Choosing an industrial VPN involves more than just encrypting data traffic between two networks. In an OT environment, the protocol must traverse 4G NATs, reconnect quickly after a disconnection, remain manageable across dozens of sites, restrict access to PLCs, generate audit logs, and never expose unnecessary public ports. OpenVPN, IPsec, and L2TP do not all meet these same requirements: here is a technical comparison to help you choose a reliable architecture.
Why an Industrial VPN Is Different from an Office VPN
An office VPN is often used to connect a user to internal applications: files, the intranet, email, ERP systems, and workstations. An industrial VPN, on the other hand, must carry continuous OT traffic between devices that are sometimes old, fragile, or highly sensitive to interruptions.
The constraints are not the same:
- PLCs without native authentication;
- SCADA systems that require stable connectivity;
- industrial protocols that are data-intensive or prone to timeouts;
- remote sites connected via 4G LTE, 5G, satellite, or ADSL;
- no on-site IT staff;
- the need for large-scale, repeatable deployment;
- logging requirements for audits and cybersecurity;
- strict separation between IT and OT;
- a policy prohibiting the exposure of public ports on PLCs;
- service provider access to be limited by site, equipment, and duration.
In this context, a VPN that works well at headquarters may be difficult to use on an industrial mobile network. NAT traversal, reconnection, access revocation, and segmentation are just as important as encryption.
OpenVPN, IPsec, L2TP: An Overview
OpenVPN, IPsec, and L2TP are often grouped together, but they don’t serve exactly the same purpose.
| Protocol | Positioning | Recommended OT Use |
|---|---|---|
| OpenVPN | Flexible TLS VPN, excellent for NAT and 4G | OT remote access, mobile sites, multi-site deployment |
| IPsec IKEv2 | Standardized network VPN, widely used in enterprises | Regulated site-to-site, data centers, controlled firewalls |
| L2TP with IPsec | Layer 2 tunnel often used with IPsec | Legacy compatibility; rarely a good choice for new deployments |
| PPTP | Legacy VPN protocol | Should not be used for any new deployments |
Caution: Important Note PPTP should no longer be used in modern industrial projects. Its security is outdated, and it does not meet current OT cybersecurity requirements.
Quick Comparison Chart
| Criterion | OpenVPN | IPsec IKEv2 | L2TP with IPsec |
|---|---|---|---|
| 4G NAT traversal | Very good | Good if NAT-T is properly managed | Variable |
| Operation over TCP 443 | Yes | Not natively | No |
| Multi-site deployment | Simple with certificates | More complex | Moderate |
| Cryptographic security | Strong if properly configured | Strong if properly configured | Highly dependent on IPsec |
| Risk of misconfiguration | Moderate | High if policies are complex | Moderate to high |
| Mobile reconnection | Good with keepalive | Good with IKEv2 and MOBIKE | Often less robust |
| Enterprise firewall integration | Easy on a single port | Very good in a controlled network environment | Variable |
| Certificate maintenance | Simple with a dedicated platform | Robust but more cumbersome | Varies |
| Suitability for new OT projects | Very high | High depending on context | Limited |
The best choice is therefore not one-size-fits-all. OpenVPN is often the most practical option for remote industrial sites and 4G access. IPsec remains a viable option when the network infrastructure is homogeneous, well-managed, and already standardized around IKEv2. L2TP is primarily found in legacy environments.
Recommended Architecture for an OT VPN
Proper architecture avoids opening an incoming port at the industrial site. The Eziwan gateway initiates an outgoing tunnel to a VPN concentrator. Technicians, SCADA, or central systems then route through this concentrator according to access policies.
This zero inbound architecture addresses a key constraint: the industrial site does not publish services directly on the Internet. The gateway establishes the tunnel from the inside, which facilitates traversal of mobile networks and significantly reduces the attack surface.
OpenVPN for Industrial OT Networks
OpenVPN is based on TLS and can operate over UDP or TCP. In OT, its main advantage is its flexibility: it traverses NATs effectively, can use a single port, relies on X.509 certificates, and can be easily deployed on industrial Linux gateways.
Its strengths are particularly useful at remote sites:
- UDP transport supported for optimal performance;
- Fallback to TCP port 443 when UDP is blocked;
- Mutual authentication via certificates;
- Revocation via a list of revoked certificates;
- Reliable operation behind carrier NAT;
- Compatibility with 4G LTE, 5G, satellite, and traditional Internet access;
- Readable and automatable configuration;
- Simpler diagnostics than complex IPsec policies;
- Seamless integration with an
outbound onlyapproach.
OpenVPN is therefore well-suited for the following scenarios:
- remote access to PLCs;
- multi-site SCADA monitoring;
- third-party maintenance;
- sites connected via 4G LTE dual SIM;
- remote stations;
- a fleet of gateways to be automatically provisioned;
- environments where field staff must not modify configuration files.
tip Eziwan’s Recommendation For distributed OT sites, OpenVPN is often the best balance between security, network traversal, ease of operation, and access management.
IPsec IKEv2 for Controlled Environments
IPsec is a widely used standard for site-to-site VPNs. It operates at the network layer and integrates seamlessly with many firewalls, routers, and enterprise infrastructures. With IKEv2, NAT-T, and modern cryptographic suites, IPsec can provide an excellent level of security and performance.
Its benefits are real:
- A standard widely supported by network equipment;
- Very good performance with hardware acceleration;
- Commonly integrated into data center architectures;
- Robust management of site-to-site tunnels;
- Compatibility with enterprise security policies;
- IKEv2 is more modern and robust than IKEv1;
- MOBIKE is useful during certain IP address changes.
Its limitations are particularly evident in mobile or heterogeneous environments:
- More complex configuration;
- IKE, SA, encryption, and lifetime parameters must be precisely aligned;
- Interoperability between vendors can sometimes be challenging;
- More difficult troubleshooting for OT teams;
- Dependence on UDP ports 500 and 4500;
- Behavior varies depending on operators’ NATs and intermediate firewalls;
- Risk of retaining legacy cryptographic suites for compatibility purposes.
IPsec remains an excellent choice when the infrastructure is managed by an experienced network team, the equipment is homogeneous, and the operational constraints are known. For a large-scale deployment of 4G sites, OpenVPN is often easier to make reliable.
L2TP: A Choice Largely Based on Legacy Factors
L2TP does not encrypt communications on its own. It is typically used in conjunction with IPsec to ensure confidentiality and integrity. In modern environments, it is often retained for compatibility with legacy systems, but it offers few advantages for a new OT project.
Its main limitations are:
- Limited technical advantages compared to OpenVPN or IKEv2;
- Reliance on IPsec for security;
- NAT traversal can sometimes be less predictable;
- Heavier protocol stack;
- Maintenance is not very appealing for large deployments;
- Limited relevance for 4G industrial sites.
L2TP can serve as a stopgap solution in an existing environment, but it should not be the target protocol for a new industrial remote maintenance architecture.
NAT Traversal and 4G LTE Networks
NAT traversal is often the deciding factor when comparing industrial VPN protocols. Remote sites connected via 4G LTE or 5G are frequently behind a carrier’s NAT. The public IP address is not directly assigned to the gateway, and incoming connections are either impossible or unstable.
OpenVPN works very well because the gateway can establish an outbound connection to a known hub. If UDP is blocked, the TCP 443 transport can help get through certain firewalls or restrictive networks.
IPsec can traverse NAT via NAT-T, typically on UDP port 4500. This works well in many cases, but depends largely on the intermediate equipment, firewall policies, and the mobile carrier.
The key principle to remember is simple: on a mobile network, prioritize an outbound connection initiated by the site’s gateway. This avoids reliance on a fixed public IP address and eliminates the need to open a port to the OT network.
Latency and Performance for SCADA, Modbus, OPC UA, and MQTT
OT data streams do not always consume a lot of bandwidth. Modbus polling, OPC UA tags, and industrial MQTT messages primarily require stability, low packet loss, and latency that is compatible with application cycles.
The factors that actually influence performance are:
- 4G or 5G connection quality;
- radio signal level and SINR;
- operator cell load;
- distance to the VPN concentrator;
- local link congestion;
- packet size;
- polling frequency;
- SCADA timeout settings;
- QoS rules;
- gateway CPU power;
- selected encryption.
VPN overhead does exist, but it is rarely the limiting factor in traditional industrial monitoring. Priority should be given to tunnel stability, QoS, and application configuration.
| OT Flow | Sensitivity | Recommendation |
|---|---|---|
| Modbus TCP | prone to timeouts | group registers, adjust retry settings |
| OPC UA | session-dependent | monitor keepalive and certificates |
| MQTT | resilient if properly configured | use appropriate QoS and local buffering |
| RDP or VNC | high bandwidth consumption | reserve for occasional maintenance |
| Firmware transfer | may saturate the link | limit and deprioritize |
| Video | very high bandwidth consumption | isolate from SCADA traffic |
Real-Time Considerations A VPN over 4G is not a substitute for a deterministic fieldbus. It is suitable for monitoring, maintenance, and non-critical control functions, but not for fast control loops or process safety functions.
Cryptographic Security: The Protocol Alone Is Not Enough
Both OpenVPN and IPsec can be secure when configured properly. Conversely, both can become vulnerable if outdated settings, overly simple shared keys, or poorly managed certificates are used.
The items to check are:
- modern encryption;
- strong authentication;
- individual certificates;
- documented revocation;
- certificate lifetimes;
- no shared secrets between service providers;
- connection logging;
- deactivation of obsolete suites;
- updating of VPN components;
- separation of user access and site-to-site access.
OpenVPN relies on TLS and a very straightforward certificate management system. IPsec also offers strong security, but its extensive configuration options increase the risk of a discrepancy between the intended policy and the policy that is actually deployed.
X.509 Certificates and Access Revocation
X.509 certificates are essential for preventing shared accounts. Each gateway, technician, or service provider can have its own cryptographic identity. When access needs to be revoked, all that is required is to revoke the relevant certificate, without changing the entire architecture.
Cases of revocation are common:
- an employee leaving;
- the end of an integrator’s contract;
- the loss of a computer;
- a suspected security breach;
- a change in the scope of operations;
- the replacement of a gateway;
- the closure of a site.
A platform like Eziwan automates this process: generation, distribution, rotation, and revocation. This is particularly important in IT, where teams don’t want to manually manage configuration files at each site.
OT Segmentation: Avoiding a Flat VPN
The most common risk isn’t just the choice of protocol. It’s the "flat VPN": once connected, the user can access the entire industrial subnet. In an OT network, that’s dangerous.
Remote access must be restricted by:
- user;
- role;
- site;
- time range;
- protocol;
- source IP address;
- destination IP address;
- port;
- session duration;
- severity level.
Sample policy:
Role: PLC Maintenance Technician
Site : usine nord
Supported devices: PLC-L2, HMI-L2
Allowed protocols: Modbus TCP 502, HTTPS 443
Maximum duration: 2 hours
Authentication: Certificate and MFA
Logging: complete
Access to other OT VLANs: prohibited
This logic is more important than the OpenVPN vs. IPsec debate. An encrypted tunnel that is too permissive remains an operational risk.
Reconnecting After a 4G or Dual-SIM Disconnection
Mobile networks may experience micro-outages, IP address changes, cell handoffs, radio signal loss, or carrier maintenance. An industrial VPN must quickly recover without blocking the SCADA system for several minutes.
OpenVPN can be configured with keepalive mechanisms, automatic reconnection, and persistent tunneling. IPsec IKEv2 can effectively handle certain network changes, particularly with MOBIKE when the environment supports it.
The important parameters are:
- keepalive;
- timeout before declaring a tunnel dead;
- reconnection frequency;
- tunnel interface persistence;
- dual-SIM behavior;
- operator priority order;
- routing upon reconnection;
- local data caching;
- logging of handover events.
| Situation | Risk | Best Practice |
|---|---|---|
| 4G micro-outage | SCADA timeout | keepalive and quick reconnection |
| Mobile IP change | tunnel break | outgoing tunnel and automatic reconnection |
| Dual SIM failover | route loss | tunnel monitoring and dynamic routing |
| Extended outage | data loss | local storage followed by retransmission |
| Unstable network recovery | repeated failovers | delay and stability thresholds |
QoS and OT Flow Prioritization
A VPN encrypts traffic, but it should not treat all traffic the same. A firmware transfer, a graphical remote session, or a large-scale export can degrade SCADA traffic if no prioritization rules are applied.
The workflows to prioritize are generally:
- Modbus TCP;
- OPC UA;
- EtherNet/IP;
- DNP3;
- mission-critical industrial MQTT;
- tunnel monitoring;
- alarms and events.
The flows to be limited are:
- RDP;
- VNC;
- file transfer;
- updates;
- video;
- large backups;
- web browsing from the site.
QoS must be applied before the link becomes saturated. On an industrial gateway, it is possible to mark, limit, or prioritize traffic based on protocol, port, address, or role.
Native OpenVPN in Eziwan
Eziwan integrates OpenVPN into an architecture designed for OT networks: outbound tunneling, X.509 certificates, automatic provisioning, device-based filtering, logging, and monitoring of tunnel status.
The key features are:
- Native OpenVPN on industrial gateways;
- UDP or TCP 443 transport, depending on the context;
- X.509 certificates generated and distributed automatically;
- Centralized revocation;
- Persistent tunnel;
- Automatic reconnection;
- Dual SIM with link monitoring;
- OT filtering rules;
- Access logs;
- Multi-site dashboard integration;
- Compatibility with SCADA, PLCs, HMIs, and field devices.
For environments that require IPsec, Eziwan can also integrate with an IKEv2 architecture in accordance with the company’s network policies. The goal is not to impose a single protocol, but to choose the one that actually works under real-world conditions.
Detailed Comparison by Scenario
| Scenario | Recommended Protocol | Why |
|---|---|---|
| Industrial site with 4G LTE | OpenVPN | NAT traversal, TCP 443 supported, simple deployment |
| Data center to fixed fiber site | IPsec or OpenVPN | choice based on internal IT standards |
| Fleet of 100 gateways | OpenVPN with provisioning | automatable certificates and configuration |
| Highly controlled firewall environment | IPsec IKEv2 | enterprise network integration |
| Temporary service provider access | OpenVPN with certificates | simple revocation and traceability |
| Legacy L2TP equipment | Migration recommended | primarily legacy protocol |
| High performance requirements | IPsec with acceleration or optimized OpenVPN | Depends on hardware and encryption |
| Multi-site SCADA | OpenVPN or IPsec hub-and-spoke | Central hub and OT filtering |
Best Practices for Deployment
A reliable industrial VPN requires more than just a choice of protocol. The design must cover the entire lifecycle.
- Prioritize outbound tunnels from the OT site;
- Avoid any port forwarding to PLCs or HMIs;
- Use individual certificates;
- Enable MFA for sensitive user access;
- Separate site-to-site access from service provider access;
- Filter traffic by device and protocol;
- Document routes and VLANs;
- Monitor tunnel status;
- Log connections, failures, and revocations;
- Test 4G and dual-SIM failover;
- Apply QoS to critical traffic;
- Establish a revocation procedure;
- Back up configurations;
- Test gateway restoration.
Audit Information For NIS2, IEC 62443, or internal audit procedures, the value comes from a combination of encryption, identity management, segmentation, logging, and revocation. A VPN protocol alone is not sufficient to demonstrate control over access.
Common Mistakes
OT VPN projects rarely fail because of a single setting. Problems often stem from a series of small, fragile decisions.
- using a shared key for multiple service providers;
- opening a public port to a user interface;
- granting access to the entire OT subnet;
- failing to revoke old accounts;
- choosing IPsec without verifying the ISP’s NAT;
- sticking with L2TP out of habit;
- Mixing SCADA traffic and file transfers without QoS;
- Failing to test reconnection after a 4G outage;
- Failing to monitor the tunnel;
- Documenting access in an unmaintained spreadsheet;
- Leaving certificates without an expiration date;
- Ignoring access logs.
An industrial VPN architecture must be tested under degraded conditions: network outage, SIM card replacement, certificate revocation, unauthorized user, equipment offline, and link congestion.
Where Eziwan Fits Into Your OT Network
Eziwan provides the secure connectivity layer between your industrial sites, your technicians, your PLCs, and your supervisory systems. The Eziwan gateway establishes the tunnel from the site, while industrial connectivity solutions manage 4G, fiber, or satellite connections, and the cloud platform centralizes certificates, logs, alerts, and access policies.
To learn more about securing industrial networks, see also the guide on OT network security without public ports and the article on SCADA over 4G LTE.
Conclusion
OpenVPN, IPsec, and L2TP do not address the same needs. IPsec remains a solid choice for controlled network environments and traditional site-to-site tunnels. L2TP is primarily used for backward compatibility. OpenVPN is often the most practical choice for distributed OT networks, 4G sites, service provider access, and multi-site deployments thanks to its NAT traversal, certificate-based management, and ease of operation.
With Eziwan, OpenVPN is integrated into a comprehensive industrial architecture: outbound tunnel, X.509 certificates, automatic provisioning, mobile reconnection, dual SIM, OT filtering, logging, and centralized revocation. The result is not just an encrypted VPN, but a remote access solution that is operational, traceable, and tailored to the real-world constraints of PLCs, SCADA systems, and industrial sites.
Further Reading
- Industrial VPN — VPN solutions tailored to the constraints of OT networks and 4G connections
- Industrial Remote Access — access your PLCs and HMIs without exposing public ports
- Industrial Cybersecurity — protect your OT networks against today’s cyber threats
- Traditional VPN vs. Industrial Remote Access — what are the practical differences for your field operations
- Private APN vs. Industrial VPN — compare network architectures for your industrial sites