How to: Access Remote TCP Servers using CloudAccess Adapter

The Mervis CloudAccess Adapter is a Windows client application that establishes a secure tunnel to your remote PLC. It allows you to access TCP services running on the PLC (such as SSH, Web Servers, or Modbus TCP) as if the device were on your local network.

This guide demonstrates how to configure the Adapter to access an SSH server on a remote PLC.

Before proceeding, ensure you have the following:

• CloudAccess Adapter Binaries: The Windows client software (usually a `.zip` file).
• CloudAccess Credentials:
  • User and Password (Specific to the CloudAccess project).
  • Channel ID: A unique string (e.g., `iiiii`) identifying the specific service (like SSH) on the PLC.
• SSH Client: Software such as PuTTY, MobaXterm, or Windows Terminal.

The CloudAccess Adapter software and credentials are not publicly downloadable. Please contact Mervis Technical Support to request the Adapter binaries and your specific project credentials.

The Adapter is controlled entirely by a JSON configuration file. You must map the remote Channel ID to a Local Port on your computer.

1. Extract the Adapter `.zip` file to a folder (e.g., `C:\Mervis\CloudAccess\`).
2. Open `appsettings.json` in a text editor (like Notepad or VS Code).
3. Locate the ``“Forwarding”`` section inside ``“AdapterEngine”``.

Update the configuration to match the example below. Pay close attention to the highlighted fields. You can download this snippet using the link above the code block.

appsettings.json

{
  "urls": "http://*:25011",
  "AdapterEngine": {
    "Forwarding": [
      {
        "ChannelId": "YOUR_CHANNEL_ID_HERE", 
        "Credentials": {
          "User": "YOUR_CA_USERNAME",
          "Password": "YOUR_CA_PASSWORD"
        },
        "Protocol": "Tcp",
        "AdapterClientEndpoint": {
          "Port": 8082, 
          "Ssl": false,
          "Timeout": "00:01:00"
        },
        "DsServerEndpoint": {
          "Host": "cloudaccess.mervis.info",
          "Port": 23000,
          "Ssl": true,
          "ValidateCertificate": false,
          "Timeout": "00:02:30"
        }
      }
    ]
  },
  "Logging": {
    "Console": { "Disabled": false },
    "File": { "Disabled": true },
    "Levels": { "Default": "Trace", "Microsoft": "Warning" }
  },
  "AllowedHosts": "*"
}

You can define multiple channels to use them in parallel. For example, you can map an SSH connection (on local port 8082) and a PLC Web Server (on local port 8083) simultaneously.

To do this, add a second block to the ``“Forwarding”: [ … ]`` array. Ensure every block has its unique ``ChannelId`` and a unique local ``Port``.

"Forwarding": [
  {
    "ChannelId": "SSH_CHANNEL_ID",
    "Credentials": { "User": "...", "Password": "..." },
    "AdapterClientEndpoint": { "Port": 8082 ... },
    "DsServerEndpoint": { ... }
  },
  {
    "ChannelId": "WEB_SERVER_CHANNEL_ID",
    "Credentials": { "User": "...", "Password": "..." },
    "AdapterClientEndpoint": { "Port": 8083 ... }, 
    "DsServerEndpoint": { ... }
  }
]

You can run the adapter temporarily via the console to test the connection.

1. Open Command Prompt or PowerShell.
2. Navigate to the folder containing the adapter.
3. Run the executable pointing to your config file:

.\ESG.NetCore.DataSpy.Client.Host.exe --runAsConsole -configFile "appsettings.json"

Success: You should see log output indicating the adapter has started and is listening on your local port (e.g., `127.0.0.1:8082`). Keep this window open.

Now that the tunnel is active, connect your SSH client to your localhost.

1. Host Name (or IP address): ``127.0.0.1``
2. Port: ``8082`` (Or the value you set in ``AdapterClientEndpoint`` → ``Port``).
3. Connection Type: SSH

When you click Open, you will be prompted for login credentials.

Login Note: At this stage, you are logging into the PLC's Operating System. Enter the root user and password for the PLC hardware (e.g., Unipi / root), not the CloudAccess credentials.

Windows Terminal Example:

ssh unipi@localhost -p 8082 -o ServerAliveInterval=10

• Connection Refused: Ensure the Adapter console window is still open and running. Check that you are connecting to `127.0.0.1` and the exact port defined in your JSON.
• Authentication Failed (Adapter): Check the console logs. if you see “Unauthorized” or credential errors, verify the `ChannelId`, `User`, and `Password` in `appsettings.json`.
• Port Conflicts: If the adapter crashes immediately, port `8082` might be in use. Change `“Port”: 8082` in the JSON to a different number (e.g., `22222`).