How to Achieve Access to NAT Networks by CNC Machine Tools

• 1
  Key takeaways
• 2
  Why CNC controls sit behind NAT in the first place
• 3
  What to gather before touching the gateway
• 4
  Designing the private subnet for CNC machine tools
• 5
  Common failures and how to clear them
• 6
  Keeping the shop floor secure while NAT is open
• 7
  Step by step: reaching NAT networks by CNC machine tools
• 8
  Which access method fits which machine

Most CNC controls ship with a fixed private address. Fanuc, Siemens, and Mitsubishi controls typically default to something like 192.168.0.1 or 192.168.1.1. If you connect two machines with the same default, neither one talks to the network. NAT solves that by giving each control its own private address behind a gateway that holds one public address.

The alternative is to give every machine a public IP. That works until you have 40 machines and a limited address block. It also puts every control directly on the internet, which most IT departments will refuse. NAT keeps the controllers hidden while still allowing a programmer or a monitoring server to reach them.

There is a second reason. Many CNC controls run old embedded operating systems that have not seen a security patch in years. Leaving them on a flat public network is a liability. A NAT gateway acts as a buffer: inbound traffic only reaches the control if a port map exists for it.

So the goal is not to remove NAT. The goal is to configure it so that the right traffic passes and everything else is dropped. That is what the steps below cover.

• 1
  Private address per controlEach CNC gets a unique address on the shop subnet.
• 2
  One public addressThe gateway holds the routable IP and performs translation.
• 3
  Explicit inbound rulesNo port map means no inbound path to the control.

You need four pieces of information before you change a single setting. First, the current IP address and subnet mask of every CNC control you plan to connect. Second, the protocol each control uses for data transfer: FOCAS, Modbus TCP, OPC UA, or simple FTP. Third, the public IP or IP block assigned by your ISP. Fourth, the internal subnet you will use for the machine network.

Write these down in a table before you start. In our experience, the most common commissioning delay is discovering that two machines were configured with the same address months ago and nobody noticed. A quick ping sweep of the machine subnet finds duplicates in under a minute.

Also check the firmware version of each control. Older Fanuc 0i series controls may not support the same Ethernet options as a 31i. If the control only supports FTP for program transfer, your port map will look different from a machine running OPC UA.

Finally, confirm who owns the firewall. In many plants the IT team manages the gateway, and the maintenance team manages the machines. Agree on the change window before you start. A 30-minute window is usually enough for three to five machines.

• 1
  Machine inventoryModel, control type, current IP, and protocol for each unit.
• 2
  Gateway accessAdmin credentials and a backup of the current configuration.
• 3
  Change windowAgreed with IT and production so no job is interrupted.
• 4
  Rollback planThe old configuration saved to a file before any edit.

Pick a private range that does not overlap with the office network. Common choices are 10.10.0.0/24 or 192.168.50.0/24. Avoid 192.168.0.0/24 and 192.168.1.0/24 because those are the factory defaults on many controls and will cause conflicts later.

Assign addresses in blocks by machine type. For example, 10.10.0.11 to 10.10.0.30 for milling centers, 10.10.0.31 to 10.10.0.50 for lathes, and 10.10.0.51 to 10.10.0.70 for EDM. This makes troubleshooting faster because the address tells you what kind of machine you are looking at.

Set the subnet mask to 255.255.255.0 for a single shop segment. If you have more than 200 devices, move to a /23 or split into VLANs. Do not use a /16 just because it is easy; large broadcast domains slow down older controls.

Leave the gateway address on the control pointed at the NAT router, not at the office firewall. The control should never see the office network directly. If it does, you have created a routing path that bypasses your port maps.

• 1
  Avoid default ranges192.168.0.x and 192.168.1.x are already used by many controls.
• 2
  Group by machine typeAddress blocks make the network self-documenting.
• 3
  One gateway onlyThe control points at the NAT router, nothing else.

The most frequent symptom is a control that pings locally but is unreachable from outside. Nine times out of ten the port map points at the wrong private address, or the control's gateway field is still set to the old router. Check both before you change anything else.

A second common failure is a connection that opens and then drops after a few seconds. This usually means the protocol needs more than one port. FTP, for example, uses port 21 for control and a separate data port. If you only mapped 21, the directory listing will fail. Switch the control to passive mode and map the passive port range as well.

Slow transfers on large programs point at duplex mismatch. Set both the control NIC and the switch port to the same speed and duplex, preferably 100 Mbps full duplex for older controls. Auto-negotiation on a 1 Gbps switch often fails with a 10-year-old controller.

If a machine drops off the network after a power cycle, check whether it is set to DHCP. Many controls default to DHCP and pick up a different address after a reboot, which breaks the port map. Set a static address on every machine you map.

• 1
  Unreachable from outsideWrong private IP in the port map, or wrong gateway on the control.
• 2
  Connection dropsSecond data port not mapped; switch to passive FTP.
• 3
  Slow transfersDuplex mismatch; pin both ends to 100 Mbps full duplex.
• 4
  Address changes after rebootDHCP still enabled; set a static address.

Every port map is a small opening. Keep the list short. If a machine only needs to send programs to a server, it does not need an inbound map at all; outbound connections from the control are enough. Inbound maps should exist only where a server or engineer must initiate the connection.

Use a separate VLAN for the machine network. Traffic between the machine VLAN and the office VLAN should pass through the firewall with explicit rules. This keeps a compromised office laptop from scanning the shop floor directly.

Change default passwords on the NAT router and on any control that supports password protection. Many controls ship with no password at all. At minimum, restrict who can reach the network settings menu.

Keep a log of port maps with an expiry date for temporary ones. A map opened for a two-hour vendor session should be removed the same day. In our own plants we review the map list monthly against the machine inventory.

• 1
  Prefer outboundIf the control can push data out, no inbound map is needed.
• 2
  Separate VLANMachine traffic crosses the firewall, not a flat LAN.
• 3
  Change defaultsRouter and control passwords, every time.
• 4
  Expire temporary mapsVendor access should not outlive the session.