Secure Remote Access: How Technicians Can Work at Industrial Sites Without Traveling There
Each on-site visit costs between €150 and €500, depending on the distance. With 80 sites, reducing unnecessary visits by 30% results in significant savings. The key: reliable, secure, and 24/7 remote access.
The Challenge of Remote Maintenance in Industrial Settings
Remote access in an industrial environment poses specific challenges:
Lack of network infrastructure: Most remote industrial sites have neither fiber nor ADSL. An LTE connection is the only available option.
Mobile Carriers and NAT: SIM cards from mobile carriers use NAT (Carrier-Grade NAT). It is not possible to open incoming ports—the device does not have a directly accessible public IP address.
OT Security Requirements: PLCs and SCADA systems must never be directly exposed to the Internet. Even a single open port is a potential attack vector.
24/7 Availability: If a pump fails at 2 a.m., it must be diagnosed without having to wait for the office to open.
Zero-inbound-port architecture
The Eziwan solution is based on a fundamental principle: the field device always initiates the connection to the cloud. Never the other way around.
Advantages of this architecture:
- No open ports on the LTE network (compatible with carrier NAT)
- PLCs and HMIs are never directly exposed to the Internet
- Access always requires Eziwan authentication
- Comprehensive audit logs (who, when, how long)
4-Step Setup
1. Set up the VPN profile on your laptop
From the Eziwan dashboard:
- Settings → VPN Access → Download OpenVPN Profile
- Import the
.ovpnfile into your OpenVPN client - Enable the tunnel
client
dev tun
proto udp
remote vpn.eziwan.com 1194
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
keepalive 10 60
persist-tun
# Routes pushed by the server: 10.24.0.0/16, 192.168.0.0/8
# Client certificate automatically injected by Zero-Touch Provisioning
2. Accessing Your Field Equipment
Once the VPN is active, you can access the site's local IP addresses directly:
# Diagnosing Connectivity
ping 192.168.1.10 # PLC Siemens
→ 26ms — round trip via LTE + VPN
# SSH Access to an Edge Module
ssh admin@192.168.1.15
→ Connected to Eziwan edge (Eziwan Gateway-Lyon-04)
# Remote SCADA Access
# Open your SCADA software (Codesys, TIA Portal, SoMachine) directly
# and set it to the PLC's local IP address: 192.168.1.10
# The VPN handles the rest transparently
3. Granular Access Control
Configure who can access what:
| User Profile | Authorized Sites | Protocols |
|---|---|---|
| Field Technician | Their sector only | SSH, RDP |
| Process Engineer | All sites | SSH, RDP, SCADA |
| SCADA Read-Only | All sites | Port 502 (Modbus TCP) only |
| IT Admin | All sites | All protocols |
Dashboard → Settings → Users → VPN ACL
4. Audit Log
Each VPN session is automatically logged:
2025-06-15 14:23:11 Lucas M. — Eziwan Gateway-Lyon-04 — Connexion VPN
2025-06-15 14:47:32 Lucas M. — 192.168.1.10 (TIA Portal) — TCP 102
2025-06-15 15:12:05 Lucas M. — Eziwan Gateway-Lyon-04 — Offline (48 min)
CSV export available for your compliance audits (NIS2, ISO 27001).
Remote Access via Satellite: When 4G Doesn't Provide Coverage
For truly remote locations—high-altitude quarries, logging sites, islands, and high-mountain weather stations—LTE coverage may be nonexistent or insufficient. In such cases, satellite is the only option.
Starlink Industrial: A New Paradigm for Extremely Remote Locations
Starlink (SpaceX) has revolutionized satellite Internet access with its LEO (Low Earth Orbit) network. Compared to traditional geostationary satellites (VSATs), the performance is radically different:
| Criterion | Geostationary VSAT (conventional) | Starlink LEO | 4G LTE (reference) |
|---|---|---|---|
| Latency | 500–700 ms | 20–60 ms | 10–50 ms |
| Download speed | 5–20 Mbps | 50–200 Mbps | 10–150 Mbps |
| Availability | 99% | 99% | 99.5% (dual SIM) |
| Hardware cost | €3,000–8,000 | ~€350 (antenna) | ~€200–500 (router) |
| Subscription | 150–500 €/month | 50–200 €/month | 10–30 €/month |
| Requirements | Satellite line of sight, flat terrain | Clear sky | Carrier coverage |
Starlink for Industrial Remote Access: With a latency of 20–60 ms, Starlink is compatible with OpenVPN, TIA Portal, and SoMachine VPN sessions, as well as SCADA interfaces—where a 600-ms VSAT made such access virtually unusable. The Eziwan Gateway integrates downstream from the Starlink terminal via its Ethernet WAN port.
Important Limitations: The Starlink antenna requires a line of sight of approximately 100° × 100°. Performance may be degraded in dense forests, at the bottom of steep valleys, or inside a metal building without windows facing the sky. An on-site positioning test is recommended before final installation.
Typical architecture: LTE as primary + Starlink as backup
For locations with marginal (<-100 dBm RSRP) but existing LTE coverage:
WAN principal : LTE 4G SIM1 + SIM2 (dual SIM Orange + SFR)
WAN backup: Starlink (triggered if LTE has been down for more than 10 minutes)
This architecture covers 99.99% of failure scenarios, including solar storms that can simultaneously disrupt multiple radio frequencies.
Multi-factor authentication and session management
Remote access without MFA is a security vulnerability, regardless of the quality of the VPN. The Eziwan Gateway incorporates several strong authentication mechanisms:
MFA for the User VPN Session
Authentification :
Step 1 → Personal X.509 certificate (linked to the user's laptop)
Step 2 → TOTP (Time-based One-Time Password) via Google Authenticator or Authy
Result → VPN tunnel established only if both factors are validated
The certificate can be revoked immediately from the dashboard without affecting the user account—which is useful when a technician leaves.
Checking Active Sessions
| Feature | Operational Benefit |
|---|---|
| Maximum session duration | Automatic logout after N hours (prevents forgotten tunnels) |
| Authorized Time Slots | Access limited to 7 a.m.–8 p.m., Monday through Friday |
| Authorized Source IPs | Access only from the service provider’s offices |
| Two-step approval | A supervisor must approve access before the technician logs in |
| Real-time alert | SMS/email sent to the technical manager each time a session is opened |
These controls can be configured by site, by user, and by type of equipment accessed—allowing for different rules for a junior technician (limited access, enhanced monitoring) and a senior engineer (full access).
Comparison: Eziwan VPN vs. TeamViewer vs. AnyDesk for Industrial OT
| Criterion | Eziwan VPN | TeamViewer Industrial | AnyDesk |
|---|---|---|---|
| Architecture | Zero-inbound, outbound tunnel | Outbound connection (cloud relay) | Outbound connection (cloud relay) |
| NIS2 Compliance | ✅ Comprehensive audit logs, hosted in France | ⚠️ Basic logs, servers in Germany/US | ❌ Limited logs |
| Access to industrial protocols | ✅ Native (Modbus TCP, TIA Portal, SCADA) | ✅ Via RDP on SCADA station | ✅ Via RDP on SCADA station |
| Full network access | ✅ Full IP access to the LAN | ❌ Per-machine access | ❌ Per-machine access |
| Individual certificates | ✅ X.509 per user | ✅ Account per user | ✅ Account per user |
| Instant revocation | ✅ Certificate revocation < 1 min | ✅ Account deactivation | ✅ Account deactivation |
| Hosting in France | ✅ France only | ⚠️ Germany + US | ❌ Outside the EU possible |
| Cost | Included in the gateway subscription | €800–2,400/year | €150–500/year |
| OT Compatibility | ✅ Designed for OT | ⚠️ Designed for IT (adapted for OT) | ❌ Not suitable for OT |
Conclusion: TeamViewer and AnyDesk allow you to remotely control a Windows machine (SCADA station, supervision PC) but do not provide direct network access to PLCs, sensors, and fieldbuses. An industrial VPN like Eziwan provides access to the site’s entire OT network—the technician can access the PLC’s IP address directly from their line-of-business software, without any intermediaries.
Case Study: Troubleshooting a Hydraulic Press
Situation: Friday, 10:00 p.m. — "Hydraulic pressure out of range" alert at the Valenciennes site.
No remote access: Technician on-site the next morning, production halted for 10 hours, cost ~€600.
With Eziwan VPN:
- The technician receives an SMS alert on their phone
- Activates the OpenVPN client on their laptop
- Opens TIA Portal and connects to the Siemens S7-1200 PLC (192.168.1.12)
- Diagnosis: pressure sensor malfunctioning—value stuck at 45 bar
- Resets the sensor module via the maintenance function block
- Pressure returns to normal—process restarted
- Incident report created from the Eziwan dashboard
Resolution time: 22 minutes. Production resumed at 10:35 p.m.
ROI of Remote Access
For a portfolio of 80 industrial sites, with an average of 3 on-site visits per site per year:
| Scenario | Annual Cost |
|---|---|
| All on-site service calls | 80 × 3 × 300 € = 72,000 € |
| 50% resolved remotely (Eziwan VPN) | 80 × 1.5 × 300 € + subscription = ~40,000 € |
| Annual savings | ~32,000 € |
Not to mention the reduction in downtime: every hour of production gained at 2 a.m. can be worth thousands of euros.
Security: What We Do Not Allow
To avoid common best practices:
| Risky Practice | Eziwan Alternative |
|---|---|
| Direct port forwarding (exposed SSH/RDP) | OpenVPN/IPSec VPN with zero inbound traffic |
| Sharing VPN credentials among technicians | Individual keys per user |
| Permanent access without audit | Logged sessions + configurable timeout |
| Access from any IP address | Optional source IP restriction |
FAQ
Can you access a remote site over 4G without a static IP address? Yes. The Eziwan model works on the principle of outbound connection initiation: the on-site gateway opens a VPN tunnel to a cloud hub with a static IP address. The site’s public IP address does not need to be static—the tunnel is established from the site to the cloud, not the other way around. This even works behind a carrier NAT.
How can you prevent a remote technician from accessing equipment they are not authorized to access? The Eziwan platform manages access rights on a per-user and per-site basis. Each technician has their own personal VPN certificate—if their access is revoked, their certificate is immediately invalidated without affecting other users. You can also restrict access to specific time periods or specific source IP addresses.
Does the VPN interrupt communication between the PLC and its local control system? No. The gateway operates in parallel: it does not interrupt local communications (the PLC communicates normally with its local HMI). The VPN is added as an additional remote read/write access point, without interfering with the local control loop.
Further Reading
- Blog: Secure Remote Access for PLCs and SCADA — VPN, Zero-Trust, and NIS2
- Blog: WireGuard vs. OpenVPN vs. IPSec — A Comparison for Industrial OT
- Blog: Industrial Router Fleet Management — Monitoring and OTA Updates
- Docs: VPN Configuration on the Eziwan Gateway
Set up your VPN → · Schedule a demo →
Additional Resources
- Internet Connectivity for Remote Industrial Sites — 4G connectivity solution for sites without fixed infrastructure
- Remote Site Solution — monitoring and remote access for remote sites and areas without coverage
- Guide to Monitoring Remote Sites — best practices for monitoring off-grid facilities
- Industrial Connectivity — rugged connectivity solutions for industry
- Guide to Connectivity in Areas Without Network Coverage — choosing the right technology for areas without wired coverage
