Technical Guide

SCADA over 4G LTE: A Reliable Architecture for Sites Without Fiber

4G LTE SCADA Architecture for Industrial Sites Without Fiber: VPN, QoS, Dual SIM, OT Security, and Reliable Monitoring.

When an industrial site lacks fiber, monitoring should not become a permanent compromise. A well-designed SCADA architecture over 4G LTE enables the connection of pumping stations, electrical substations, agricultural facilities, remote sites, or mobile units with a permanent VPN, controlled quality of service, dual carrier connectivity, and security policies tailored to OT networks.

Why Connect a SCADA System to 4G LTE?​

Legacy SCADA architectures were often designed for private wired networks: dedicated fiber, MPLS, leased lines, or extended industrial Ethernet networks. In practice, however, many sites do not have this option. They still rely on 2G, 3G, GPRS, private radio, unstable ADSL, or manual interventions due to a lack of reliable connectivity.

Industrial 4G LTE is suitable for this use case, provided it is not treated as a simple Internet router. A consumer mobile network has several limitations for a SCADA environment:

  • Uncontrolled IP addressing behind the carrier’s NAT;
  • Variable latency depending on the cell, radio load, and signal quality;
  • Lack of prioritization for industrial data streams;
  • Dependence on a single mobile carrier;
  • Difficulty establishing incoming sessions from the control room;
  • Excessively large attack surface if the router is open to the Internet;
  • Insufficient monitoring of radio quality, the VPN tunnel, and OT data streams.

A robust 4G LTE SCADA architecture is therefore based on three layers: industrial mobile access, a controlled VPN tunnel, and strict segmentation between IT, DMZ, and OT.

Target Architecture​

The recommended approach is to install an Eziwan industrial gateway at the remote site. It establishes an outbound VPN tunnel to a central hub located in the control room, the data center, or a controlled cloud environment. The SCADA server then communicates with the PLCs via the tunnel’s private addresses, as if it were on a site-to-site network.

This approach prevents PLCs from being exposed to the Internet. The remote site initiates the VPN connection itself, which simplifies traffic routing through mobile carrier networks and minimizes the number of firewall rules required at the field level.

Essential Components​

A reliable mobile SCADA architecture does not depend on a single piece of equipment. It combines several technical functions that must be designed together.

ComponentRoleBest Practices
Industrial 4G LTE GatewayConnects the remote site to the mobile networkRuggedized model, DIN rail mounting, industrial-grade power supply, suitable antennas
Dual SIMReduces reliance on a single carrierSIM cards from two different carriers, on-site radio testing
Always-on VPNEncrypts and stabilizes data trafficOutbound OpenVPN or IPsec tunnel, certificates, fixed tunnel IP
QoSPrioritizes essential SCADA trafficDSCP marking, priority queues, throttling of non-critical traffic
OT firewallReduces the attack surfaceWhitelist by IP, port, and industrial protocol
Network MonitoringDetects anomalies before a failureMonitors RSSI, RSRP, SINR, latency, packet loss, and tunnel status
Central HubAggregates sitesHigh availability, logging, segmentation by site
Recommended Architecture

For a multi-site SCADA system, it is preferable to use a central VPN hub rather than independent direct connections to each 4G router. This makes it much easier to manage certificates, routing rules, logs, and access rights.

SCADA VPN: OpenVPN or IPsec?​

Both approaches are possible. The right choice depends on the network environment, security constraints, and the IT team’s practices.

CriterionOpenVPNIPsec
Mobile NAT traversalVery goodVaries depending on configuration
Certificate managementSimple and straightforwardMore stringent, sometimes more complex
Enterprise firewall integrationEasy on a single portStandard in network environments
PerformanceSufficient for most SCADA trafficVery good with hardware acceleration
On-site troubleshootingGenerally simplerRequires greater network expertise

In both cases, the tunnel must be initiated from the remote site to the hub. This circumvents the limitations of non-public mobile IP addresses and avoids opening an incoming port to the OT network.

Quality of Service: Prioritizing the Right Data Flows​

In most cases, a SCADA system does not require a very high data rate. Above all, it needs stable latency, low packet loss, and clear priority for critical communications.

Typical workflows to prioritize are:

  • Modbus TCP on port 502;
  • OPC UA on port 4840;
  • EtherNet/IP on port 44818;
  • DNP3 on port 20000;
  • Industrial MQTT when carrying priority telemetry;
  • VPN monitoring and tunnel monitoring.

The flows that need to be limited or isolated are:

  • software updates;
  • graphical remote access;
  • transfer of large files;
  • video surveillance;
  • non-critical cloud synchronization;
  • Internet browsing from the site.

QoS must be applied as close to the site as possible, before the radio link becomes saturated. It can combine DSCP marking, rate limiting, port-based prioritization, and rules based on source or destination IP addresses.

Dual SIM and Carrier Redundancy​

Dual SIM is only useful if it is used properly. Having two SIM cards from the same carrier in the same coverage area does not protect against antenna failure, network maintenance, or local congestion. Best practice is to use two different carriers, with properly positioned antennas and an actual on-site signal strength measurement.

The switch can be triggered based on several criteria:

  • complete loss of connectivity;
  • VPN tunnel unavailable;
  • latency exceeding a defined threshold;
  • persistent packet loss;
  • insufficient radio signal;
  • failure to resolve DNS or route to the hub.
Important Note

Switching too aggressively can create more instability than it resolves. Thresholds should include a delay—for example, several consecutive failures before switching SIMs.

OT Security: Never Expose PLCs​

A 4G router connected to a PLC must not become an open gateway between the Internet and the industrial network. The rules must follow the principle of least privilege: only traffic necessary for SCADA is permitted, and only to identified devices.

A secure configuration typically includes:

  • Encrypted VPN tunnel with individual certificates;
  • Disabling unnecessary services on the gateway;
  • Stateful firewall between the VPN and the OT LAN;
  • Whitelist of authorized SCADA addresses;
  • Filtering by industrial port;
  • VLAN segmentation if multiple OT zones coexist;
  • connection logging;
  • separate administrative access from monitoring traffic;
  • strong authentication for remote operators;
  • certificate rotation and revocation.

To align the architecture with an industrial cybersecurity approach, refer to the principles of IEC 62443 and the ANSSI recommendations on industrial system cybersecurity.

Compatibility with Schneider, Siemens, AVEVA, and Ignition​

A 4G LTE-based SCADA architecture works with the major monitoring platforms as long as routing, ports, and cycle times are configured correctly.

EcosystemCommon ProtocolsPoints to Check
Schneider EcoStruxureModbus TCP, OPC UAtimeout, polling, PLC addressing
Siemens WinCC and TIA PortalS7, OPC UA, Profinet depending on userouting, authorized ports, read cycles
AVEVA WonderwareOPC DA, OPC UA, SQL, application servicesWindows dependencies and segmentation
IgnitionOPC UA, MQTT, SQLstore-and-forward, OPC UA certificates
Historical monitoringSQL, MQTT, APIfault tolerance and recovery

However, it is important to distinguish between monitoring and real-time control. 4G LTE is well suited for monitoring, telemetry, alarms, non-critical controls, and remote operation. It is not intended to replace a deterministic fieldbus for fast-response or safety control loops.

Latency, Polling, and SCADA Settings​

The stability of a 4G SCADA system depends as much on the application configuration as it does on the network. Excessively aggressive polling cycles can unnecessarily saturate the link and amplify latency fluctuations.

Best Practices for Adjustment:

  • Group Modbus readings into coherent ranges;
  • Avoid repeated single-query requests on scattered registers;
  • Increase timeouts to account for the mobile network;
  • Separate critical tags from convenience tags;
  • Log data locally if a network outage is acceptable;
  • Use MQTT or store-and-forward for non-interactive data;
  • Monitor packet loss rather than just throughput.

For standard monitoring, a cycle of 500 ms to a few seconds may be realistic, depending on coverage, radio load, the number of sites, and the number of tags. The exact values must be validated through field testing, as they depend heavily on the operator, the antenna, the cell, and the industrial environment.

Typical Deployment at a Site Without Fiber​

A well-planned deployment can be carried out quickly, but it must follow a clear method.

1. Radio Audit​

Before installation, measure the coverage of the operators available on site. Useful metrics include RSSI, RSRP, RSRQ, and SINR. A good signal level is not enough: a low SINR can cause instability even with a high reception bar.

2. Addressing Plan​

Define the IP ranges for the OT LAN, the VPN tunnel, and the central networks. Avoid overly common ranges such as 192.168.0.0/24 or 192.168.1.0/24, which often cause conflicts during multi-site interconnection.

3. VPN Configuration​

Configure the site certificate, the static tunnel address, the allowed routes, and the firewall rules. Each site must be independently identifiable and revocable.

4. OT Filtering​

Allow only the necessary data streams. For example, a SCADA server can be allowed to connect to a PLC via Modbus TCP on port 502, without general access to the entire industrial network.

5. Functional Tests​

Verify readings, alarms, logging, authorized commands, and behavior during a temporary outage. Also test SIM failover—don’t just test normal operation.

6. Placed Under Supervision​

Add the gateway to the network monitoring dashboard. Alerts should cover the VPN tunnel, radio quality, latency, packet loss, and SIM changes.

Example of Filtering Rules​

Here is a typical firewall configuration for a remotely monitored pumping station.

SourceDestinationPortActionComment
SCADA ServerPump Controller502AllowModbus TCP read and write
Historian ServerEziwan Gateway161AllowSNMP monitoring if used
OT Admin WorkstationEziwan Gateway443AllowAdministration via VPN only
All other VPN trafficOT LANAllBlockDeny by default
OT LANInternetAllBlockNo direct, uncontrolled outbound traffic

This approach prevents a VPN connection from becoming an unrestricted access point to the entire industrial network.

Example of an application configuration​

For a SCADA server communicating with a PLC via Modbus TCP, the parameters to consider are generally:

PLC address: 10.80.12.10
Port : 502
Timeout: 2 to 5 seconds, as measured in the field
Retries : 2 ou 3
Cycle tags critiques : 1 seconde
Non-critical cycle tags: 5 to 30 seconds
Order Entry: Application Confirmation Required

These values are design guidelines, not universal guarantees. They must be adjusted after testing for latency, packet loss, and actual load.

Connectivity Monitoring​

A 4G LTE SCADA dashboard should provide visibility to OT and IT teams. The most useful metrics are:

  • VPN tunnel status;
  • active carrier;
  • Active SIM;
  • RSRP level;
  • SINR quality;
  • Average and maximum latency;
  • Packet loss;
  • Data usage;
  • Last reboot;
  • Last SIM change;
  • Firewall errors or blocked attempts.

This monitoring makes it possible to distinguish between a PLC failure, a local network failure, radio congestion, and a VPN tunnel outage.

Common Use Cases​

Industrial monitoring over 4G LTE is particularly well-suited for sites where the cost, time required, or feasibility of fiber-optic connectivity are not compatible with operations.

Sample scenarios:

  • water pumping and treatment stations;
  • secondary electrical substations;
  • agricultural silos and irrigation systems;
  • quarries, mines, and temporary sites;
  • ports, logistics terminals, and remote areas;
  • boiler rooms, remote production units, and utility buildings;
  • OEM machinery installed at customer sites;
  • multi-site monitoring with phased deployment.

In these environments, the goal is not just to establish a connection. It is to ensure that the connection remains usable, monitorable, and secure over the long term.

Common Pitfalls​

Several errors frequently occur in SCADA projects on mobile networks.

  • using a consumer SIM card without any warranty or oversight;
  • exposing the 4G router with port forwarding enabled;
  • keeping the factory default passwords;
  • failing to test dual-SIM failover;
  • ignoring the SINR quality and focusing solely on the signal level;
  • allowing all VPN traffic to pass through to the entire OT LAN;
  • mixing remote maintenance, video surveillance, and SCADA polling without QoS;
  • configuring read cycles that are too short;
  • failing to revoke certificates for service providers;
  • failing to document authorized routes and traffic flows.
Good Practice

Before going live, perform a disconnection test: disconnect the main antenna, force a tunnel loss, and then verify that the SCADA system recovers. A reliable system is also judged by how it handles transitions.

Where should you place Eziwan in your architecture?​

Eziwan can function as an on-site industrial gateway, a multi-site VPN hub, or a complete OT connectivity architecture. The goal is to provide secure remote access that is compatible with the constraints of industrial environments and the needs of operations teams.

For more information, please visit the pages dedicated to the Eziwan gateway, cloud offerings, and industrial connectivity solutions. These components can be combined to build a fiber-free SCADA monitoring system with centralized management and a consistent security policy.

Conclusion​

SCADA over 4G LTE is a viable solution for connecting industrial sites without fiber, provided that the guidelines for a robust OT architecture are followed: outbound VPN tunnel, dual SIM, QoS, strict filtering, network monitoring, and failover testing. 4G does not replace a local deterministic network, but it can serve as a reliable monitoring link for isolated, mobile, or hard-to-connect sites.

With an Eziwan industrial gateway, a VPN concentrator, and a configuration tailored to industrial protocols, teams can monitor their PLCs, log their data, and perform remote maintenance without exposing the OT network or relying on a long, costly fiber-optic extension.

Further Reading​

Frequently Asked Questions

You might also like