remote access via VPN, the ADS route points to the PLC’s IP address within the VPN network.

Beckhoff Product Line Compatible with Remote Access​

ProductDescriptionTwinCATEthernet
CX9020Compact DIN-rail embedded PC, ARMTC2/TC32 × Ethernet
CX5100Intel Atom embedded PCTC2/TC32 × Ethernet
CX5200Intel Core i embedded PCTC32 × Ethernet
CX8090Embedded PC with EtherCAT switchTC32 × Ethernet
C6015Ultra-compact industrial PCTC32 × Ethernet
EK9000EtherCAT/Modbus TCP coupler—1 × Ethernet

Beckhoff industrial CX and PC devices are the typical targets for remote access via TwinCAT. The EK/BK devices are field couplers, not targets for direct programming.

Configuring TwinCAT 3 Remote Access​

Step 1: Prepare the Network Environment Make sure the VPN is active and that you can ping the IP address of the remote CX.

Step 2: Add an ADS Route In TwinCAT XAE (Visual Studio), go to the System tab and select "Routes." Click "Add Remote Route" and enter the following:

  • Remote Name: descriptive name (e.g., Site_Lyon_CX5200)
  • AMS Net ID: the CX’s AMS Net ID (found in the TwinCAT Control Panel)
  • Transport: TCP/IP
  • Address: the CX’s IP address within the VPN tunnel

Step 3: Enable the route on the remote CX On the remote CX (accessible via Remote Desktop or by asking a local technician), add the reverse route from the CX to the engineer’s workstation.

Step 4: Connect Online In TwinCAT XAE, open the configuration (F4) and connect online. The project synchronizes with the remote runtime.

Beckhoff OPC UA for SCADA Monitoring​

The TC3 OPC UA (TwinCAT 3 OPC UA) server automatically exposes variables marked as OPC UA in the PLC program. Configuration:

  1. Install the TC3 OPC UA package from the TwinCAT Package Manager
  2. Configure the listening port (4840 by default) and the security settings
  3. Tag the PLC variables with the {attribute 'OPC.UA.DA' := '1'} attribute
  4. From the SCADA client, connect to opc.tcp://[IP_CX]:4840

When using a VPN, the OPC UA URL uses the CX’s IP address within the tunnel.

Security for Beckhoff Systems via Remote Access​

Beckhoff CX systems run on Windows—Windows best practices apply in addition to OT best practices:

  • Remote Desktop: If enabled, use only via a VPN tunnel. Change the RDP port (3389) to a non-standard port if it is exposed.
  • Windows Firewall: Create restrictive rules for the ADS (48898) and OPC UA (4840) ports—access allowed only from IP addresses within the VPN tunnel.
  • Antivirus: Beckhoff recommends industry-specific solutions (Trend Micro, Windows Defender with TwinCAT exclusions).
  • Updates: Windows IoT LTSC receives security updates—schedule them during machine downtime.

Frequently Asked Questions

You might also like