First year here and I'm still finding out what we've got, because almost none of it is written down. Management want to see the line 2 HMI from home, mostly production counts and alarms. It's a PanelView Plus 7 on a CompactLogix 5380, one unmanaged switch, and the plant network sits on its own range behind a firewall IT look after.
So I asked IT to forward the VNC port on the terminal and got a flat no, and no to 3389 to the engineering PC either, with nothing beyond "not happening". Someone on my shift said TeamViewer, so I tried the free one for an hour and IT saw it and blocked it the same day. They won't hear of anything coming in.
Is a port forward really that bad if its only a viewer? Or any ideas for a way of doing this that IT would actually say yes to, because I'd rather not go back with the same ask twice?
Yes, it's that bad. A forwarded VNC port on a terminal is on Shodan inside a week, and the terminal has no lockout. IT were right and short with you, both.
What does the plant firewall allow outbound? Anything at all on 443?
Outbound 443 is open, that's how the engineering PC gets its updates. Nothing else that I know of. So if the box inside calls out that's allowed, and nothing calling in is. Might be something to work with there.