VNC Viewer over NATR

[PLC Pie Guy]

Good morning Folks.
I've been trying to get this to work but something isn't adding up.

I have a basic system that consists of a private machine network with an IP set in the range of 192.168.1.xxx.

I'm using a 1783-NATR to connect to the plant network on 172.16.5.xxx.

It all works perfectly communications wise.

I'm trying to leave the HMI on the 192-machine network and use a NAT rule so we can see it from the LAN to use the VNC viewer. Simply to avoid adding a second Ethernet switch in the cabinet for the Plant LAN.

HMI is a Weintek eMT3105P. It will talk to my PLC from either side of the NATR successfully as desired. I can also PING the HMI while it's connected to either side of the NATR while my PC is on the plant network as expected.

It will NOT connect to the VNC viewer on my PC while going through the NAT module.

Any initial thoughts on why the VNC viewer will not work over NATR while all other communications work as expected?

I know the VNC is running on the HMI as I can connect to it from the machine network.

 

[Ken Roach]

To my knowledge, the 1:1 NAT on those devices doesn't have any TCP Port or protocol specific filters, so RSLinx or IGMP PING or VNC should all work the same.

Although "NAT is not routing" is a truism, I saw a note in the 1783-NATR user manual (page 46) that suggests that the Default Gateway for the devices on the Private side is important:

The gateway address for any device on the private (machine) network that is translated must be set to the 1783-NATR Private port address.

This week I am trying to figure out a NAT system set up by others about five years ago, using Stratix 5700. The NAT rule configuration on those is a little trickier.

 

[PLC Pie Guy]

To my knowledge, the 1:1 NAT on those devices doesn't have any TCP Port or protocol specific filters, so RSLinx or IGMP PING or VNC should all work the same.

Although "NAT is not routing" is a truism, I saw a note in the 1783-NATR user manual (page 46) that suggests that the Default Gateway for the devices on the Private side is important:

The default gateway on the Private Side Devices are all set to match the Private Network IP address of the NATR module. The Ping works perfectly. The PLC will talk to the HMI. However, on top of VNC not working, I cannot download to the HMI either over the NATR from Plant LAN to the Private Network. The software will simply not connect and advise me to check IP address and connections.

I ended up moving the HMI to the Plant LAN for the moment to continue without issues but I'm not completely understanding why this is happening like this. I would expect it to work or not work, not give me partial functionality.

I also learned that if there is a rule configured on the NATR to look at a Plant LAN IP address, and you put a device with that address on the Plant LAN, the NATR will show an IP conflict even though the device isn't physically connected on the private network. Interesting...

 

[KuulKuum]

It has been years since I have messed with a 1783-NATR, but:

Have you tried setting a custom rule to pass Port 5900 - VNC within the web interface NAT configuration?

 

[MikeyN]

I ran into similar issues with a new machine that hit our floor. I didn't have any trouble accessing AB equipment through the NATR. The trouble was with the Cognex cameras, the MyCloud NAS, and a few other devices we wanted to translate. I was able to ping everything, but was not able to connect to any of them.

I finally noticed that my web interface looked slightly different than in the manual. When I select a rule, I have the option to create a custom rule (up to 5) for each connection. Using this function I was able to open up the required TCP and UDP ports I needed to connect to most of our devices. Unfortunately the Cognex Cameras require more than 5 ports, so I still cannot do everything I need with them, but at least I can access the web page for them now. The images I attached were taken from the Network Address Translation tab in the Device Manager Web-Interface. I am sure this is revision specific, so I am running Product Revision 1.005 Build 50.

IIRC I used WireShark to see which ports were being used when trying to perform different operations; go online, upload/download, web interface, etc. Some of the ports were common sense like port 80 for web interface, but others were not documented.