Remote HMI Access Without a Public Web Listener
Keep the HMI off the public internet and broker one approved action through a gateway, an enrolled asset identity and a session you can revoke on demand.
Showing a machine's status page in a browser tab is not the same as controlling the equipment behind it. The HMI should stay private while a small, policy-bound service brokers the one action a user needs. Decide the operation, the identity and the revocation path before choosing a product. Transport is the easy part to replace; the authorization model is not.
Pick the Operation Before the Transport
Reading a status page, pulling an approved report and changing a setpoint are three different requests. The first can be satisfied by a read-only view; the last touches equipment state and needs the owner's explicit approval, a maintenance window and local supervision. Grouping them under remote access hides that difference and usually produces a broader path than the task requires. Name the operation, the role allowed to perform it and the evidence that it happened.
The transport then follows from the operation rather than the other way round. A read-only need rarely justifies interactive control, and interactive control rarely justifies exposing the HMI's own listener. Once the operation is written down, the access model becomes a decision instead of a product default.
Put the Broker in Front of One Named Resource
A resource gateway authenticates the user, applies policy, and opens a connection to one private service. The HMI keeps its listener on the private network and never accepts sessions from the internet. The gateway terminates the encrypted session, which makes it a plaintext trust boundary that someone must administer and monitor.
That boundary is the design, not a side effect. Write down where encryption ends, who holds the gateway's keys, and which team can change its policy.
| Model | Where the session ends | Fits when |
|---|---|---|
| Browser gateway | At the broker, then a narrow proxy connection to one HMI service | Read-only pages and approved actions with per-user policy |
| Site engineering workstation | On a controlled host inside the site network | The tool needs local discovery or a legacy client |
| Outbound site connector | At the connector, brokered from outside | No new inbound path to the site is allowed |
Each row carries a different failure mode. A gateway depends on its policy and certificate chain, a site workstation depends on physical and local account control, and an outbound connector depends on the broker being reachable. Pick the row that matches the operation, then document the dependency it introduces.
Address Is Routing, Identity Is Authorization
A tunnel address or a DNS name tells the network where to send packets; it does not tell the broker which machine the user intended. Enrol each HMI or site connector with a distinct identity and tie that identity to an inventory record. When an address changes, the identity still selects the right asset. When an identity is retired, the inventory entry shows what access disappeared.
Dynamic DNS updates a record and nothing else. It supplies neither user authorization nor a route through every upstream translator, and treating it as access control is how an old name keeps working after a decommission. A supported outbound connector avoids a new unsolicited inbound path, but it still needs network-owner approval and a documented behaviour when the broker is unreachable.
Scope the Session and Prove Revocation
Give each user a separate identity, require multifactor authentication, and grant only the actions the operation needs. Set the maintenance window in the policy rather than in a calendar note. Protect the credentials and job data the session touches, and retain access events without collecting unrelated user activity.
Revocation has to be tested while the session is live. Remove the user's entitlement, end the session from the broker, and confirm the HMI is no longer reachable through that path.
Then exercise the failure the plan claims to survive: stop the broker or drop the tunnel and verify that local operation and recovery still work. A design that only functions while the remote path is healthy is not a remote-access plan. Record the date, the operator and the result, because the next reviewer will ask for evidence rather than intent.