Zero Inbound Ports: The Only Acceptable OT Network Architecture in 2025

· 10 min read
10 min read
Lucas Moreau
Lucas Moreau
OT/IT Network Engineer

In 2025, having an open inbound port on an OT device connected to the Internet is a security breach—not a configuration that “needs improvement.” Attacks on industrial infrastructure have quadrupled since 2020. The security policy is clear: zero inbound ports, always.

The Reality of Cyberattacks on OT Networks​

Figures for 2024–2025​

The ICS (Industrial Control Systems) security reports are alarming:

  • +400% increase in OT security incidents since 2020 (Dragos 2024 report)
  • 67% of industrial incidents exploit an insecure remote connection
  • Average time before an OT intrusion is detected: 12 days
  • Average cost of an OT incident: €2.8 million (production downtime + remediation)

The targets are no longer just large industrial companies. Industrial SMEs, local governments, and water and energy providers are now in the crosshairs.

The Most Common Attack Vectors​

TOP 5 vecteurs d'attaque OT (2024) :

1. Unsecured remote access (outdated VPN, exposed RDP): 41%
2. Compromised credentials (phishing, password reuse): 28%
3. Unpatched firmware vulnerability: 19%
4. Lateral movement from IT to OT: 8%
5. Supply chain compromise : 4%

Result: The first two vectors account for 69% of incidents. And both are addressed by a single measure: the zero-inbound-port architecture with a modern VPN.

What an Inbound Port Is (and Isn't)​

The Fundamental Distinction​

OUTBOUND CONNECTION — secure:
  IT Equipment → [Carrier NAT] → Internet → Cloud Server
  The device is initiating the connection. No ports are open on the field side.

INBOUND CONNECTION — to be avoided:
  External operator → Internet → [open port] → OT equipment
  Someone from outside the network can initiate a connection to your device.

Virtually all industrial attacks exploit incoming connections—open ports accessible from the Internet.

Risky practices are still all too common​

PracticeRisk
RDP (3389) port forwarding on PLCDirect access to the PLC from the Internet
PPTP or L2TP VPN without strong authenticationVulnerable protocols, offline attack possible
Exposed HMI web server (ports 80/443)Publicly accessible control interface
SSH open on public IPBrute-force attacks, firmware CVE exploitation
TeamViewer / AnyDesk without controlsPermanent access, no audit trail

These setups are still in use at thousands of industrial sites in France—sometimes installed by system integrators 5 or 10 years ago and never reviewed since.

The Zero Inbound Port Architecture: How It Works​

The OpenVPN outbound-only principle​

OpenVPN elegantly solves the problem of ISP NAT (LTE SIM cards do not provide a directly accessible public IP address) while eliminating incoming ports:

What Happens: The gateway initiates an outbound UDP connection to the cloud hub. Once the tunnel is established, both parties can communicate—but from the outside, no one can initiate a connection to the gateway (no open ports).

WireGuard, OpenVPN, or IPSec?​

CriterionWireGuardOpenVPNIPSec/IKEv2
Attack surface (lines of code)~4,000~100,000Complex standard
Performance (encrypted throughput on ARM)Excellent (~48 Mbps)Good (~38 Mbps)Good (~40 Mbps)
Added latencyVery low (+2–4 ms)Moderate (+5–12 ms)Low (+4–8 ms)
Reconnection after LTE disconnection< 3s10–20s3–8s (MOBIKE < 2s)
Enterprise firewall traversal❌ UDP only✅ TCP 443❌ UDP only
ConfigurationSimpleReasonableComplex
FIPS 140-2 certification❌Partial✅

For standard deployments: OpenVPN (universal compatibility, Eziwan ZTP). For FIPS-regulated environments or transparent dual-SIM failover: IPSec + MOBIKE. For maximum performance on ARM: WireGuard. See our comprehensive industrial VPN comparison.

NIS2 Compliance and OT Security​

NIS2 Requirements for Operators of Critical Importance​

The NIS2 Directive (transposed into French law in 2024) requires operators of critical infrastructure to implement minimum security measures:

  • Strong authentication for all remote access
  • Encryption of communications for remote control and monitoring
  • Audit log of access (who, when, from where)
  • Vulnerability management — equipment updates
  • IT/OT separation — network segmentation

The zero-inbound-port architecture with OpenVPN meets all of these requirements.

Automatic Audit Log​

Eziwan automatically logs every VPN session:

AUDIT LOG — Export NIS2/ISO27001

2025-08-26 09:14:22  CONNECT   Lucas Moreau     Site: Pompage-Lyon-07  IP: 10.24.5.12
2025-08-26 09:17:45  ACCESS    Lucas Moreau     192.168.7.10 (PLC)   TCP:102
2025-08-26 09:43:12  ACCESS    Lucas Moreau     192.168.7.11 (IHM)   TCP:80
2025-08-26 09:58:01  DISCONNECT Lucas Moreau    Site: Pompage-Lyon-07  Duration: 43 min
2025-08-26 11:32:09  CONNECT   Sophie Renard    Site: Reservoir-Est-3  IP: 10.24.5.19
2025-08-26 12:05:44  DISCONNECT Sophie Renard   Location: Reservoir-Est-3  Runtime: 33 min

CSV export available for your compliance audits — can be reused directly in your NIS2 reports.

Migrating from an architecture with open ports​

Diagnosis: Identifying Open Ports​

Before migrating, assess your current exposure:

# Scan your public IP ranges from an external network
# (with the explicit authorization of your CIO)

nmap -sV -p 1-65535 <IP_publique_site>

# Typical results that require immediate correction:
# 22/tcp open  ssh    OpenSSH 7.2 (obsolete)
# 3389/tcp open  rdp    Windows RDP
# 502/tcp open  modbus Modbus TCP (JAMAIS exposer directement)
# 80/tcp open   http   IHM web

Every open port is a potential point of attack. The top priority is to close port 502 (Modbus TCP) and port 3389 (RDP) if they are exposed.

3-Step Migration Plan​

Step 1 — Deploy the VPN (1 day)

  • Install the Eziwan gateway
  • Configure OpenVPN for outbound-only traffic
  • Test remote access via VPN

Step 2 — Migrate Access (1 week)

  • Train technicians on the VPN client
  • Redirect all remote access through the VPN
  • Verify that everything is working

Step 3 — Close the Ports (1 day)

  • Remove the port forwarding rules from the router
  • Verify from the outside that the ports are closed
  • Document for the NIS2 audit

Download the OT Security Guide → · Schedule an audit of your architecture →

Conclusion​

The zero-inbound-port architecture is not just another security measure—it is a prerequisite for any OT deployment in 2025. Attacks are automated, constant, and specifically target open ports on industrial equipment.

OpenVPN outbound-only, combined with strong certificate-based authentication and comprehensive audit logging, meets NIS2 requirements while remaining easy to deploy—even across a network of several hundred sites.

The risk of leaving the port open is at its highest. The cost of closing it is minimal. There is no reason to wait.

How to Test Your Exposure in 10 Minutes​

Before starting any project, assess your current situation—it’s quick and often enlightening:

  1. Identify your public IP addresses: those of your modems, routers, and 4G connections with static IPs (your service provider or curl ifconfig.me from each site).
  2. Scan them from the outside: nmap -sV --open <IP_publique> from a third-party network, prioritizing ports 502 (Modbus), 102 (S7), 44818 (EtherNet/IP), 4840 (OPC-UA), 3389 (RDP), 5900 (VNC), and 1194/500 (inbound VPNs).
  3. Cross-reference with Shodan: search for your IP addresses on shodan.io—if your devices appear there, attackers have already indexed them.
  4. Identify “forgotten” access points: manufacturer-provided modems, 4G routers installed by a service provider, and historical port forwarding rules on the site’s router.

Any industrial port visible from the Internet is a potential incident: remediation (switching to an outbound tunnel) is planned on a site-by-site basis, starting with the most exposed sites.

The Role of the SIM Card in Zero-Inbound-Port Architecture​

An often-overlooked detail: on a 4G connection, the type of SIM card determines the site’s exposure. A SIM card with a fixed public IP address makes the router directly accessible—and scannable—from the Internet, which recreates the very problem we’re trying to eliminate. Conversely, an M2M SIM behind the carrier’s CGNAT—or better yet, on a private APN—makes the site inaccessible from the outside by design: only the outbound connection initiated by the gateway exists. A fixed public IP address should only be chosen for the rare legacy architectures that require it, and always behind a strict firewall.

FAQ — Zero-Inbound-Port Architecture​

Isn't an enterprise firewall with strict rules enough to protect an open port?

No, not entirely. An open port with filtering rules reduces the attack surface but does not eliminate it. The service listening on that port remains vulnerable to exploitation attempts (zero-day vulnerabilities, brute-force attacks, denial-of-service attacks). With a zero-inbound-port architecture, there is nothing to exploit on the external perimeter—the connection is always initiated from the inside.

How do technicians access the PLCs if no ports are open?

Through the outbound tunnel. The gateway establishes an OpenVPN connection to the Eziwan cloud (outbound connection, like an HTTPS web page). The operator logs into the Eziwan cloud using MFA and accesses the PLC through this already-established tunnel—without ever opening an incoming port on the factory network. The flow is opérateur → cloud Eziwan → tunnel gateway → automate.

What happens if Eziwan's cloud infrastructure is compromised?

The OpenVPN tunnel is authenticated using certificates on the gateway side—an attacker who compromises the cloud server would not be able to send traffic to the controllers without also possessing the client certificates. Furthermore, the gateway and client certificates are separate and can be revoked independently.

Is outbound OpenVPN traffic blocked by certain corporate networks?

OpenVPN runs on UDP 1194 by default. If this port is blocked (as is the case with some corporate networks or restrictive mobile carriers), Eziwan can switch to TCP 443 (the HTTPS port)—which is indistinguishable from standard web traffic and impossible to block without cutting off Internet access. This flexibility ensures a connection in virtually any network environment.

How long does it take to close all incoming ports on an existing site?

If a single traditional VPN (inbound port) is used and replaced by Eziwan, the process typically takes 30 to 60 minutes: install the gateway, connect it, validate the outbound tunnel, and close the inbound port on the firewall. If multiple legacy remote access solutions coexist (TeamViewer, RDP, IPsec VPN), allow 1 to 2 days to audit, migrate, and validate each access method.

Further Reading​

Secure your OT network with Eziwan → · Assess your NIS2 compliance →

Additional Resources​