Connect to a WinCC Unified Web Server over the internet using DDNS

Hello joe.smith_alias,

please have a look at this:
https://support.industry.siemens.com/tf//ww/en/posts/swaclogin-error-during-componet-s-creation/225869?page=0&pageSize=10

Regards,

Nzett11

Hi Nzett11,

Thanks for the response. I have seen that post before and have tried both of the suggestions as follows:

1) Deleting the web server and recreating with own certificate (Youtube video): No change. Same Swaclogin error.

2) Try to enter "textual" url in browser, not ip-address: This is not applicable. If I use the IP address on the local LAN then it works fine. I cannot use the "textual url" when connecting over the internet using DDNS. I have to use the DDNS address to connect via the router WAN address, and then the router forwards the 8443 and 443 port to the web server IP address.

3) port 8443 may be blocked: I have disabled the firewall on the web server computer and ensured that the router forwards port 8443. No change.Same Swaclogin error.

Thanks

joe.smith_alias

I have WinCC Unified Runtime Web Server running on Windows 10 Professional x64 (OS Build 19041.450) on the local LAN side of a router connected to the internet. I want to be able to connect to the website over the internet, using DDNS, from my phone or tablet using an HTML5 browser like Chrome.

1) I can browse to the website from any computer or tablet on the local LAN, login with the admin user account and view the live data from an S7-1200 PLC. No problem at all.

2) I have created a DDNS account so that the Router WAN IP Address is always accessible via the same DDNS name and have configured the router to forward ports 443 and 8443 to the WinCC Unified Web Server IP Address on the LAN.

3) I have loaded version 2 update of WinCC Unified and TIA Portal v16 and have selected the WinCC web server IP address with the check box within the "User Administration" section of the WinCC Unified Configuration.

4) I have re-created the self assigned certificate from the beginning using different admin user credentials and have exported the certificate to my android tablet and another laptop with Windows 10 on the internet.

5) From my Android tablet or Windows 10 laptop I can connect to the https://DDNS web address and am forwarded to the Win CC Web Server and the home page is displayed.

6) When I click on the "WinCC Unified RT - Start Your Project" button the error message is "SwacLogin: Error during componet/s creation"

What could the problem be and how do I resolve it? I have tried clicking the "User Management - Manage Your Users" button first but it shows the message "Redirect to login page..." and does not open the login window.

 I haven't managed to solve this one yet. Is anyone able to help me with this one? How do I escalate the query? I am able to recreate the problem every time and should be possible for someone to do the same. I would really appreciate any assistance. Thanks

Hi Matt,

I am starting to think that the capability is somehow not allowed in the runtime software to ensure that there will be a market for WinCC Unified Cloud. Not sure when that will be coming out. I've tried everything I can think of, and scoured the internet but no luck...

Hi Joe,

I have tried everything I can think of. Manually installed certs via IIS, Change the URL rewrites from Localhost to my server domain, etc, and no luck with anything. I have started a service request about this issue, If I figure it out I will let you know. Where did you hear about this cloud platform? All I need is web access so the customer can control his irrigation pumps around the farms from his phone/pc so nothing too major. 

I have same problem and still no answer. The only answer i got was to use VPN... but then there is no point in winCC Unified at all.

I made my runtime accessible from internet with next setup:

I have static IP.

My internal and external network on the router are set to be the same (161.53.170.xxx)

My certificate is made for same address as my static IP and same name as my server.

My LAN address of server is same as my static IP.

This is the only way i managed to access from internet, otherwise i get SWAC loggin.

So this is not secure at all but it works.

Siemens made certificates in a way that both device name and IP address must be matched in order to access runtime. First problem here is that each router have internal and external network on different IP range for protection... so how do i make my certificate? If i put external address i can access server but cant log in cuz of SWAC... if i made it to internal IP i cant access server at all (ofc i cant, i cant see local address from internet).  

I also tried with DynDns and as soon as IP changes = SWAC loggin. The moment i reconnect it to old IP, it works. I tried without IP... SWAC loggin.

I'm trying to get in contact with development team to see what is the future of this solution. I really want to use it but not in this form.

So the logical answer would be "Use VPN"... but i don't want to. If i am going to use VPN again there is no need to switch from winCC professional to unified at all. I have same thing and "Complicated" connectivity from user stand point. User just wants to; well, LOG IN... while developers want no 3rd party solutions in order for user to log in.

Anyone found any other solution?

I can setup un-secure access using an IP address with no problem using the static IP of my server and access the runtime also as a test but definitely not going to do this for a production environment. 

I have contacted siemens about this and they just kept referring me to articles about swac-login etc did not provide much help and then gave me the option for paid support. 

I have tried renaming my CN on the cert to the same as the Siemens certs but this did not work. At this stage, there is no way to use secure SSL and DNS to access the runtime part of the web server over the internet. If someone was experienced enough on the web development side I'm sure they could find a workaround or remove the swac-login requirements in the webserver scripts ( there is a lot of scripts by siemens in the webserver folders ) 

Other platforms are easy to set up secure access to the webserver HMI/SCADA, I have done this with Rapid SCADA, Indusoft, and Ignition perspective no problem, but really struggling with WinCC Unified. 

UPDATE: I now have this working across the internet using SSL from let's encrypt and DNS from my domain. With update 3 it is now possible under the configuration where you enter the identity provider IP Address you can now also enter DNS. You can now put in the DNS and all redirects to UMC work correctly and no longer get Swaclogin errors. 

Matt-mrea

I can setup un-secure access using an IP address with no problem using the static IP of my server and access the runtime also as a test but definitely not going to do this for a production environment. 

I have contacted siemens about this and they just kept referring me to articles about swac-login etc did not provide much help and then gave me the option for paid support. 

I have tried renaming my CN on the cert to the same as the Siemens certs but this did not work. At this stage, there is no way to use secure SSL and DNS to access the runtime part of the web server over the internet. If someone was experienced enough on the web development side I'm sure they could find a workaround or remove the swac-login requirements in the webserver scripts ( there is a lot of scripts by siemens in the webserver folders ) 

Other platforms are easy to set up secure access to the webserver HMI/SCADA, I have done this with Rapid SCADA, Indusoft, and Ignition perspective no problem, but really struggling with WinCC Unified. 

UPDATE: I now have this working across the internet using SSL from let's encrypt and DNS from my domain. With update 3 it is now possible under the configuration where you enter the identity provider IP Address you can now also enter DNS. You can now put in the DNS and all redirects to UMC work correctly and no longer get Swaclogin errors. 

 So you can use Dynamic DNS adress by just enter domain name in identity provider IP Address at server configurator and it works?