A machine’s web screen#

The press on line 3 has a PLC with a built-in web page: status, counters, alarm history. It sits on an isolated machine network that IT will never route to the office, let alone the internet. We put a Raspberry Pi in the control cabinet with one leg on the machine network and one on a 4G router, and get that web page in a browser anywhere, without touching the plant firewall.

What you need#

• A Raspberry Pi (a DIN-rail case is worth it) on 64-bit Raspberry Pi OS.
• A way for the Pi to reach the internet that isn't the machine network: a small 4G router, or the office Wi-Fi.
• An Ethernet cable from the Pi into the machine network's switch.
• A Tollan account on Starter or above: reaching another host on the device's network is forwarding, a paid feature.

How it works#

  laptop ──HTTPS──▶ press-3 address
                           ▲
                           │ the Pi connects out over 4G
  Raspberry Pi ────────────┘
    tollan-agent ──eth0──▶ PLC web screen, 192.168.0.10:80

The Pi dials out over the 4G link and holds the connection open. When you open the address, the agent on the Pi fetches the PLC's web page from the machine network for you. The Pi doesn't route between its two networks (Linux has IP forwarding off by default), and the agent only ever connects to the targets you set as routes in the console. Nothing else on the machine network is reachable.

Step 1: Two networks, one Pi#

Connect wlan0 (or a USB 4G dongle) to the internet and eth0 to the machine switch. Give eth0 a static address in the machine network's range, without a gateway, so the internet route stays on the 4G side:

sudo nmcli con mod "Wired connection 1" ipv4.method manual \
  ipv4.addresses 192.168.0.200/24 ipv4.gateway "" ipv4.never-default yes
sudo nmcli con up "Wired connection 1"

Pick a free address: ask whoever owns the machine network, don't guess. Then check that the Pi sees the PLC and still has the internet:

curl -s -o /dev/null -w '%{http_code}\n' http://192.168.0.10/     # 200 from the PLC
curl -s -o /dev/null -w '%{http_code}\n' https://tollan.ie/        # 200 over 4G

Step 2: Install the agent#

Add a device in the console named line3-gw, architecture linux/arm64, and install its bundle on the Pi. The Quickstart covers it; it's a tar -xf and sudo ./install.sh.

Step 3: Route to the PLC#

On the device page, click Add route:

Device name names the address after the machine rather than the Pi, so one gateway can front several machines without the addresses getting mixed up. The dialog previews the address. Save it.

A new route can take a few seconds to reach the gateway. If the very first request fails, reload.

Step 4: Open it#

Open the address in a browser. You're looking at the PLC's own web page, served from the machine network.

If the PLC only serves HTTPS, use a port route to 192.168.0.10:443 instead of sni. Open https://<host>:<port> with the host and port the console shows, and accept the PLC's own (usually self-signed) certificate.

Step 5: Lock it down#

Do this before you share the address with anyone:

1. On the route, click Security, add a Basic auth rule, and give each person their own username and password.
2. Add an IP allowlist rule with the office's public address, so the page isn't even reachable from anywhere else.

Password-protect a site walks through both. On a port route only the IP allowlist applies, so lean on the PLC's own login there.

Gotchas#

• Lost the PLC after setting the address? Check you didn't give eth0 a gateway. If you did, the Pi tries to reach the internet through the machine network and the agent goes offline.
• Page loads, buttons don't. Some HMI pages pull scripts or images from another address on the machine network. Add a route for each address the page uses, or open the HMI vendor's "remote" view if it has one.
• ESP32 instead of a Pi? An ESP32 on the machine network can do the same job for a single web page, with no SD card to wear out. See ESP32 forwarding.

Where to take it next#

• One gateway, many machines: add a route per PLC or HMI, each with its own Device name.
• Keep an eye on the gateway: the Stability tab on its device page shows every disconnect and outage of the last 72 hours.