FireSight OT · PLC remote access
Secure PLC remote access, without opening the plant
FireSight OT gives engineers secure PLC remote access from their own laptop, with the tools they already use. A small Cloud Connector at the site dials out to your Cloud Hub, and each engineer reaches only the PLCs, HMIs and engineering PCs they have been granted. Nothing at the plant accepts a connection from outside.
How it works
PLC remote access through one outbound connection
The Cloud Connector sits on the machine network. It makes an encrypted, outbound-only connection to the Hub, so the plant firewall needs no inbound rule and no public address. When an engineer opens a PLC, the Hub checks the grant and the Connector makes the connection on the plant side.
- No inbound ports at the plant. Only the Hub, which you run on your own server or a cloud VM, is reachable from the internet.
- Mutual TLS with a certificate per Cloud Connector, TLS 1.3 by default.
- No changes on the PLC. The PLC sees connections from the Cloud Connector's own address, so no routes or gateways change.
- Same addresses at every site? Each site's network is mapped 1:1 to its own range on the Hub. See remote access with duplicate IP addresses.
Engineering software
Remote access to Siemens, Rockwell and Modbus PLCs
The FireSight OT client runs on Windows, macOS and Linux. It opens a local port on the engineer's laptop that leads to one PLC port at the site. You point your engineering software at that local port, as if the PLC were on your desk.
| Protocol | Port | Typical tools |
|---|---|---|
| Siemens S7 (ISO-on-TCP) | TCP 102 | TIA Portal, STEP 7 and S7 diagnostic tools for S7-1200 and S7-1500 PLCs. |
| EtherNet/IP and CIP | TCP 44818 | Rockwell Studio 5000 and other EtherNet/IP tools for ControlLogix and CompactLogix PLCs. |
| Modbus TCP | TCP 502 | Modbus pollers, test tools and PLC software that speaks Modbus. |
| OPC UA | TCP 4840 | OPC UA clients, browsers and data tools. |
| MQTT and others | TCP 1883, or any TCP port | Any tool that talks TCP to a known port. |
Pick a machine, get a port
Sign in once, with single sign-on if your company uses it. Pick a PLC from a terminal view or a point-and-click window, and the client shows the local address to use.
Always the right version
Engineers download the client from your own Hub, so it always matches the Hub's version. The Mac client is signed and notarised by Apple.
When a tool needs a whole network
Some engineering work needs more than one address and port. An optional WireGuard VPN reaches a whole machine network, still limited to the networks granted to that person.
Nothing to install
Web HMIs and engineering PCs in the browser
Not every visit to a PLC needs a programming tool. Often an operator or a service engineer just needs the HMI, or the engineering PC that already has the project on it.
- Web HMIs and machine web pages open in the browser through the Hub, including sign-in pages, cookies and live HMIs that use WebSockets.
- New in 0.3.0: remote desktop in the browser. RDP and VNC to Windows engineering stations and HMI panels, with clipboard and Ctrl+Alt+Del. No client needed.
- New in 0.3.0: a terminal in the browser for SSH and Telnet to gateways and Linux devices on the line.
- With the client, Remote Desktop and VNC viewers open by themselves.
Control
Secure PLC remote access means per-machine access
A site VPN usually lands people on a whole network. FireSight OT starts from nothing: no one sees a PLC until it's granted to them.
Per PLC, per port
Grant one PLC port, one HMI, or everything on a Cloud Connector, to a person, a division such as a plant or a maintenance team, or an outside vendor.
Hours and end dates
Machine builders and integrators get vendor accounts with two-factor sign-in, access hours and an end date. Their sessions close when time is up.
The plant has the last word
An allowlist set on the Cloud Connector at the site caps which machines the Hub may ever reach. The Hub can't widen it.
Every session logged
Who opened which PLC, from where, when, for how long and how much data, in the Hub's audit log.
Two-factor and single sign-on
TOTP two-factor for everyone if you choose. Single sign-on with Microsoft Entra ID, Google Workspace, Okta, OpenID Connect, ADFS or SAML 2.0.
For SCADA and historians
A static port forward gives a SCADA or historian server a fixed Hub port to one PLC, limited to allowed addresses or, new in 0.3.0, to VPN users only.
Getting started
One Cloud Connector per machine network
Create the Cloud Connector in the Hub, copy the ready-made firesight.txt onto its card, cable it to the machine network and the uplink, and power it up. Then publish the PLC ports and HMIs and grant them.
Licensing is per Cloud Connector, not per engineer or per PLC. Start with a 30-day evaluation for up to three Cloud Connectors.
Comparing options? Read eleven questions to ask any OT remote access product, or talk to us about a pilot.
FAQ
Questions people ask
Can I use TIA Portal or Studio 5000 remotely with FireSight OT?
Yes. The FireSight OT client opens a local port on your laptop that leads to the PLC's port at the site, such as TCP 102 for Siemens S7 or TCP 44818 for EtherNet/IP. You point your engineering software at that local port.
Does PLC remote access need inbound firewall ports at the plant?
No. The Cloud Connector only makes outbound connections to your Cloud Hub, so the plant firewall needs no inbound rule and no public address.
Do I need to change settings on the PLC?
No. The PLC sees connections coming from the Cloud Connector's own address, so no routes or gateways change on PLCs or HMIs.
Is it a VPN?
Not by default. People are brokered to single machines and ports they have been granted. An optional WireGuard VPN is available for tools that need a whole network, still limited to the networks granted to each person.
Can I open an HMI without installing anything?
Yes. Web HMIs open in the browser through the Hub, and since 0.3.0 RDP and VNC to engineering PCs and HMI panels open in the browser too.
See it on a test line
Tell us about your sites and who needs to reach them. We'll show you FireSight OT in a live demo Hub, with real machines behind a Cloud Connector.
