Industrial VPN — OpenVPN / IPSec for Industry

Definition of a VPN​

A VPN (Virtual Private Network) is a technology that creates an encrypted communication tunnel between two remote points on a public network (the Internet, 4G/5G networks), ensuring the confidentiality and integrity of the data exchanged.

In an industrial setting, a VPN is the fundamental security building block that enables secure remote access to PLCs, RTUs, and OT equipment deployed at remote sites, without ever exposing that equipment directly to the Internet. Without a VPN, a PLC accessible via the Internet is an exposed target for any scanning, intrusion, or ransomware attempts.

The VPN also meets the requirements of industrial cybersecurity standards: IEC 62443, NERC CIP, and ANSSI’s recommendations for the protection of industrial information systems (IIS).

OpenVPN — Eziwan's default VPN​

OpenVPN is an open-source VPN protocol that has been proven over more than 20 years and has become a de facto standard for secure remote access. It is based on the TLS/SSL stack and AES-256-GCM encryption, with mutual authentication using X.509 certificates.

Why OpenVPN for the Industry​

  • Excellent firewall traversal: OpenVPN can encapsulate the tunnel within TLS on TCP port 443—the same port used by HTTPS—allowing it to bypass restrictions where other protocols are blocked (carrier firewalls, corporate proxies, DPI).
  • Robust, authenticated encryption: AES-256-GCM (AEAD) with mutual authentication via X.509 certificates—each technician has their own certificate, which can be revoked individually.
  • Fast reconnection after a 4G outage thanks to the persist-tun option, without a full tunnel renegotiation.
  • Maturity and compatibility: extensively audited code, widespread adoption, clients available on Linux, Windows, macOS, iOS, and Android.
  • Traceability: certificate revocation meets NIS2 and IEC 62443 audit requirements.

IPSec (IKEv2) — the enterprise alternative​

IPSec remains the standard in regulated environments that require FIPS 140-2-certified protocols. Its MOBIKE mechanism handles IP address changes in a virtually transparent manner—making it particularly well-suited for Dual SIM failover. Its configuration is more complex (PKI, X.509 certificates, SA policies), but it offers maximum interoperability with existing network equipment.

WireGuard — the next-generation protocol​

WireGuard is a modern VPN protocol designed with a focus on radical simplicity: ~4,000 lines of code (compared to ~100,000 for OpenVPN), and it has been integrated directly into the Linux kernel since 2020. Its key features:

  • Modern cryptography: Curve25519 (key exchange), ChaCha20-Poly1305 (symmetric encryption), BLAKE2s (hash). These algorithms are faster than AES on ARM processors without built-in AES-NI—which includes many embedded IoT gateways.
  • Ultra-low latency: no complex handshake (multi-round TLS handshake). The tunnel is established in a single exchange, with initial connection latency <100 ms.
  • Transparent reconnection: WireGuard is a stateless protocol on the server side. If the client’s IP address changes (failover from SIM1 to SIM2), there is no renegotiation—the tunnel is reestablished as soon as the first valid packet is received.
  • Reduced code = minimal attack surface: 4,000 lines of audited code, compared to 100,000 for OpenVPN. As a result, the risk of vulnerabilities is structurally lower.

Limitations for Industrial OT:

  • WireGuard operates only over UDP—unlike OpenVPN, which can run over TCP port 443. On some corporate networks that filter all non-standard UDP traffic, WireGuard may be blocked.
  • The client ecosystem (Linux, Windows, iOS, Android) is mature, but less widely available than OpenVPN clients.
  • No FIPS 140-2 certification — a deal-breaker for certain regulated markets (defense, nuclear).

The Eziwan Gateway also supports L2TP, PPTP, and GRE for legacy interoperability purposes.

Zero-inbound-port architecture​

Eziwan's industrial VPN architecture is based on the zero-inbound-port principle: no incoming ports are open on the remote site.

In this model:

  • The Eziwan gateway initiates the outbound connection to the Eziwan VPN server.
  • The remote site has no open TCP/UDP ports facing the outside.
  • An attacker cannot discover the remote devices through a network scan (they are not directly reachable from the Internet).
  • The operator accesses the remote devices via the VPN tunnel established by the gateway, under the control of Eziwan authentication.

This architecture complies with the recommendations of the IEC 62443 standard (cybersecurity of industrial automation and control systems) and the ANSSI guidelines.

Comparison: OpenVPN vs. IPSec vs. L2TP​

CriterionOpenVPNIPSec (IKEv2)L2TP / PPTP
EncryptionTLS, AES-256-GCM (AEAD)AES-256, SHA-2Weak (PPTP/MS-CHAPv2 not recommended)
AuthenticationX.509 certificate per clientPSK or X.509 certificatesUsername / password
Firewall / NAT traversalExcellent (TCP 443 works everywhere)Average (NAT-T required)Varies
4G Disconnection RecoveryFast (persist-tun)Excellent (MOBIKE)Slow
Configuration complexityModerate (.ovpn file)High (PKI, IKE, SA)Simple
CertificationsExtensively auditedFIPS 140-2Outdated (PPTP should be avoided)
OT/IoT CompatibilityRecommendedRegulated/InteroperableLegacy
CPU Usage (Gateway)ModerateLow (acceleration possible)Low

OpenVPN is the default recommended VPN technology for industrial IoT deployments: its ability to traverse firewalls via TCP 443, its AES-256-GCM encryption, and its certificate revocation make it a robust and auditable choice. IPSec (IKEv2) is preferred for regulated environments requiring FIPS 140-2 compliance or transparent reconnection during Dual SIM failover.

Automatic ZTP Configuration in Eziwan​

Eziwan's ZTP (Zero Touch Provisioning) automatically deploys and configures the OpenVPN VPN on a new gateway, without any manual on-site network intervention:

  1. The installer connects the Eziwan gateway to the network (via an Ethernet cable or a pre-installed 4G SIM card).
  2. The gateway automatically contacts the Eziwan servers using its pre-registered serial number.
  3. The Eziwan server pushes the VPN configuration (X.509 certificate, tunnel IP address, routes) to the gateway.
  4. The OpenVPN tunnel is established in a few seconds.
  5. The administrator receives a notification in the dashboard confirming that the site is online.

This process eliminates manual configuration errors and makes it possible to deploy hundreds of sites remotely without sending a network technician to each site.

Frequently Asked Questions​

What is the role of an industrial VPN?​

Encrypt data exchanges between sites, the cloud, and technicians; authenticate each end point using certificates; and transmit industrial protocols (Modbus, S7, OPC-UA) without ever exposing the equipment to the Internet.

OpenVPN or IPsec: Which One Should You Choose?​

OpenVPN natively traverses NAT on 4G networks (CGNAT) and easily handles X.509 certificates—it is the default choice for cellular sites. IPsec IKEv2 is suitable for fixed, end-to-end-secured connections.

Why not use a consumer VPN?​

Consumer-grade VPNs anonymize a user's browsing; they do not offer machine certificates, site-to-site connections behind 4G NAT, per-device segmentation, or audit logging—all of which are required for serious OT access.

Is a VPN Enough to Secure Remote OT Access?​

This is just the foundation, not the whole picture: we must also include least privilege (access based on device), MFA authentication, temporary sessions, and logging—the Zero Trust principles required by NIS2 and IEC 62443.