ForwPort¶

ForwPort forwards a TCP/UDP port on the gateway's local network out to a remote engineer, so they can point their PLC engineering software (GX Works, TIA Portal, RSLinx, CX-Programmer, etc.) directly at a PLC sitting on the plant network, from off-site.

The forwarding server runs locally on the gateway and is only reachable after joining this gateway's ZeroTier network — never over the open internet. A remote engineer needs both ZeroTier access and the proxy details below to reach a PLC through ForwPort.

The proxies table¶

Each row is one forwarded port: Name, Type (tcp/udp), Local (host:port on the plant network), Remote (the port or domain the engineer connects to), an Enabled checkbox, and a Delete button.

Unchecking Enabled on a row turns that forward off without deleting its configuration. Deleting asks for confirmation first:

Delete proxy '{name}'?

Adding a proxy: presets for common PLC software¶

The Proxy preset dropdown pre-fills Type and a starting Local/Remote port for common PLC engineering software, so you don't have to look up the right port yourself:

A preset keeps Local port and Remote port equal, since PLC proxies typically need the same port on both sides. Picking Custom hands full control back — you can choose Type freely and set Local and Remote ports independently.

To add a proxy:

1. Pick a Proxy preset, or leave it on Custom to fill in Type yourself.
2. Enter a Name for the proxy.
3. Enter the Local host — the PLC's real address on the gateway's network (a preset does not know this; it always defaults to 127.0.0.1 and needs changing to the PLC's actual address).
4. Enter or confirm the Local port. With a preset selected, Remote port mirrors it automatically.
5. Click Add proxy.

Allow non-loopback local host¶

By default, applying the configuration only accepts proxies whose Local host is 127.0.0.1 (the gateway itself) — exposing anything else through the tunnel widens what the remote side can reach, so it's refused unless you opt in. Since a real PLC is never at 127.0.0.1, check Allow non-loopback local host before applying whenever you have a proxy pointed at a PLC's real address on the plant network, as in the steps above.

Applying the configuration¶

Adding, editing, or deleting a proxy does not take effect on its own — click Apply configuration to push the current proxy list live. Cockpit confirms with the number of active proxies once applied.