Technical Architecture
Eziwan is a full-stack platform that manages the entire industrial IoT connectivity chain—from the field sensor to your monitoring dashboard.
The 3 Layers of Eziwan
Field Components — Eziwan Gateway
Hardware Specifications
| Component | Specification |
|---|---|
| LTE Modem | 4G Cat 6 — 300 Mbps DL / 50 Mbps UL |
| SIM | 2× Nano-SIM — Automatic failover |
| Wi-Fi | 802.11 b/g/n/ac — 2.4 GHz + 5 GHz |
| RS485/RS232 | DB9 + terminal block — 115,200 baud max |
| Ethernet | 2× 10/100/1000 Mbps (WAN + LAN) |
| Temperature | −40°C to +75°C (operating) |
| Power Supply | 9–30V DC — terminal block |
| Mounting | 35 mm DIN rail or M4 screws |
| Protection | IP30 · CE Certified · RoHS |
| Embedded OS | OpenWRT (Linux) — OTA updates |
Fundamental Security Principle — Zero Inbound
All traffic is outbound only from the router to the cloud. No incoming ports are exposed on the LTE interface.
- ✗ No incoming ports open on the router side
- ✗ No fixed public IP address required on the site side
- ✓ Compatible with the mobile carrier's NAT
- ✓ No direct exposure to the Internet
This radically simplifies security and bypasses mobile carriers' NAT restrictions.
LTE Transport — Dual SIM Failover
Normal Connection Flow
Automatic Failover Sequence
T+0s SIM1 RSRP drops below -100 dBm
T+8s Watchdog: 3 consecutive failed pings detected
T+10s Failover decision — SIM2 activated
T+15s SIM2 obtains an LTE IP
T+18s OpenVPN tunnel renegotiated on SIM2
T+28s VPN restored — monitoring normal
⏱ Interruption totale : < 30 secondes
Monitoring Parameters
| Parameter | Default Value | Configurable |
|---|---|---|
| Ping watchdog | Every 3 seconds | Yes |
| Consecutive KO threshold | 3 pings | Yes |
| Minimum RSRP for SIM1 | -100 dBm | Yes |
| SIM1 recovery time (after restoration) | 10 min | Yes |
Safety
Encryption in Transit
| Channel | Protocol | Algorithm |
|---|---|---|
| VPN | OpenVPN | AES-256-GCM (AEAD) |
| Alternative VPN | IPSec (IKEv2) | AES-256 / SHA-2 |
| MQTT | TLS 1.3 | Mutual client certificate |
| Dashboard | HTTPS | TLS 1.3 + HSTS |
| API | HTTPS + Bearer | TLS 1.3 |
Certificate Management
TLS certificates are generated automatically during provisioning and renewed automatically every 90 days via Let's Encrypt. No manual management is required.
OpenVPN certificates are rotated with each reprovisioning and can be manually regenerated from the dashboard (immediate revocation).
Multi-tenant isolation
Each tenant is isolated within its own VPN network space. Client router A can never communicate with client router B.
High Availability in the Cloud
The Eziwan platform is hosted in France by OVHcloud:
| Aspect | Configuration |
|---|---|
| Primary Data Center | Roubaix (RBX) |
| Secondary Data Center | Gravelines (GRA) |
| Strategy | Active-Active Multi-AZ |
| Cloud SLA | 99.9% uptime guaranteed |
| Backups | Snapshots every 6 hours, 30-day retention |
| Monitoring | Prometheus + Grafana, 24/7 internal alerting |
| GDPR | Data hosted exclusively in France |
Complete Data Flow
Modbus RTU Data Collection → Dashboard
Remote VPN Access
Reference Latencies
| Operation | Typical Latency |
|---|---|
| LTE ping → France cloud | 20–45 ms |
| Full SIM failover | 10–30 seconds |
| Alert after field event | < 5 seconds |
| Modbus polling → MQTT cloud | Configurable (5s to 24h) |
| Zero-Touch Provisioning | 1–3 minutes |
| Configuration deployment from dashboard | 30–60 seconds |
| OTA firmware reboot | 3–5 minutes |
Frequently Asked Questions
Where is the data hosted?
On cloud infrastructure located in France, with encryption at rest and in transit. This location simplifies GDPR compliance and meets the sovereignty requirements of operators of critical infrastructure.
How does the gateway connect to the cloud?
Still on the outgoing side: the gateway establishes an encrypted tunnel (VPN) to the platform via 4G/LTE or Ethernet. No incoming ports are open at the site, and the field devices remain invisible from the Internet.
What happens in the event of a network outage?
The gateway buffers the timestamped data locally (with several days of battery life) and automatically retransmits it once the connection is restored. Configured local alerts continue to function even without an Internet connection.
Is the architecture compatible with NIS2 and IEC 62443?
Yes: outbound connections only, zone segmentation, strong authentication, least privilege, and audit logging are the technical measures required by these standards.
Related Resources
- Eziwan REST API — Integrate the platform into your IT system
- Industrial IoT Solution — The gateway + connectivity + cloud offering
- Industrial IoT Gateway — the field component of the architecture
- Industrial Data Hosting in France — data sovereignty and NIS2
- Industrial VPN — secure end-to-end data transmission