Skip to content

LAN Reach

LAN Reach lets an operator connect an engineering tool on their own computer to a specific device on the Edge's local network, such as a PLC or an HMI web interface. Only devices you whitelist are reachable.

Requirements

  1. A whitelist. The Edge's configuration has at least one lan_reach.whitelist entry. Without one, the Edge does not offer LAN Reach.
  2. A grant with remote access. The operator has an active grant on the Edge with Remote access selected. See Grant access to an Edge.

The Edge's licence must be valid and the App's access must not have ended.

Whitelist entries

Each entry names one device and one TCP port. All four fields are required.

Field Rule
id Unique key in the list. Lowercase letters, digits and hyphens, starting with a letter or digit, up to 63 characters. The operator does not see it.
ip The device's IPv4 address on the Edge's LAN.
port TCP port, 1 to 65535.
label The name the operator sees, 1 to 128 characters. 
{
  "lan_reach": {
    "whitelist": [
      {
        "id": "hmi-web",
        "ip": "192.0.2.50",
        "port": 443,
        "label": "HMI web UI"
      }
    ]
  }
}

Set up the whitelist

Set the whitelist on a template to apply it to every Edge that uses the template, or on a single Edge.

  1. Open Templates and open the template.
  2. Select the LAN Reach tab.
  3. Select Add reach entry and fill in id, ip, port and label. Add one row per device and port.
  4. Select Publish.
  1. Go to Edges, open the Edge and select the Config tab.
  2. In Overrides JSON, add the lan_reach object from the example.
  3. Select Save layer.
  4. Optionally select Preview render to check the effective document.

Once the Edge applies the new configuration and shows In sync, the new targets reach the operator's App. For templates, layers and rollouts, see Templates, Edge configuration and the Edge config document.

Whitelist only what operators need

Every entry is reachable by any operator with a remote access grant on that Edge. Use specific addresses and ports, and remove entries you no longer need.

Connect with LAN Reach

  1. Open the chat with the Edge and select Remote Access.
  2. Choose LAN Reach (TCP Forward).
  3. In LAN Reach — Choose Target, select the device.
  4. Check Local port. It defaults to the target's port. Change it if that port is in use on your computer.
  5. Select Connect.
  6. When the tunnel is active, point your tool at 127.0.0.1:{port}.
  1. Open the chat with the Edge and tap the Remote access icon.
  2. Tap LAN Reach, then tap the target device.
  3. When the App shows "LAN Reach active", point your tool at 127.0.0.1:{port}. The local port equals the target's port.
  1. Open the chat with the Edge and tap Remote Access.
  2. Tap LAN Reach. Targets appear as {label} ({ip}:{port}).
  3. Tap the target device.
  4. When the App shows "LAN Reach Active", point your tool at 127.0.0.1:{port}. The local port equals the target's port.

Close the session the same way as other tunnels. See Open a tunnel.

Session limits

  • One LAN Reach session per target at a time. If another operator is connected to the same target, your session is refused.
  • A session ends if your tool does not connect within 5 minutes, and after 30 minutes in total. Open a new session to continue.

If LAN Reach is missing or fails

What you see What to do
No LAN Reach option Check that the whitelist has entries, the Edge shows In sync, and the grant shows · remote.
"No LAN Reach targets provisioned…" (desktop) or "This edge has not advertised any LAN Reach targets." (iOS) Add whitelist entries and publish.
The tunnel times out See If a tunnel does not open. Another session may hold the target.
The tool connects but gets no answer Check that the device is on and that ip and port are correct.