Keenetic router has Diagnostic with trace record capability. Setup
capture for your Internet network interface and try to connect
externally. You'll got downloadable pcap trace which you may
analyze on PC in Wireshark application. Don't generate a lot of
traffic when capturing to not overflow router memory buffer too
soon. (writing form a laptop without of Cyryllic locale) First of all, you need look if the first request is reaching the router at all. If Keenetic remote access service is filtering VNC port, change the port at remote client side then setup port forwarding at Keenetic router side to forward non-standard port to your PLC standard VNC port. Probably, this trick will pass the firewall of Keenetic DNS service.