FireSight docs

FireSight OT OT remote access

What FireSight OT is

FireSight OT gives engineers, maintenance staff and machine builders secure remote access to machine networks: PLCs, HMIs, engineering PCs and anything else on a plant floor. It's built for manufacturers whose lines are copies of each other, where every site uses the same machine addresses.

Nothing at the site accepts connections from outside. A small device in each machine network dials out to your Hub, and people are brokered through it to exactly the machines they've been granted.

 engineer ── browser / fsot client ──► Cloud Hub ◄── outbound TLS ── Cloud Connector ── PLC / HMI
                                                                     site A 192.168.1.0/24  → 10.200.3.0/24
                                                 ◄── outbound TLS ── Cloud Connector ── PLC / HMI
                                                                     site B 192.168.1.0/24  → 10.200.4.0/24

The parts

Part What it is
Cloud Hub The head-end server, on Debian 12 or 13. People sign in here, in the web console or with the client. It holds the companies, sites, machines, people, rules, audit log and licensing, and is the only part exposed to the internet (HTTPS on 443). See Install a Cloud Hub.
Cloud Connector A small, DIN-rail-friendly device in each machine network: models CC-3, CC-4 and CC-5, and the industrial CC-4i and CC-5i. They're based on Raspberry Pi: buy ours, or build your own with no hardware lock-in. It only ever connects out to the Hub, over TLS on port 443, and publishes the machines it's been told about. See Cloud Connectors.
FireSight OT client (fsot) For Windows, Mac (signed and notarized by Apple) and Linux, downloaded from your own Hub so it always matches its version. Tunnels RDP, VNC, SSH, Telnet and any TCP tool (Modbus, OPC UA, S7, vendor engineering software) to a port on the engineer's own computer. Web HMIs need no client at all. See The FireSight OT client.

Ideas worth knowing

Resources. A resource is one thing people can reach through a Cloud Connector: a web page (an HMI), an RDP or VNC desktop, an SSH or Telnet console, any TCP port, or a whole subnet. Nobody sees a resource until it's granted to them.

Duplicated networks and 1:1 mapping. When two sites both use 192.168.1.0/24, the Hub gives each one its own virtual subnet from a pool (by default 10.200.0.0/16). Address .20 at site A becomes 10.200.3.20, and at site B 10.200.4.20. People and resources can use either the real or the virtual address; the connector a resource belongs to decides which site it reaches.

Companies, divisions and vendors. A Hub can serve one company or many, kept fully separate; grants never cross companies. Each company can be split into divisions (plants, lines, maintenance) and external vendors (machine builders, integrators), and access is granted to those groups or to individual people. See People and access.

Outbound only. Cloud Connectors work through the site's NAT and firewall with only outbound HTTPS, and through an HTTP proxy if the site needs one. There is a fallback Hub port (8443) for sites that block 443.

What it does

Area What you get
Access Per machine by default. An optional full-network WireGuard VPN per connector, still limited to granted networks.
Resource types Web page (HTTP/HTTPS), RDP, VNC, SSH, Telnet, serial console, any TCP port, a whole subnet. Web pages, Remote Desktop, VNC and terminals open in the browser.
NAT options Outbound-only through the site's firewall, HTTP proxy, fallback Hub port, masquerade (machines see the connector's address, so no routes are needed at the site), source-restricted static port forwards on the Hub.
Connector networking One port, two ports (uplink and machines kept apart), Wi-Fi uplink with Ethernet to the machines, or 4G/5G mobile data with data saving; Wi-Fi or mobile data as a backup uplink. Remote changes are opt-in on site and roll back automatically if the Hub is lost.
Provisioning One generic SD card image for everyone. A one-time enrollment code ties a device to its company and site. See Cloud Connectors.
File transfer Machines and engineers at the site upload logs and recipes over SFTP or FTP; staff download them on the Hub, and the Hub can keep copies for the company's backup software. See File storage and Hub files.
Remote management Status, diagnostics, logs, ping and port tests from the site, signed software updates, certificate renewal, restart, reboot and revoke.
Alerts Email when a Cloud Connector is offline or a machine stops answering for a set time, per team, with reminders and "back" emails. One line when a whole site drops, so no alert floods.
Self-healing A Cloud Connector that loses the Hub renews its network, then restarts its software, then reboots, in stages with limits.
Security Mutual TLS with a certificate per device, two-factor sign-in, single sign-on (Entra ID, Google Workspace, Okta, OpenID Connect, ADFS, SAML 2.0), source-network limits, session and idle limits, vendor working hours, and a full audit log. See Security and audit.
Ember The built-in helper: tips for each page, a getting-started checklist, and troubleshooters that run real checks (offline Cloud Connector, unreachable machine, sign-in, email, files). It runs on your Hub and sends nothing anywhere.
Licensing Through this portal, like FireSight: a Hub license for a number of connectors, or a device license for one connector. See FireSight OT licenses.

Roles on the Hub

Role What they can do
Admin Everything: companies, connectors, resources, people, security settings, licenses, the audit log.
Operator Their companies' Cloud Connectors, resources and people. An operator placed in a division manages only that division.
User Reach the resources granted to them, from My access or the client.

What's next

These guides describe version 0.3.0. For what it added, and what's planned for 0.4.0, see What's new and coming in FireSight OT.

Where to go next

What's new and coming in FireSight OT →