VPN Remote Access

Eziwan automatically creates an encrypted VPN tunnel between your field router and the cloud. This tunnel allows you to access all devices on the router's local network — from anywhere, without an open incoming port.

Zero-inbound-port architecture​

Key benefit: The field router initiates the connection to the cloud. No incoming ports need to be opened at the mobile operator's end. Compatible with all operator NATs.

Available Protocols​

CriterionDetails
EncryptionAES-256-GCM (AEAD)
AuthenticationX.509 certificate per client
PortUDP 1194 or TCP 443 (configurable)
Firewall traversalExcellent — TCP 443 gets through everywhere
Router CPUModerate
CompatibilityLinux, Windows, macOS, iOS, Android

IPSec (Enterprise Alternative)​

CriterionDetails
EncryptionAES-256 / SHA-2 (IKEv2)
ReconnectionExcellent — MOBIKE (transparent IP change)
CertificationsFIPS 140-2
Use CasesRegulated environments, interoperability with existing equipment

The Eziwan Gateway also supports L2TP, PPTP, and GRE for legacy interoperability.

Option 1 — Access from the Eziwan dashboard​

The fastest way to get one-time access.

  1. On the dashboard → click on a device
  2. Access tab → Log In
  3. Select the protocol (OpenVPN recommended)
  4. Eziwan generates a temporary profile (valid for 8 hours)

From the open session:

  • SSH → Linux device on the field LAN
  • HTTP/HTTPS → web interface (HMI, camera, manageable switch)
  • RDP → Windows industrial PC
  • Telnet / Modbus TCP → PLC, meter

Option 2 — Permanent VPN Profile on Your PC​

For daily access from your workstation.

Install OpenVPN​

Download the profile from Eziwan​

  1. Go to Settings → VPN Access → My Profile
  2. Select OpenVPN
  3. Click Download .ovpn Profile
  4. Import the file into your OpenVPN client
  5. Enable the tunnel

Example of a generated profile​

# Automatically generated by Eziwan on June 1, 2025
client
dev tun
proto udp
remote vpn.eziwan.com 1194          # Eziwan VPN Gateway — Roubaix (FR)
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
keepalive 10 60                    # ping 10 s, restart after 60 s
persist-key
persist-tun
verb 3
# Routes pushed by the server: 10.24.0.0/16, 192.168.1.0/24
# X.509 client certificate automatically injected by Zero-Touch Provisioning
<ca>...</ca>
<cert>...</cert>
<key>...</key>

Once you're logged in, you'll have direct access to the local IP addresses of the field site:

votre-pc:~$ ping 192.168.1.10
PING 192.168.1.10 — 22 ms   ← Siemens PLC on-site

your-pc:~$ ssh admin@192.168.1.15
Connected to Eziwan edge device (192.168.1.15)

Option 3 — Access from Your SCADA / ERP System​

To connect your central monitoring system to multiple field sites.

Only traffic to field networks goes through the VPN. Your normal Internet traffic uses your usual connection.

# OpenVPN Split Tunneling: Access to Field Sites, Direct Internet Traffic
route 10.24.0.0   255.255.0.0      # Eziwan Management Network
route 192.168.1.0 255.255.255.0    # Site Paris
route 192.168.2.0 255.255.255.0    # Site Lyon
route 192.168.3.0 255.255.255.0    # Site Bordeaux
route 192.168.10.0 255.255.255.0   # Site Marseille
# 'redirect-gateway' NOT enabled → the rest of the traffic goes directly through

Full-tunnel (all traffic routed through Eziwan)​

# Full-tunnel OpenVPN: All traffic goes through Eziwan
redirect-gateway def1

Useful if your corporate network requires all traffic to pass through a single exit point (compliance, audit).

Security and Access Control​

ACL by Device​

Restrict which users can access which routers:

UserAuthorized Access
Lucas (Technician)Paris and Lyon sites only
Sophie (Admin)All sites
SCADA-Read (Service)Read-only — port 502 (Modbus TCP)

Configuration: Settings → Users → Edit → VPN Access

Audit Log​

Every VPN connection is logged:

  • Date/time
  • User
  • Target device
  • Session duration
  • Source IP

CSV export available for your compliance audits.

Key Rotation​

Regenerate a user's or device's VPN keys from the dashboard → the old key is immediately revoked.

VPN Troubleshooting​

SymptomCauseSolution
Tunnel fails to establishUDP 1194 blockedAllow outbound UDP 1194, or switch to proto tcp port 443
High latency (>150 ms)LTE congestionNormal in high-density areas—test outside peak hours
Frequent disconnectionsInsufficient keepaliveReduce the interval from keepalive to 10 60
No access to field IPsMissing routeAdd the LAN subnet via an route directive
TLS handshake errorExpired certificateDownload a new profile from the dashboard
Site-to-Site Access

Do you want to connect two field sites to each other (without going through your PC)? Eziwan supports hub-and-spoke and mesh topologies between routers. Contact us → to configure this option.

Need help?

Frequently Asked Questions​

How do I access a site's equipment from my laptop?​

Install the OpenVPN profile generated by the console, log in with your account (MFA), and the site's network becomes accessible: you can ping the PLC, access the manufacturer's console, and use the device's web interface—just as if you were on the local network.

Can my central SCADA system connect to the sites via VPN?​

Yes: A permanent site-to-site tunnel connects the SCADA server to the networks at the remote sites. Modbus/DNP3 polling travels through the encrypted tunnel without being exposed to the Internet.

What is split tunneling, and should you enable it?​

It only routes the sites' subnets through the tunnel (the rest of the laptop's traffic exits normally). Recommended: This prevents your web traffic from passing through the platform and limits the scope of liability.

What should I do if the tunnel is up but the equipment isn't responding?​

Verify that the device's IP address is within the routed subnet, that its default gateway points to the Eziwan gateway, and that no local firewall is blocking the traffic. The diagnostics page displays the active tunnel routes.