IoT Guide

Remote Access to a Siemens S7 PLC via 4G VPN

Connect your Siemens S7-300, S7-400, S7-1200, and S7-1500 PLCs remotely via a 4G VPN router. S7comm protocol, TIA Portal, Step 7: a complete guide.

Quick answer
Remote access to a Siemens S7 PLC is provided via an industrial 4G router with a VPN tunnel that secures S7comm traffic on TCP port 102. Once the VPN is established, TIA Portal or Step 7 connects to the PLC exactly as it would on the local network, allowing for diagnostics, program editing, and monitoring without having to travel to the site.

Remote Access to Siemens S7 PLCs: Fundamentals​

Siemens PLCs in the S7 series—S7-300, S7-400, S7-1200, and S7-1500—are among the most widely deployed in global industry. The ability to access them remotely to diagnose issues, modify settings, or monitor their status is a major operational challenge: every trip avoided saves time and money.

Remote access to a Siemens S7 PLC relies on two complementary components:

  1. Network connectivity: An industrial 4G/LTE router installed on the site’s OT network creates an encrypted VPN tunnel to the operator’s platform or to the engineer’s workstation.
  2. The S7comm protocol: the native Siemens protocol that encapsulates TIA Portal/Step 7 communications with the PLC, which are transmitted transparently through the VPN tunnel.

Compatibility by Siemens PLC Series​

All S7 series are accessible remotely, but with different prerequisites:

SeriesNetwork InterfaceProtocolRequired CP Card
S7-300Native MPI port + CP 343-1S7comm over EthernetYes (CP 343-1 Lean or Advanced)
S7-400Native MPI port + CP 443-1S7comm over EthernetYes (CP 443-1)
S7-1200Integrated EthernetS7comm + Modbus TCP + OPC UANo
S7-1500Integrated EthernetS7comm + OPC UA + Web serverNo
ET 200SP CPUIntegrated EthernetS7comm + OPC UANo

The S7-1200 and S7-1500 are the easiest to connect to remotely: their native Ethernet interface and OPC UA support make them directly accessible via the 4G VPN router.

Architecture of a Secure S7 Remote Access System​

The 4G router acts as a transparent bridge: from within TIA Portal, the engineer sees the PLC as if it were on the same local network. The S7comm protocol passes through the VPN tunnel without any modifications. The S7 PLC receives the connection on its TCP port 102; the 4G VPN router encrypts all traffic to the VPN concentrator; and the engineer connects from TIA Portal via their VPN client.

Configuring TIA Portal for Remote Access​

When configuring S7 remote access, there are several TIA Portal settings to check:

In the CPU properties:

  • Enable Ethernet communication (the "Ethernet Addresses" tab)
  • Set a static IP address (avoid using DHCP in an industrial environment)
  • Configure the CPU protection level (Protection Level) according to your security policy
  • On the S7-1500: enable or disable PUT/GET access as needed

For remote diagnostics:

  • The "Go Online" feature in TIA Portal works via VPN exactly as it does locally
  • The diagnostic buffer can be viewed remotely
  • Watch tables are accessible in real time

S7comm vs. OPC UA: Which Protocol Should You Use for Remote Access?​

The S7-1200 (firmware ≥ 4.0) and S7-1500 support OPC UA in addition to S7comm. For remote access, both approaches have their place:

S7comm is essential for:

  • Programming and modifying programs with TIA Portal
  • Online diagnostics (block status, variable values)
  • Uploading to the device (Download to device)

OPC UA is best suited for:

  • SCADA or MES integration
  • Multi-vendor monitoring
  • Real-time applications using publish/subscribe (OPC UA PubSub)
  • Access from third-party systems (Python, Node-RED, MATLAB)

Security: Best Practices for S7 Remote Access​

Securing remote access to a Siemens PLC requires a multi-layered approach:

  • Never expose directly: TCP port 102 must never be open to the Internet. All access must go through the VPN tunnel.
  • Strong authentication: X.509 certificates or a robust pre-shared key for the VPN, CPU password in TIA Portal.
  • Network Segregation: The S7 PLC is in an isolated OT subnet, with the 4G router providing a controlled connection.
  • Logging: Every VPN connection and every TIA Portal session is time-stamped and logged.
  • S7-1500 CPU Protection: Enable the “Confidentiality” protection level to encrypt the downloaded program.
  • NIS2 Compliance: For operators of critical infrastructure, document remote access procedures and authorizations.

Practical Implementation with an Industrial 4G Router​

The deployment of S7 remote access typically follows these steps:

  1. Installing the 4G router on the OT network (DIN rail, 24 V DC or 12 V DC power supply)
  2. VPN configuration: configuring the IPsec or OpenVPN tunnel on the router side
  3. Assigning a static IP address to the S7 CPU on the OT network
  4. Connectivity test: ping from the engineer’s workstation via VPN
  5. Connecting to TIA Portal: Select the "TCP/IP" PG/PC interface and enter the PLC’s IP address
  6. Authorization verification: Checking the CPU protection level
  7. Documentation: Recording the procedure and access permissions

Frequently Asked Questions

You might also like