Browser monitoring and control

While browser monitoring is on, Live starts a small web server on its computer; the default port is 8080. The user enters the address of the Live computer in the browser (for example http://192.168.1.20:8080), logs on with a user name and password, and sees the pages with the same appearance as in Live, with data refreshed about once per second. If remote control is on, a user given a permission group writes tags, acknowledges alarms and handles recipes; the actions are carried out on the Live computer.

• Every action goes to the Live computer and is carried out there. It is written to the event log with the user name and the address of the computer.
• The Web viewers (n)… window in the Live system menu lists the connected users with address, rights and duration. Control users connecting and leaving are also written to the event log.
• Scripts attached to button events run in the controlling browser. Scheduled tasks, alarm detection, the archive and drivers stay on the Live computer; database, file and program access from scripts works only there.
• TV addresses always monitor only.

On the login screen, if Remember me (30 days) is selected, the session is valid for 30 days, otherwise for 12 hours. If a user is deleted or the password changes, the session becomes invalid.

• Camera images and PDF Viewer files are delivered through the server, with a session.
• For a monitor-only user, a page that requires authorization opens according to the session on the Live computer; until an authorized user logs on in Live, an authorization message appears instead of the page. For a user with control, it opens according to that user’s permission group.
• If Web access › Viewable from browser / TV is switched off in the page properties, the page does not appear in the browser’s list and is skipped in the TV sequence.
• If the time machine is on in the project, the browser user’s screen navigation, mouse movements and value entries are recorded on the Live computer; the menu says so. Passwords are not recorded.

The server looks at the address the connection comes from. The Allowed addresses setting offers three options:

A rejected request receives a 403 response. If there are 5 failed logins from the same address within 10 minutes, that address is put on hold for 60 seconds. Passwords are stored in the project file as a SHA-256 hash. The origin of the request is checked, and the session cookie has HttpOnly and SameSite=Strict set. TV addresses have no password by default; for details see the TV and multi-monitor page.

One computer: a browser user can be connected from only one computer at a time; a logon from another address is rejected, while a second tab on the same computer is allowed. When the browser is closed, the place is freed after 15 seconds. TV addresses are not bound by this rule.

Object, page and menu permissions are enforced inside the browser. The server only checks whether the session has control rights, the user’s group and whether control is on in the project. A user with control rights can write to any tag with a request that bypasses the browser interface. Therefore:

• Give control rights only to people you trust; leave the others on Monitor only.
• Give each person their own user and a password that cannot be guessed.
• Use remote control only on the plant network or over a VPN.

For devices on the network to connect, Windows Firewall needs an inbound connection permission for this program and port. Add firewall permission does this: first the settings authorization is checked, then Windows administrator approval (UAC) is requested.

In Live, the system menu › Remote monitoring… window shows the server status, the number of connected users, the browser and TV addresses (with Copy buttons), rejected connections and the firewall state. If the port is used by another program, Live reports it; choose another port in the project.

To monitor or control over the internet, set up a VPN to the plant. The user first connects to the VPN, then opens the address on the local network in the browser. Only the VPN port is opened to the internet (UDP 51820 for WireGuard); the monitoring port and the PLC ports are not forwarded. FabyaVision also checks the source address: a request from an address on the internet receives 403 even if the router is opened by mistake.

• Define a separate browser user for each person, with a password that cannot be guessed and has at least 10 characters.
• If the VPN address pool is in a private block, no extra setting is needed; if it is in a public block, add it to the Access Networks list. In strict mode, enter the VPN subnet and the local network of the TVs in the list.
• Let the VPN client reach only the monitoring port on the Live computer, with no access to the PLC network.