How to Secure an Industrial OT Network in 2025: Segmentation, VPN, and NIS2 Compliance

· 8 min read
8 min read
Lucas Moreau
Lucas Moreau
OT/IT Network Engineer

OT (Operational Technology) networks have long been considered “secure by isolation.” That model is a thing of the past. With LTE connectivity, remote maintenance, and cloud-based monitoring, your PLCs and SCADA systems are now accessible from outside the network—whether intentionally or not.

The NIS2 Directive (effective October 2024) imposes cybersecurity requirements on operators of critical infrastructure and providers of essential services. If you manage critical infrastructure, this applies to you.

The 5 Most Common OT Risks​

1. Port 502 (Modbus TCP) exposed to the Internet​

A Shodan scan is all it takes to find tens of thousands of Modbus TCP devices that are directly accessible from the Internet. Without authentication, anyone can read—and sometimes write to—your registers.

2. Direct RDP/SSH Access to Field Equipment​

Opening an RDP or SSH port to a HMI or PLC to enable remote maintenance exposes the equipment to brute-force attacks. Ransomware targeting industrial systems often enters through this gateway.

3. Unsegmented OT/IT Network​

A network in which PLCs, supervisory PCs, and desktop PCs share the same VLAN allows ransomware to spread laterally from a desktop computer to production PLCs.

4. Default Passwords​

PLCs, routers, and cameras that come with factory-set passwords ("admin/admin," "1234")—which are rarely changed—represent an easy attack vector.

5. Lack of connection monitoring​

Without logging remote access, an intrusion could go unnoticed for weeks.

OT/IT Segmentation — The Top Priority​

The OT zone must never be directly accessible from the Internet or the IT zone. Only the DMZ may initiate connections to the OT zone, after authentication.

OpenVPN/IPSec VPN: Secure Remote Access​

OpenVPN is the recommended VPN protocol for industrial environments in 2025. Its advantages:

  • Controlled attack surface: proven TLS stack and mutual authentication using X.509 certificates
  • Modern cryptography: AES-256-GCM, ECDHE, SHA-256
  • Public-key authentication only—impossible to brute-force
  • Resilience: the tunnel automatically reestablishes itself after a network outage
Golden Rule for Industrial VPNs

The VPN must operate in split-tunnel mode: only traffic to OT networks should pass through the tunnel. The technician’s Internet traffic must not pass through your infrastructure.

Eziwan Configuration — Zero Incoming Ports​

Eziwan implements a outbound-only security model: the field router establishes an encrypted connection to Eziwan's cloud servers. No incoming ports are open on the local network.

# Verification from a field device:
$ netstat -an | grep LISTEN
# → Expected result: no lines containing 0.0.0.0:* or :::*
# The router is not listening on any incoming ports from the Internet

This architecture prevents port-scanning attacks, exploits of exposed services, and network reconnaissance.

NIS2 Compliance Checklist​

The NIS2 Directive requires, in particular:

  • Access Management: multi-factor authentication for all remote access
  • Logging: retention of access logs for at least 12 months
  • Segmentation: Isolation of OT networks from IT networks and the Internet
  • Encryption: Encryption of communications in transit
  • Incident Management: Notification of significant incidents within 24 hours
  • Third-Party Management: audit of the supply chain (suppliers, integrators)
  • Backup: backup and disaster recovery plan

What Eziwan Covers​

NIS2 RequirementEziwan Coverage
Encryption in TransitOpenVPN AES-256-GCM ✓
Access LoggingTime-stamped VPN logs retained for 12 months ✓
Strong AuthenticationPublic keys + certificates ✓
OT IsolationZero incoming ports, separate VLAN ✓
Sovereign HostingOVHcloud France, ISO 27001 ✓
Configuration AuditConfiguration change history ✓

Security Audit: 3 Immediate Steps​

1. Scan your exposed equipment​

# From your local network — identify open ports
nmap -sV -p 502,4840,102,20000 192.168.1.0/24

# Common industrial ports to check:
# 502  → Modbus TCP
# 4840 → OPC-UA
# 102  → S7 (Siemens)
# 44818 → EtherNet/IP

2. Check the default passwords​

Check the default-password.info database for your device model numbers. Always change the manufacturer-set passwords.

3. Enable connection alerts​

Configure Eziwan to immediately alert you to any VPN connection made outside of normal hours or from an unknown IP address.

Industrial VPN vs. Makeshift Solutions​

Many sites “secure” their remote access using tools that were never designed for OT. The following table compares the approaches most commonly encountered during audits:

ApproachInternet ExposureTraceabilityOT SegmentationVerdict
Exposed RDP/VNC + port forwardingPublic port constantly scannedNoneNoneMust be disabled immediately
TeamViewer/AnyDesk on monitoring PCIndirect (pivot PC)Partial, out of controlNoneTolerated for occasional troubleshooting, never on a permanent basis
Inbound VPN on site router/firewallPublic VPN portDepends on configurationRarelyBetter, but attack surface remains
Outbound industrial VPN (Eziwan)Zero inbound portsComplete log per sessionAccess by deviceRecommended architecture, NIS2-compliant

The fundamental difference lies in the direction of the connection: in outbound architecture, the site’s gateway initiates the encrypted tunnel to the cloud. From the Internet’s perspective, the installation does not exist.

Example of an Eziwan Zero Inbound Port Architecture​

Control devices and OT equipment (segmented network) → Eziwan gateway → 4G/Ethernet connection (outbound only) → encrypted VPN tunnel (X.509 certificates) → Eziwan cloud → authenticated technicians (MFA), access by device, logged sessions.

Each component addresses a specific audit requirement: segmentation isolates the OT from the IT, the outbound tunnel eliminates the attack surface, MFA eliminates the risk of shared passwords, and logging provides the evidence required by NIS2.

The Most Common Errors Identified During Audits​

  1. "Temporary" access that became permanent: a port forwarding rule opened for manufacturer troubleshooting that was never closed.
  2. The shared account: a single username used by the entire team and contractors—no accountability, no possibility of revocation.
  3. The dual-connected monitoring PC: connected to both the OT network and the Internet, it bypasses all network segmentation.
  4. Unchanged manufacturer default passwords: PLCs, HMIs, and routers shipped with “admin/admin,” listed in public databases.
  5. Tested lack of revocation: Certificates and accounts belonging to former service providers remain valid years after the contract ends.

FAQ — OT Network Security and Industrial VPN​

What exactly is the role of a VPN in an industrial network?

It performs three functions: encrypting traffic between the site and the outside world (ensuring the confidentiality and integrity of industrial protocols, which are natively transmitted in plain text), authenticating both ends using certificates, and transmitting remote maintenance data streams without exposing the equipment to the Internet. The VPN is the foundation; device-based access control and logging round out the system.

Is a dedicated firewall required to segment OT and IT?

A dedicated firewall is the recommended solution for robust segmentation (Fortinet FortiGate Rugged, Cisco IR, Stormshield). However, for small and medium-sized enterprises (SMEs) without a dedicated IT department, segmentation via VLANs on a manageable switch (with strict inter-VLAN rules) is already a significant improvement over having no segmentation at all. The key is that traffic between OT and IT is filtered and not routed freely.

Is an online port scan sufficient to verify that no ports are exposed?

This is the first step. Use nmap -sV --open <IP_publique> or an online tool (Shodan, Censys) from outside the network. An open port 502 (Modbus), 102 (S7Comm), 44818 (EtherNet/IP), or 3389 (RDP) open on your public IP address is an immediate red flag. The audit must be repeated after every change to the network configuration.

Does NIS2 require a specific VPN or a particular type of encryption?

NIS2 does not prescribe any specific technology, but requires "appropriate measures" that are proportionate to the risk. In practice, the functional requirements (strong authentication, encryption in transit, audit logs) are met by OpenVPN with AES-256-GCM + X.509 certificates + MFA. Deprecated algorithms (DES, RC4, MD5) must be disabled.

What should you do if an OT controller needs to communicate with an ERP server (IT)?

Designing a unidirectional OT→IT data flow through a DMZ: OT data is pushed to an intermediary server in the DMZ, to which the IT ERP system connects. The OT network never receives incoming connections from the IT network. A data diode reinforces this unidirectional flow for the most critical installations.

Does OT/IT segmentation require a production shutdown to be implemented?

If the network is currently "flat" (OT and IT on the same switch), migrating to a segmented architecture requires a maintenance window. This can be prepared for gradually: define the target topology, configure the VLANs on a test switch, and schedule the switchover during a planned outage. For 24/7 operations, temporarily duplicating the infrastructure can enable a migration without downtime.

OT cybersecurity is no longer optional. NIS2 mandates it, and ransomware attacks targeting the industry confirm this. Eziwan is designed to help you comply without sacrificing availability.

Questions about NIS2 compliance? Let's talk about it with our team.

Additional Resources​