Why integrate the VPN into the router instead of using a separate VPN?

Integrating the VPN into the router simplifies installation (a single device, a single management point), ensures that the VPN is always active (no risk of forgetting to turn it on or accidentally disabling it), and optimizes performance (no double encapsulation). At remote sites where space is limited and maintenance is difficult, a single device that does it all is a major operational advantage.

OpenVPN or IPSec in the industrial 4G router?

OpenVPN is the most robust choice for 4G connections: it operates over UDP (which is more resilient to mobile packet loss), can use port 443 (to bypass filtering), and reconnects very quickly after a disconnection. IPSec offers better raw performance but can be blocked by certain NATs or firewalls in cellular environments. For industrial IoT over 4G, OpenVPN is preferred.

What happens if the 4G connection is lost?

The router constantly monitors the connection. If the 4G connection drops, it attempts to reconnect every few seconds. When the connection is restored, the VPN tunnel is automatically reestablished within a few seconds. Application sessions (MQTT, remote access) reconnect via the VPN’s keep-alive mechanism. With a dual-SIM router, the connection switches to the secondary SIM during an outage on the primary SIM.

Can we access the PLC from programming software (TIA Portal, Unity Pro) via the built-in VPN?

Yes. The Layer 3 VPN tunnel creates a direct IP network connection between your PC and the site’s OT network. You can use TIA Portal (Siemens S7-1200/1500), Unity Pro (Schneider M340), EcoStruxure Machine Expert, Studio 5000 (Rockwell), or TwinCAT 3 (Beckhoff)—just as if you were on the site’s local network. No software modifications are required.

Security & Connectivity

4G Router with Built-in VPN: Connectivity and Security in One Device

Industrial 4G router with built-in VPN: OpenVPN, IPSec, remote access to PLCs without opening ports. How it works, benefits, and selection criteria. Eziwan Guide.

Quick answer

A 4G router with built-in VPN combines 4G/LTE cellular connectivity and a VPN client (OpenVPN or IPSec) in a single DIN-rail enclosure. It automatically establishes an encrypted tunnel to a cloud-based VPN server as soon as it is powered on—without any manual on-site configuration. Connected devices (PLCs, meters, HMIs) can be accessed from the Internet via the tunnel, without any ports needing to be opened at the industrial site.

Connectivity AND Security: Why It’s a Mistake to Separate Them

A 4G router without a VPN exposes the OT network to serious risks. The temptation to “just open Modbus port 502” or “enable RDP port forwarding” to access an HMI is real—but it’s one of the most dangerous practices in connected OT.

Thousands of industrial devices are listed on Shodan (a search engine for services exposed on the Internet), with their Modbus registers directly accessible without authentication. In 2021, an attacker altered the chlorine levels at a water treatment plant in Florida via direct TeamViewer access.

The 4G router with built-in VPN solves this problem at its source: the VPN is enabled by default, the OT network is never exposed to the Internet, and remote access is secured through authentication and encryption.

How a 4G + VPN Router Works

Advantages of a Built-in VPN vs. an External VPN

Criterion	VPN built into router	Separate external VPN
Number of devices	1	2 (router + VPN device)
Configuration	Single (all-in-one)	Dual (router + VPN)
Cabinet space	Minimal	Double
Single point of failure	1	2
Active VPN guarantee	Yes (built-in firmware)	To be verified
Cost	Lower	Higher
Maintenance	Only one device to update	Two

Zero-Touch Provisioning: Deployment Without a Network Technician

The main operational advantage of a 4G router with an integrated VPN is zero-touch provisioning: the router leaves the factory with its configuration preloaded (APN, VPN settings, certificates). On-site, the technician simply plugs in the power and connects the field equipment. Within 3 to 5 minutes, the router is connected, the VPN is established, and the site is visible in the cloud platform.

No need to connect to the network service, no manual IP address configuration, and no need to manage VPN certificates. That’s what makes it possible to deploy 50 sites in just a few days.

The Eziwan Approach

The Eziwan Gateway is a 4G router with built-in VPN (OpenVPN + IPSec), dual M2M SIM support, a native RS-485 port, and zero-touch provisioning. The VPN is enabled by default upon first startup, with certificates automatically generated and deployed from the Eziwan Cloud.

For more information: Secure Industrial VPN, Remote Access to Industrial PLCs, and Remote Access Without Port Forwarding.

Frequently Asked Questions

Industrial 4G RouterEverything You Need to Know About 4G Routers for Field Locations.Learn more Secure Industrial VPNVPN Architecture for OT Networks.Learn more Remote Access to the PLCAccess the PLCs via the Internet.Learn more Dual-SIM 4G RouterCombine 4G dual SIM and VPN.Learn more Remote Access Without Port ForwardingPure outbound VPN architecture.Learn more Eziwan GatewayThe Eziwan All-in-One 4G + VPN Gateway.Learn more

Connectivity AND Security: Why It’s a Mistake to Separate Them​

How a 4G + VPN Router Works​

Advantages of a Built-in VPN vs. an External VPN​

Zero-Touch Provisioning: Deployment Without a Network Technician​

The Eziwan Approach​