On the plant Wi-Fi the phone and the HMI panel share one local network, so the panel's private address answers. Cellular is a separate network with no route into a private address, which is why the same phone times out. Test the four boundaries in order, use the panel's own address for the local test, and let whoever owns the router build the VPN route.
Your phone opens the panel's web page on the plant Wi-Fi and times out on cellular, and the difference is not a setting buried in the panel. On Wi-Fi, the phone and the panel share one local network, so the panel's private address answers directly. Cellular puts the phone on the carrier's network, where a private address has no route and nothing to answer. The router's address, the one people try next, leads to the router alone. The fix is a route into the plant network, built as a VPN by whoever owns that router. This article names the four boundaries to test, in order, and what each failure points to.
Why Wi-Fi works and cellular does not
When the phone joins the plant Wi-Fi it takes an address on the plant's own network, the same wire the panel hangs on. Open the panel's address and the answer comes back in one hop, with the page on the phone in well under 1 second.
Cellular hands the phone an address on the carrier's network instead. RFC 1918 reserves three ranges for private networks: 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255. Internet routers carry no route into any of those ranges, so a panel at 192.168.1.50 stays invisible from the carrier side, whatever the panel's own network settings say. The browser waits about 30 seconds, gets no answer, and reports a timeout.
The router's public address is the edge of the plant network and nothing more. From cellular, opening it reaches the router itself, and the most it offers is its own management page, which many routers refuse to serve from the far side. Panel and router are separate devices with separate addresses; one address cannot do the other's job. Web browsers and phone apps say this in their own words, and one common message is that the address in use is for a local network only.
What each symptom points to
- The router's address opens a login page, or refuses. You have reached the router itself, so the test says nothing yet about the panel.
- The panel opens on plant Wi-Fi and times out on cellular after about 30 seconds. Expected: there is no route in yet, and building one is the fix below.
- The panel times out on Wi-Fi too. Stay local: read the panel's address from its own setup screens and check the phone's address against the panel's subnet.
- The VPN app reports connected and the panel still times out. The tunnel is up but does not carry the panel's subnet; the network administrator adds that network to the tunnel's routes.
- The panel's page opens from cellular but the values on it never change. The network path is done; the panel-to-PLC link is the next test.
Test the four boundaries in order
Work one boundary at a time and retest the same path after each change. A DNS edit on the panel does nothing for a missing route, and an FTP setting builds no path either.
- Local link. Confirm the panel is on the network and read its address and subnet mask from its own setup screens. With a mask of 255.255.255.0, the phone must match the panel in the first three octets: 192.168.1.77 matches a panel at 192.168.1.50, and 192.168.43.12 does not.
- Local test. Join the same Wi-Fi the panel is on and open the panel's own address in the browser, never the router's. If the guest network fails while the staff network works, the guest network is isolating its clients from each other; test from the panel's network.
- Remote route. Switch the phone to cellular, connect the approved VPN first, then open the panel's address again. If it still times out after about 30 seconds with the tunnel up, walk the route the way Remote HMI access times out away from town: test the path describes.
- Panel-to-PLC data. Once the panel-to-PLC link exists, change a value at the PLC and watch it update on the panel. You can finish the first three boundaries before that cable arrives; the data check is its own commissioning step.
Example: one panel, one router, four boundaries
The panel sits at 192.168.1.50 with mask 255.255.255.0, the router's LAN side is 192.168.1.1, and its public side is 203.0.113.7.
Boundary one, the local link. The panel's setup screens show 192.168.1.50 with mask 255.255.255.0. That mask makes the local network 192.168.1.0, with 256 addresses of room and 254 usable once the network address and the broadcast address are set aside. Boundary one passes: the panel is addressed and on the wire.
Boundary two, the local test. The phone joins the plant Wi-Fi and reports 192.168.1.77. The first three octets match the panel's 192.168.1, so the two share a subnet. The browser opens 192.168.1.50 and the panel's page loads in under 1 second. Local path good.
Boundary three, the remote route. The phone moves to cellular. The browser tries 192.168.1.50, waits about 30 seconds, and times out: that address sits inside 192.168.0.0 to 192.168.255.255, a private range, so the carrier has no route to it. The browser tries the public side 203.0.113.7 and gets the router's edge, still no panel. The phone connects the VPN, takes a tunnel address such as 10.8.0.6, and the tunnel carries the 192.168.1.0 network. The browser tries 192.168.1.50 again and the page loads. Remote path good.
Boundary four, the panel-to-PLC data. The cable is still in delivery, so the check waits. Cable connected, the operator forces a value at the PLC and the number on the panel's page changes within a second or two. Data path good.
Four boundaries, four passes. The same phone that timed out in the parking lot now reads the panel over cellular.
The fix: give cellular a route
The working path for cellular is a VPN into the plant network, set up with whoever owns the router. The phone joins the tunnel first, then opens the panel's private address as if it were local. After a power cut, expect the router to be back on the internet within 2 to 3 minutes and the phone to follow once its tunnel client reconnects. For the router side of that job, the VPN router setup for remote PLC and HMI access walks the equipment and the configuration.
Port forwarding is the other router option, and it needs care. A forwarding rule publishes one panel service to the whole internet, where automated scanners knock on common ports all day. If the network owner approves the design, take the port list from the panel's own help file, forward only the one service you tested, and change the default port where the panel allows it; the registered defaults for HTTP and HTTPS are TCP ports 80 and 443, so a panel left on defaults is an easy find. When a rule exists and access still fails, the port forwarding test, step by step shows how to isolate which hop is refusing.
DNS and FTP belong to a different job. DNS turns names into addresses and FTP moves files; neither creates a route through the router, so leave both until the path itself tests clean.
Recommendation: get the local test right before anything remote: phone on the plant Wi-Fi, the panel's own address such as 192.168.1.50 in the browser, the router's address out of the picture. When that works, have the network owner set up the VPN route and test from cellular before touching DNS or FTP on the panel. Consider port forwarding only when the owner approves the design in writing, and take the port list from the panel's help file.
One note on equipment: an HMI is part of the control loop, and a signage display is not a substitute for one. If the plant also wants a notice board on the wall for shift messages and safety numbers, our shop-floor signage displays are built for that job.
Questions
Can I finish the network setup before the panel-to-PLC cable arrives?
Yes. The local link, the local test and the remote route involve the network only, and the panel's own pages open with no PLC attached, which is what the path test needs. Leave the live data check until the cable is connected. Then force a value at the PLC and watch it change on the panel to close the last boundary.
The phone says the address in use is for a local network only. What does that tell me?
It means the phone is trying to reach past its network while holding only a private address, and no route carries the request. On the plant Wi-Fi that is normal; the private address is exactly what you want for opening the panel. On cellular it means the tunnel is down or was never started, so connect the VPN first and try the panel's address again.
Will the remote path survive a power cut?
The router restarts on its own and reconnects to the internet, usually within 2 to 3 minutes. Two things then decide whether the phone follows. The tunnel client on the phone has to reconnect, and the site's public address has to be the one the tunnel profile points at. If the line hands out a changing address, ask the administrator for a fixed tunnel name, because a saved numeric address such as 203.0.113.7 dies with the next modem reboot.
Planning information, not legal or engineering advice. Rules differ by place: check codes and permits with your local authority and your licensed trades.