{"id":1256,"date":"2022-12-07T12:08:58","date_gmt":"2022-12-07T10:08:58","guid":{"rendered":"https:\/\/www.rocworks.at\/wordpress\/?p=1256"},"modified":"2022-12-07T12:15:09","modified_gmt":"2022-12-07T10:15:09","slug":"wincc-unified-v18-exposed-to-the-internet","status":"publish","type":"post","link":"https:\/\/www.rocworks.at\/wordpress\/?p=1256","title":{"rendered":"WinCC Unified V18 exposed to the Internet…"},"content":{"rendered":"\n

This article will show how WinCC Unified<\/strong> can be accessed through a public available server in the internet. <\/p>\n\n\n\n

Disclaimer: I only did this for testing and demo purposes!!!<\/strong><\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

First you need to have a public domain name<\/strong> and a public accessible host. Or a host running somewhere in the cloud and you will get a IP and\/or an URL, which will point to your host. In my case I have a public IP address from my internet provider and my public sub domain name points to my server at home.<\/p>\n\n\n\n

My registered public domain name <\/strong>is rocworks.at. Additionally I have used a sub-domain name unified.rocworks.at<\/strong>. Because I have multiple services running on my machine at home. With the subdomain the service can be easily be distinguished. At my internet provider I have configured a DDNS <\/strong>services, so that my subdomain unified.rocworks.at points to my IP at home. You can also use other DDNS services (noip.com) , also if you have a dynamic IP address.<\/p>\n\n\n\n

If you have it running at home, then you have to setup a port forwarding from your modem to your web server IP at home. <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

At the WinCC Unified Runtime Host<\/strong> we have to change some settings in files, to set the right public URL for the identity provider (UMC). After doing this, you should reboot the computer. <\/p>\n\n\n\n

Config.level (C:\\Program Files\\Siemens\\Automation\\WinCCUnified\\config)\n\n\t[IdentityProvider]\n\tUrl = \"https:\/\/unified.rocworks.at\/umc-sso\/\"\n\t\nWeb.config (C:\\Program Files\\Siemens\\Automation\\WinCCUnified\\WebRH)\n\n\t<appSettings>\n\t    <add key=\"appvirtdir\" value=\"\/WebRH\" \/>\n\t    <add key=\"origins\" value=\"https:\/\/unified.rocworks.at\" \/>\n\t  <\/appSettings>\n\nConfig.json (C:\\Program Files\\Siemens\\Automation\\WinCCUnified\\SimaticUA)\n\n        \"dnsname\": \"unified.rocworks.at\"\n\nUmcd.cfg (C:\\Program Files\\Siemens\\LocalUserManagement\\etc)\n\n\tSearch and replace hostnames\n\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Siemens\\User Management\\WebUI\\Settings\n\n        ipaddress = \"https:\/\/unified.rocworks.at\/umc-sso\/\"\n\nNote: instead of \"unified.rocworks.at\" use your public domain name. \n<\/strong>    <\/code><\/pre>\n\n\n\n
At the web server at home I have NGINX <\/a><\/strong>running in a Docker Container together with Let’s Encrypt<\/a><\/strong>. With Let’s Encrypt and Certbot<\/a> we can get valid Certificates for our Webserver. But that’s another story. Here is a docker-compose.yml file for NGINX and Let’s Encrypt:<\/p>\n\n\n\n
version: '3'\nservices:\n  nginx:\n    image: nginx\n    restart: unless-stopped\n    ports:\n      - 80:80\n      - 443:443\n    volumes:\n      - .\/data\/www:\/var\/www\n      - .\/data\/letsencrypt:\/etc\/letsencrypt\n      - .\/config:\/etc\/nginx\/conf.d\n       \n    command: \"\/bin\/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \\\"daemon off;\\\"'\"\n\n  certbot:\n    image: certbot\/certbot\n    restart: unless-stopped\n    volumes:\n      - .\/data\/www:\/var\/www\n      - .\/data\/letsencrypt:\/etc\/letsencrypt\n    entrypoint: \"\/bin\/sh -c 'trap exit TERM; while :; date; do certbot renew --webroot -w \/var\/www\/certbot; sleep 12h & wait $${1}; done;'\"<\/code><\/pre>\n\n\n\n
Before you start with a new sub domain you have to initially get a certificate: <\/p>\n\n\n\n
docker run --rm -ti -v $PWD\/data\/www:\/var\/www -v $PWD\/data\/letsencrypt:\/etc\/letsencrypt certbot\/certbot certonly --webroot -w \/var\/www\/certbot -d <\/code><your-public-domain-name> --email <your-email-address><\/code><\/p>\n\n\n\n
NGINX Configuration: default.conf :<\/p>\n\n\n\n
server {\n        listen 80;\n        server_name unified.rocworks.at;\n        location \/.well-known\/acme-challenge\/ {\n            root \/var\/www\/certbot;\n        }\n        location \/ {\n            root \/var\/www\/html;\n        }\n}<\/code><\/pre>\n\n\n\n
NGINX Configuration: unified.conf:<\/p>\n\n\n\n
server {\n        server_name unified.rocworks.at;\n\n        root \/var\/www\/html;\n        index index.html index.htm;\n\n        location \/ {\n            proxy_pass https:\/\/<ip-of-wincc-unified-host>\/;\n            proxy_http_version 1.1;\n            proxy_set_header Upgrade $http_upgrade;\n            proxy_set_header Connection 'upgrade';\n            proxy_set_header Host $host;\n            proxy_cache_bypass $http_upgrade;\n        }\n\n        location \/umc-sso {\n            proxy_pass https:\/\/<ip-of-wincc-unified-host>\/umc-sso;\n            proxy_http_version 1.1;\n            proxy_set_header Upgrade $http_upgrade;\n            proxy_set_header Connection 'upgrade';\n            proxy_set_header Host $host;\n            proxy_cache_bypass $http_upgrade;\n            proxy_buffer_size 128k;\n            proxy_buffers 4 256k;\n            proxy_busy_buffers_size 256k;\n        }\n\n        #location \/graphql { # Optionally you can also publish GraphQL\n        #    proxy_pass http:\/\/<ip-of-wincc-unified-host>:4000\/graphql;\n        #    proxy_http_version 1.1;\n        #    proxy_set_header Upgrade $http_upgrade;\n        #    proxy_set_header Connection 'upgrade';\n        #    proxy_set_header Host $host;\n        #    proxy_cache_bypass $http_upgrade;\n        #}\n        \n\n        listen 443 ssl; # managed by Certbot\n        ssl_certificate \/etc\/letsencrypt\/live\/unified.rocworks.at\/fullchain.pem; # managed by Certbot\n        ssl_certificate_key \/etc\/letsencrypt\/live\/unified.rocworks.at\/privkey.pem; # managed by Certbot\n        include \/etc\/letsencrypt\/options-ssl-nginx.conf; # managed by Certbot\n        ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem; # managed by Certbot\n}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
This article will show how WinCC Unified can be accessed through a public available server in the internet. Disclaimer: I only did this for testing and demo purposes!!! First you need to have a public domain name and a public … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,33],"tags":[],"class_list":["post-1256","post","type-post","status-publish","format-standard","hentry","category-allgemein","category-wincc-unified"],"_links":{"self":[{"href":"https:\/\/www.rocworks.at\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1256","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rocworks.at\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rocworks.at\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rocworks.at\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rocworks.at\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1256"}],"version-history":[{"count":15,"href":"https:\/\/www.rocworks.at\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1256\/revisions"}],"predecessor-version":[{"id":1275,"href":"https:\/\/www.rocworks.at\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1256\/revisions\/1275"}],"wp:attachment":[{"href":"https:\/\/www.rocworks.at\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1256"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rocworks.at\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1256"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rocworks.at\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1256"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}