Allowing remote access to FieldPoint unit from all computers

[UTErika]

We're trying to set up a system where students can run a LabVIEW .vi (which we've converted to an .exe) from any computer with Internet access, using a FieldPoint installer and the executable file installer so the student doesn't need LabVIEW on their host machine. The program communicates with our FieldPoint unit which currently sits online at the static IP address 146.6.85.30. The FieldPoint unit is also hooked up to all of the wind tunnel hardware in our lab, so essentially, students can control the operation of our large wind tunnel from their home. Using a webcam and other accessories, they can conduct complete fluid flow experiments with this system.

The current problem we are having is a network a
ccess issue. As I mentioned, the IP address of the FieldPoint is 146.6.85.30, and the subnet mask is 255.255.0.0. Any computer on the IP range 146.6.* can access the FieldPoint unit remotely, and effectively control the wind tunnel. For some reason, however, computers outside of this range cannot access the IP address. Even attempting to ping the IP from an outside computer results in a "Request timed out" response. If you attempted to access the site 146.6.85.30 right now, you wouldn't be able to find the server (yet I can interact with it just find from the 146.6.* IP address range).

Here are some fixes we have tried:
- Changing the subnet mask to 0.0.0.0 to allow more IP addresses access. When we did this, the FieldPoint unit wouldn't come back online.
- Using MAX to set the permissions in the FieldPoint Access Control tab, allowing "*" to have read/write access. This didn't fix the problem, and * is the default anyways.
- Opening our LabVIEW .exe and under the operate
-> options menu, checking the box for "enable web server" under the Web Server menu. Again, no fix.

Any suggestions???

[Matthew_Williams]

Sounds like the gateway address is not set properly. Set the netmask back to 255.255.0.0 (assuming this is proper) and make sure that you have the right gateway. A missing or improper gateway will act exactly as you described, responding properly from the same network but unresponsive to machines outside the network.

Matt

[UTErika]

Thanks for your reply Matt. I'm pretty sure we used a gateway suggested by our network administrator, but there is also an option to let MAX suggest a gateway. If I remember correctly, those values are different. Should we go with the network admin or MAX? I believe the network admin gave us the netmask of 255.255.255.0 which we changed to 255.255.0.0 on the FieldPoint to allow more access. Maybe changing the gateway would be a good idea?

[Matthew_Williams]

You should use the netmask and gateway that your network admin gave you.

The netmask tells the fieldpoint what other ip addresses are 'local' to it, meaning the fieldpoint can talk directly to those other addresses. The fieldpoint unit will direct packets for non-local addresses to the the gateway for forwarding. Errors in either the subnet or gateway can cause non-local communications to fail.

The gateway from your admin should be on the 'local' subnet, something like 146.6.n.n if your correct netmask is 255.255.0.0 or 146.6.85.n if your correct netmask is 255.255.255.0.

Don't forget to at least password protect the fieldpoint unit. I've never exposed a fieldpoint controller directly to the internet; I don't know how well hard
ened they are. We always at least do portforwarding and masking into private ip space.

Let me know how you fare. Thanks.

Matt

[Aaron_G]

You should use the Gateway settings that your network administrator tells you. MAX suggests values based upon the current computer configuration and common values/settings. It is an educated guess, but a guess nonetheless.

The most likely reasons that you will be unable to access the unit, even to ping it, are network configuration issues. Most of these will be based upon firewall, router and gateway settings. These will probably require you to get additional assistance from your network admin. The admin will have to specifically allow the router/gateway/firewall to make the IP address available to the internet along with specific ports (e.g. FTP or Ping).

I would be very careful in simply making the unit available to the world at large. If you do not co
nfigure the security settings, any person knowing that the unit existed would be able to link to it, download the control program and control it. It would not necessarily be restricted to the students who need it. FieldPoint modules do support IP and name based security. You should use this to restrict access. A better option may be to modify the control program. The firewall could be set to allow FTP access to the FieldPoint unit and one or two dedicated ports. The control program which is downloaded could talk through a custom protocol (that you program) over TCP/IP to the opened ports on the FieldPoint system. The FieldPoint system can be running a control program that requies the specific communications protocol, plus a log-on/password to further restrict access. This would also allow you to include code that allows multiple users to share data from a session, or prevent two users from unintentionally interfering with each other.
I would also set the FieldPoint unit to have the FT
P server set for downloads only (especially on external accesses).

Regards,
Aaron

[UTErika]

Matt, you were right. It was definitely a gateway issue. I reset the netmask and the gateway to the correct values for the corresponding IP address and was able to reach the FieldPoint IP address remotely from my home computer (outside of the FieldPoint network)! Thanks so much for your help!!

[UTErika]

Aaron, thanks for your reply. I was able to adjust the gateway and allow remote access to the FieldPoint. As far as security goes, the control program (at least the one we created) is only available to students via CD. It is not publically available via the Internet. We have an embedded server program that runs on the FieldPoint unit, and it acts as a password checker to ensure that only students with correct passwords can use the control program. Also, I locked the configuration of the FieldPoint unit in MAX. Do you think this is enough security?