Why has remote access to PLCs become essential?
An industrial PLC breaks down at 11 p.m. Without remote access, the maintenance operation requires a trip on-site—often hundreds of kilometers away, at a cost of several thousand euros for just a few hours of work. With secure remote access, the technician can log in from home in 2 minutes, diagnose the problem, and restart the machine.
In addition to corrective maintenance, remote access is used to:
- Change program settings without having to travel.
- Download software updates (PLC firmware, production recipes).
- Monitor in real time without being on site.
- Train operators remotely via screen sharing.
- Audit sessions conducted by external service providers.
Secure Remote Access Architecture for PLCs
The fundamental principle: the gateway initiates the connection to the cloud—never the other way around. As a result, no incoming ports are open on the OT network. An attacker cannot scan the industrial site from the Internet.
Comparison of Access Methods
| Method | OT Security | Industrial Protocols | Traceability | Complexity |
|---|---|---|---|---|
| Site-to-Cloud VPN (recommended) | ★★★★★ | Yes | Yes | Medium |
| Direct port forwarding access | ★ | Yes | No | Low |
| AnyDesk / TeamViewer | ★★★ | No (PC only) | Partial | Low |
| Zero Trust ZTNA | ★★★★★ | Yes | Yes | High |
| Site-to-site VPN access | ★★★★ | Yes | Partial | High |
Opening a direct port is strictly prohibited: it exposes the OT network to the Internet and is regularly targeted by automated scans (see the Shodan incidents involving exposed industrial control systems).
Best Practices for OT Security in Remote Access
1. Never open an incoming port All traffic must flow from the site to the cloud (outbound tunnel). This is the opposite of traditional RDP or VNC.
2. Multi-factor authentication (MFA) Each session must be validated by a second factor. A username and password alone are not sufficient.
3. Principle of Least Privilege A maintenance technician does not need access to all PLCs. Limit each account to the equipment necessary for its specific task.
4. Comprehensive Logging Every connection and every command sent to the PLC must be logged with a timestamp, user ID, and IP address. This is required for NIS2 compliance.
5. Temporary, Revocable Access For service providers, create time-limited access that expires automatically. Never grant permanent access to third parties.
6. IT/OT Segmentation The OT network (controllers, sensors) must be isolated from the IT network (office computers, Wi-Fi). The gateway creates this boundary and controls what passes from one to the other.
Compatibility with PLC Software
Level 3 VPN remote access is transparent to programming tools. You use your usual software from your workstation:
- Siemens — TIA Portal, S7-PLCSIM Advanced, WinCC
- Schneider Electric — EcoStruxure Machine Expert (SoMachine), Unity Pro
- Rockwell Automation — Studio 5000, FactoryTalk
- Beckhoff — TwinCAT 3
- Phoenix Contact, Wago, Pilz… compatibility is complete because the VPN tunnel is transparent at the network level.
The Eziwan Approach
The Eziwan Gateway natively supports outbound VPN (OpenVPN or IPSec), session logging, and zero open ports. Through the Eziwan Cloud, you can manage access rights for each technician, create temporary access for service providers, and view a complete audit log of all sessions.
Learn more: Secure Industrial VPN, Remote Access Without Port Forwarding, and Industrial Zero Trust.