OpenVPN for Industry: The VPN That Simplifies Remote OT Access

· 10 min read
10 min read
Eziwan Team
Eziwan Team
IoT Infrastructure

Industrial technicians spend an average of 2.3 hours traveling for each service call on remote equipment. A reliable VPN completely changes the equation. But not all VPNs are created equal—and OpenVPN remains the robust, universal standard for OT environments.

Criteria for an Industrial VPN​

Whether in a factory or at a remote location, a VPN must meet requirements that are not encountered in office environments:

  • Traversing firewalls and carrier NATs: On a 4G connection, the address is private and behind the carrier’s NAT. The VPN must be able to establish a connection using outbound traffic only, without any inbound ports.
  • Reconnection after a network outage: SCADA monitoring runs continuously; the tunnel must re-establish quickly after a SIM switch.
  • Audited and revocable security: strong encryption, mutual authentication, and individual access revocation for NIS2 / IEC 62443 compliance.
  • Easy deployment: no manual network configuration required at each site.

OpenVPN: The Proven Standard​

OpenVPN is an open-source protocol that has been refined over more than 20 years and has become a de facto standard for secure remote access. It is based on the TLS/SSL stack and meets all industry requirements.

OpenVPN Cryptography​

  • Encryption: AES-256-GCM (AEAD — authenticated encryption)
  • Authentication: X.509 certificates, using mutual TLS (each end proves its identity)
  • Integrity: SHA-256
  • Transport: UDP 1194 or TCP 443 (configurable)

The Decisive Advantage: Crossing Firewalls​

This is where OpenVPN really stands out in practice: it can encapsulate the tunnel within TLS on TCP port 443—the same port as HTTPS. As a result, it gets through where other protocols are blocked: ISP firewalls, corporate proxies, and deep packet inspection (DPI). On the website’s end, no public IP address or incoming port is required: the gateway initiates the connection outbound.

Performance on Industrial Hardware​

Here is a benchmark result from the Eziwan Gateway (ARM Cortex-A7 processor, 1 GHz):

ProtocolEncrypted SpeedReconnectionFirewall Pass-Through
OpenVPN (AES-256-GCM)~45 MbpsFast (persist-tun)Excellent — TCP 443
IPSec IKEv2 (AES-256)~90 MbpsVirtually transparent (MOBIKE)Average (NAT-T)
L2TP / PPTPVariableSlowVariable

In practice, a bandwidth of a few Mbps is more than enough for Modbus data collection, MQTT telemetry, and remote access to a PLC. The decisive factor is not the raw bandwidth but the reliability of the tunnel connection—and that is precisely OpenVPN’s strength.

Deployment in an industrial hub-and-spoke topology​

For a network of industrial sites, the hub-and-spoke topology is the most common:

Each site has its own Eziwan Gateway with a unique X.509 certificate. The hub (hosted by Eziwan or within your infrastructure) maintains connections for all sites.

Configuration on the Eziwan Gateway​

Using the Eziwan cloud interface, the setup process is as follows:

  1. Name the tunnel (vpn-paris-usine-01)
  2. Select the hub (vpn.eziwan.com or your own endpoint)
  3. Define the local network to be advertised (192.168.1.0/24)
  4. Enable the tunnel

Eziwan automatically generates the client certificate and configures the hub. No need to manually manage a PKI or manually renew certificates.

Manual Configuration (for purists)​

If you prefer to have full control, here is the OpenVPN configuration for the remote site:

client
dev tun
proto udp
remote vpn.votre-infra.com 1194
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
keepalive 10 60          # ping 10 s, restart after 60 s
persist-tun
# Server-pushed subnets: 10.10.0.0/16, 192.168.0.0/16
<ca>...</ca>
<cert>...</cert>
<key>...</key>

The keepalive 10 60 is important for 4G: carriers' NATs close inactive UDP connections after 30–60 seconds. This regular ping prevents the connection from being closed.

Enhanced Security for OT Environments​

OT/IT Network Segmentation​

OpenVPN with Eziwan allows for strict segmentation:

  • The tunnel exposes only explicitly routed subnets (route directives)
  • OT traffic (Modbus, DNP3) never leaves the network—it travels exclusively through the encrypted tunnel
  • PLCs cannot initiate connections to the Internet
  • Each technician has their own certificate with their own permissions

Authentication Using an X.509 Certificate​

Unlike VPNs that rely solely on a password, OpenVPN uses X.509 certificates for mutual TLS authentication. As a result:

  • No brute-force attacks on passwords
  • No phishing for credentials
  • Immediate revocation of access: addition of the certificate to the CRL on the concentrator side

Zero Trust and audit logs​

Eziwan logs each VPN connection with the following information:

  • Connection/disconnection time
  • Source IP address
  • Gateway and technician IDs
  • Amount of data transferred

These logs can be viewed on the cloud platform and exported for your security audits.

Use Case: Remote Access to a Siemens S7 PLC​

A typical scenario: Your S7-1200 PLC is on the 192.168.1.0/24 network at the Lyon site. You are at the office in Paris.

Without Eziwan: on-site deployment, or setting up risky port forwarding on the site's router (HTTPS 443 → port 102 S7 — direct exposure to the Internet).

With Eziwan:

  1. A permanent OpenVPN connection between the Lyon site and your office
  2. From TIA Portal, enter 192.168.1.10 (the PLC’s local IP address)
  3. The connection goes through the encrypted tunnel—the PLC responds as if you were on the local network
  4. No ports are open to the Internet; no exposure

Setup time: 15 minutes. Cost of a trip avoided: €450.

Final Comparison: Which VPN Should You Choose?​

CriterionOpenVPNIPSec (IKEv2)L2TP / PPTP
Firewall bypass⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐
Fast reconnection⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐
Security / Encryption⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐
Ease of Setup⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐
Certifications (FIPS)⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐
Legacy compatibility⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐

For most enterprise deployments, OpenVPN is the default choice: universal, auditable, and capable of bypassing all firewalls. IPSec (IKEv2) takes over in regulated environments (FIPS 140-2) or when a completely transparent reconnection during Dual SIM failover is required. Eziwan supports both.

Conclusion​

OpenVPN isn't the newest protocol, but it is the most robust and universal: AES-256-GCM encryption, mutual certificate-based authentication, and, above all, unmatched firewall traversal thanks to TCP port 443. For the industry, its most valuable advantage remains its ability to establish a tunnel from any 4G network, without exposing any ports.

The Eziwan Gateway enables OpenVPN by default on all new deployments. In 15 minutes, your industrial site can be accessed remotely and securely, without any open ports on the Internet.

Why a Consumer VPN Isn't Suitable for the Industry​

The popularity of consumer-grade VPNs (NordVPN, Proton VPN, and the like) often leads to confusion among decision-makers: “We already have a VPN.” However, these services address a radically different need—anonymizing a person’s browsing activity—and they lack everything that defines an enterprise-grade VPN:

  • No site-to-site: They connect a user to the Internet, not a network of machines to a monitoring platform.
  • No machine certificates: Authentication is tied to a personal account, which cannot be deployed on a router in an electrical cabinet.
  • No controlled CGNAT traversal: On an industrial 4G link, the equipment is behind the operator’s NAT; only a tunnel initiated outbound by the equipment (OpenVPN on UDP 1194 or TCP 443) works reliably.
  • No audit logging: no actionable logs available for a NIS2 or IEC 62443 audit.
  • No segmentation: it is impossible to restrict a service provider to a single PLC.

The role of an industrial VPN is specific: to encrypt traffic between sites and the cloud, authenticate each end point using an X.509 certificate, and carry Modbus, S7, or OPC-UA traffic without ever exposing it to the Internet. It is an infrastructure component, not an anonymization service.

Checklist for Deploying an OpenVPN Industrial VPN​

  1. Connection Direction: Tunnel initiated by the site’s gateway; no incoming ports are open on the firewall.
  2. Transport: UDP 1194 by default; falls back to TCP 443 to traverse the most restrictive networks.
  3. Cryptography: AES-256-GCM, TLS 1.2 minimum, deprecated algorithms disabled (DES, RC4, MD5).
  4. Authentication: A unique X.509 certificate per device—never a shared key between sites.
  5. User Accounts: MFA required, one named account per technician, no shared accounts.
  6. Least Privilege: Access granted per device and per time slot; no permanent “entire network” access.
  7. Revocation: Tested procedures (for contractor departure, equipment loss) and scheduled certificate rotation.
  8. Logging: Each session is logged (who, when, which device, duration), and logs are exportable for auditing.

FAQ​

Is WireGuard more secure than OpenVPN for an enterprise deployment? WireGuard has a significantly smaller attack surface (~4,000 lines of code vs. ~100,000 for OpenVPN), which reduces the risk of exploitable vulnerabilities. However, OpenVPN has a much longer history of security audits and is more easily auditable by certification bodies. For environments requiring FIPS 140-2 certification, IPSec/IKEv2 remains the standard. For the majority of industrial deployments, both OpenVPN and WireGuard are solid choices.

Are L2TP and PPTP still usable in an industrial environment? No. PPTP has been cryptographically broken since 2012—do not use it. L2TP alone is also insecure (no native encryption); L2TP/IPSec is acceptable but more complex than OpenVPN/IKEv2. If your existing equipment only supports L2TP/PPTP, plan to replace it—this is not a secure configuration for industrial OT networks.

How does the VPN handle intermittent 4G outages? OpenVPN with keepalive 10 60 and persist-tun attempts to reconnect automatically as soon as connectivity is restored. With IPSec/IKEv2 + MOBIKE, the tunnel survives even when the public IP address changes (during a Dual SIM failover). In both cases, the reconnection time is 5 to 30 seconds—acceptable for monitoring, but insufficient for real-time control.

Further Reading​

Are you deploying remote access solutions at industrial sites? Contact our team for a technical demo.

Additional Resources​