---
title: "Wi-Fi Button: Field Service and Maintenance"
slug: "wlan-button-field-service-and-maintenance-access"
updated: 2026-11-04T15:29:44Z
published: 2026-11-04T15:29:44Z
canonical: "docs.insys-icom.com/wlan-button-field-service-and-maintenance-access"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insys-icom.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Wi-Fi Button: Field Service and Maintenance

## Situation

You operate or maintain **local machines** and **plants** in the field, e.g. transformer stations, wind turbines, solar power systems, water/pumping stations, and mobile or hard-to-access machinery. In doing so, you are often faced with the following typical conditions:

- The machine or plant is already fully in **operation**
- **Network components** and remote maintenance are in **operational configuration**
- **On site**, there is often **no** local configuration/service **network** available, and **working conditions can be challenging** (accessibility, space, lighting, weather conditions
- **On-site access** to parts of the machine/plant is necessary for:
  - Diagnosis, troubleshooting
  - Maintenance, configuration, firmware updates
  - Commissioning of new components

The following challenges further complicate the situation:

- Access **via cable** is difficult to achieve
  - Requires control cabinets to be kept open at all times
  - Work must be carried out directly on the machine
  - Additional cabling required
  - Difficult to stay in the immediate vicinity (space, weather, noise, light)
- Access **via existing remote maintenance** is difficult to achieve
  - Allows for unnecessary diagnosis
  - On-site dismantling or conversion may be required
  - It may well be that the lack of an internet connection is the problem

The **objective** is to provide temporary, secure access to the machine’s or plant’s network

- without making any changes to the existing network structure
- without affecting the current configuration and
- without permanently enabling local wireless access.

## Solution

Using an INSYS icom Wi-Fi-enabled industrial router from the **MRX.neo** or **MOROS.neo** series to provide **temporary Wi-Fi access** with the following features:

- Wi-Fi is **disabled** by default
- Activation is carried out deliberately using a **physical button**
- Automatic deactivation via **timeout**

In practice, this offers the following **benefits** to service staff:

- Connection using a tablet or laptop close to the plant
- Carrying out diagnostics directly on the vehicle or from a safe distance
- No long-term work on an open control cabinet
- Working in a service vehicle, sheltered from the weather
- Convenient use of engineering tools

![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(724).png)

> [!NOTE]
> Please note that the networks are separate!
> 
> In our example, the Wi-Fi forms a **separate, logically isolated service network**. It is intended to allow access only to the local machine/plant network.

### Prerequisites

This Configuration Guide assumes that the following infrastructure or configuration is already in place:

- A remote maintenance solution has been configured (optional, but recommended) **✔** see the [Configuration Guides](/kb/docs/configuration-guides-ics) for our **icom Connectivity Suite – VPN**
- Routers and network components are integrated into the system and are operational **✔**
- Access to the router is available (e.g. locally or initially) **✔**

### Restrictions

There are no significant restrictions.

### Recommendations

- Configure the Wi-Fi exclusively as a temporary service interface.
- Set a timeout that allows sufficient time for your service processes (e.g. 30–45 minutes).
- Use a separate IP subnet for the Wi-Fi and set the subnet mask and DHCP server settings to cover only a small network (e.g. 192.168.250.0/30).
- Restrict access via firewall rules and only allow relevant ports and protocols.
- Give the Wi-Fi network a unique SSID (e.g. **SERVICE_<plant_number>**). The factory default SSID is **MOROS.neo** or **MRX.neo**, followed by the router’s serial number.

### Procedure

Follow the steps below to configure the router, which connects the system to the remote maintenance service or the internet, so that it provides a temporary service Wi-Fi network for access to the system network when the Wi-Fi button is pressed.

#### Connecting the Wi-Fi antenna

Connect a suitable [Wi-Fi antenna](https://www.insys-icom.com/en/accessories/antenna/#wifi-antennas), approved for use with your router, to the router. Please also refer to our [Antenna Guide](/kb/docs/antennas-for-insys-routers-selection-installation-und-optimisation).

#### Configuration of the router

1. Open the user interface of the router: https://insys.icom
2. Set up an IP network for the Wi-Fi. Click on the *Network* → *Interfaces* page in the *IP networks* section on to add an IP network and configure this accordingly:

  - *Mode*: Wi-Fi Service
  - *Betriebsart*: Local - always started
  - *Start SLAAC*:
3. Klicken Sie unter Statische IP-Adressen auf und weisen Sie der WLAN-Schnittstelle eine *IP-Adresse* zu (hier **192.168.250.1/30**). ![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(773).png)
4. Click on Submit.
5. Configure the DHCP server. Click on the *Network* → *DHCP* page in the *DHCP server* section behind the active DHCP server on to edit this and configure this accordingly:

  - *Interface*: select the previously created Wi-Fi service network
  - *First IP address*: 192.168.250.2
  - *Last IP address*: 192.168.250.2
  - *Netmask*: 30
6. Click on Submit.
7. Add a new firewall rule that permits Wi-Fi access to the local network via HTTPS. Click on the *Network* → *Firewall / NAT* page in the *IP-Filter* section on and configure it as follows:

  - *Description*: WLAN - local access via HTTPS
  - *Packet direction*: INPUT
  - *IP version*: Alle
  - *Protocol*: TCP
  - *Input interface*: net2
  - *Destination port*: 443

![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(775).png)

1. Click on Submit.
2. Add a new firewall rule that forwards packets from the Wi-Fi network to the local network. Click on the *Network* → *Firewall / NAT* page in the *IP-Filter* section on and configure it as follows:

  - *Description*: Wi-Fi into local network
  - *Packet direction*: FORWARD
  - *IP version*: All
  - *Protocol*: All
  - *Input interface*: net2
  - *Output interface*: net1
3. Click on Submit.
4. Add a new firewall rule that permits incoming DHCP connections from the Wi-Fi network. Click on the *Network* → *Firewall / NAT* page in the *IP-Filter* section on and configure it as follows:

  - *Description*: Wi-Fi - DHCP access
  - *Packet direction*: INPUT
  - *IP version*: All
  - *Protocol*: UDP
  - *Input interface*: net2
  - *Destination port*: 67
5. Click on Submit.
6. Add a new firewall rule that permits outgoing DHCP connections to the Wi-Fi network. Click on the *Network* → *Firewall / NAT* page in the *IP-Filter* section on and configure it as follows:

  - *Beschreibung*: Wi-Fi - DHCP response
  - *Packet direction*: INPUT
  - *IP version*: All
  - *Protocol*: UDP
  - *Output interface*: net2
  - *Destination port*: 68
7. Click on Submit.
8. Add a new firewall rule that permits Pings to the router from the Wi-Fi network. Click on the *Network* → *Firewall / NAT* page in the *IP-Filter* section on and configure it as follows:

  - *Description*: Wi-Fi - ping router
  - *Packet direction*: INPUT
  - *IP version*: All
  - *Protocol*: ICMP
  - *Input interface*: net2
9. Click on Submit.
10. Add a new Source NAT rule that permits masquerading for the Wi-Fi network. Click on the *Network* → *Firewall / NAT* page in the *Source NAT* section behind *Masquerading for all local interfaces* on and add under *Output interface* the Wi-Fi interface **net2**. ![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(776).png)
11. Click on Submit.
12. Configure the Wi-Fi network. Click on the *Network* → *Interfaces* page in the *WLAN* section behind the Wi-Fi interface on to edit this and configure this accordingly:

  - *Active*:
  - *Description*: Wi-Fi AP for service
  - *Operation mode*: Access Point
  - *Access Point activation only via WLAN button*:
  - *Deactivate after (minutes)*: 30
  - *SSID*: Service_1234
  - *Encryption Method*: Pre-Shared-Key
  - *Pre-Shared-Key*: enter a strong and secure Wi-Fi password
  - Frequency Band: select the desired Wi-Fi frequency band
  - *Channel*: automatic
  - *Bridge to IP net*: net2
13. Click on Submit.
14. Activate the profile with a click on Activate profile .

You have now configured the router for the temporary service Wi-Fi network.

## Results check

### Enabling and disabling the Wi-Fi connection

Press the WLAN button on the router.

![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(734).png)

The WLAN LED should start flashing orange and the Wi-Fi will be enabled for the specified duration. Pressing the WLAN button again will disable the WiFi.

Search for the router’s Wi-Fi network on your computer and connect to it. Enter the *Pre-shared key* specified above.

![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(735).png)

Once the connection has been established, the WLAN LED should light up green.

After the specified time has expired, the Wi-Fi should be deactivated and the WLAN LED should no longer be lit.

If you click on the ![view dashboard outline](https://docs.insys-icom.de/assets/icons/view-dashboard-outline.png) *Status* → *Dashboard* page in the *Network configuration* section on the *net2* field, you can view detailed information about the Wi-Fi connection. You can check the remaining duration of the Wi-Fi connection under *Deactivate after*.

![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(779).png)

You can view detailed information in the respective logs on the ![view dashboard outline](https://docs.insys-icom.de/assets/icons/view-dashboard-outline.png) *Status* → *Log view* page.

![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(780).png)

### Access to the router and the local network

Check that the devices on the network are accessible by pinging them from the computer connected to the router’s Wi-Fi network.

## Troubleshooting

- Can’t connect to the Wi-Fi?
  - Is the WLAN LED flashing? If not, press the WLAN button again or check the Wi-Fi settings.
  - Is the Wi-Fi SSID visible? If not, check the compatibility of the band you are using (2.4/5 GHz) or the Wi-Fi settings.
  - Is authentication not possible? Check the pre-shared key set in the Wi-Fi settings.
  - Is the DHCP client enabled on your PC so that the PC can be assigned an address by the Wi-Fi access point’s DHCP server?
- Do you have a Wi-Fi connection but cannot access the devices on the system network?
  - Check the firewall and NAT rules (IP filters and S-NAT/masquerade).
  - Is the destination IP address reachable? Ping the destination IP from the computer and the router (*Status* → *Dashboard* → *Connection Test*).
- Is your connection unstable?
  - Reduce the distance between your computer and the router or Wi-Fi access point.
  - Check for possible sources of interference, such as other radio devices or obstacles that may block reception.
  - Optimise the position of the antenna.
  - If necessary, change the frequency band or channel.

The serial number can be taken from the label on the router or its menu item *Status* → *Dashboard*.

Standard IP address: https://192.168.1.1; login depending on configuration; default for earlier firmware versions: *User name*: **insys**, *Password*: **icom**