Dear,

I'm configuring a SCALANCE M876-4 as an OpenVPN client to remotely access devices in VLAN1 (192.168.100.1/24). The SCALANCE is equipped with a SIM card and connects to the internet via mobile data. To make the SCALANCE reachable, I've set up dynamic DNS using No-IP. The VPN tunnel establishes successfully, and the SCALANCE receives an IP address in the 10.8.0.0/24 range (e.g., 10.8.0.6).

My goal is to access the Web Based Management (WBM) interface of the SCALANCE and other devices in VLAN1, such as the PLC (S7-1510; IP: 192.168.100.10/24; Gateway: 192.168.100.1) and HMI (is a Unified Panel, IP: 192.168.100.11/24; Gateway: 192.168.100.1) connected to port 1 of VLAN1, through the VPN tunnel. However, despite a successful VPN connection, the WBM interface is inaccessible via the tunnel, and I cannot connect to the PLC and HMI.

I have experimented with adding topology subnet, but this resulted in completely losing access to the WBM interface.

Has anyone experienced configuring a SCALANCE M876-4 as an OpenVPN client to achieve full access to VLAN1 and the connected devices via the VPN tunnel? Any suggestions or examples of working configurations would be greatly appreciated.

For more context and visual support, I've attached a Word document containing relevant screenshots of the current configuration and network status.

Kind regards,

Frederik

I have not used the openVPN client functionality, but it should be similar enough to sinemaRC.

Once the tunnel is established, can you log in to the WBM via the scalance vpn address (10.8.0.6 in your example)? if not the tunnel is not working.

Why are you using ddns? an openvpn client does not need a static address, hell not even a public one.

in windows try route print in command prompt and verify that you have the proper routes set up. Windows really likes to mess up the routing if you define a network adapter with a class 10.0.0.0 network with a /24 SN mask.

Your firewall configuration is just plain wrong, your router will not last a week online if you leave everything like this on the internet.

I suggest a factory reset, then via the wizard set up mobile network, system time, and LAN. nothing else.
At this point add your openVPN connection, and enable auto firewall and NAT.

If your openVPN server is properly set up, on connection,  it will create a route to 192.168.100.0/24 via your openVPN TAP adapter.

try a tracert to your PLC from your PC and take a look what interface the traffic is going out.

these are all guesses, I have not tried any of this. Here are my suggestions based on experience:

If you want to use your scalance as a ovpn client, consider a sinemarc server, they are very easy to set up and frankly extremely price competitive (NO SUBSCRIPTION), specially if you have multiple remote networks. It takes me less than 2 minutes from opening a scalance box to reaching it via the internet. with the latest firmware you can even avoid paying a sinemarc plug for each device and use a floating license that you enable only on the device you want to connect to.

If you want simple remote point-to-point connection I have had success with IP-sec, since you already have a ddns service you do not need any more resources. ip sec is natively supported by windows.

Thanks for the reply, I’m going to give it a try. I’ll let you know whether it worked or not.