Why not just open the Modbus (502) or RDP (3389) port on the firewall?

Opening an incoming port on the OT network directly exposes your equipment to the Internet. Thousands of bots constantly scan all ports on all public IP addresses. Port 502 (Modbus) and port 3389 (RDP) are particularly targeted. In 2021, industrial control systems were hacked through open Modbus ports without authentication. Access without an open port completely eliminates this attack surface.

Does it work behind a NAT or a strict firewall?

Yes, that’s exactly the advantage. An outbound VPN tunnel (OpenVPN over UDP/443 or HTTPS) naturally passes through all NATs and firewalls that allow outbound traffic—which is the case for 99.9% of industrial configurations. There are no special rules to create in the site’s firewall: the gateway traffic exits just like any other HTTP traffic.

How does a technician gain access through this system?

The technician logs in to the Eziwan cloud server (using MFA). The cloud server relays the technician’s connection through the gateway’s existing tunnel. The technician sees the site’s OT network as if they were physically there. Traffic flows as follows: technician → cloud server → existing tunnel → OT network. There is never a direct connection between the technician and the site.

What happens if the tunnel exit collapses?

The gateway attempts to reconnect immediately and continuously. In the event of a network interruption (4G outage, reboot), the tunnel is reestablished within a few seconds as soon as connectivity is restored. Monitoring sessions remain active (data is buffered locally). Active remote access sessions are interrupted but can be resumed immediately after reconnection.

OT Security

Remote Access Without Port Forwarding: Secure Outbound Architecture

How to Access Industrial Equipment Remotely Without Opening Any Inbound Ports? Outbound Tunnel Architecture, Reverse VPN, Zero Trust.

Quick answer

L’Remote access without opening ports (outbound-only VPN) is the standard secure method for industrial OT networks. The gateway at the site initiates a connection outgoing to a cloud server (a single outgoing TCP/UDP port) and keeps this tunnel open. Technicians connect to the cloud server—never directly to the site. The result: No open incoming ports, no firewall rules to create on the site side, no exposure to the Internet.

The Dangers of Port Opening in OT Networks

Opening inbound ports on an industrial network is the practice that leads to the most OT cybersecurity incidents:

Port 502 (Modbus) — exposed without authentication on thousands of industrial devices.
Port 3389 (RDP) — targeted by brute-force and ransomware attacks.
Port 5900 (VNC) — often unprotected or protected by weak passwords.
Port 4840 (OPC UA) — sometimes exposed without security policies enabled.

Automatic Internet scanning (via Shodan, Censys, ZoomEye) continuously indexes all these services. An exposed device is identified and targeted within a few hours. Access without opening ports completely eliminates this attack surface.

"Outbound-Only" Architecture: How It Works

The site’s firewall only allows outgoing traffic to the Eziwan Cloud server’s IP address. All incoming connections are blocked. The technician never connects directly to the site—he always goes through the cloud server, which relays the connection via the already established tunnel.

Comparison of Remote Access Methods

Method	Open port on the site side?	Security	Network complexity
Outbound VPN	No	★★★★★	Low
RDP/VNC port forwarding	Yes (3389/5900)	★	Low
Modbus port forwarding	Yes (502)	✗ (no security)	Low
Site-to-site IPSEC VPN	No	★★★★	High
ZTNA (Zero Trust Network Access)	No	★★★★★	Medium
TeamViewer / AnyDesk	No	★★★	Low (but not OT-native)

Site-Side Firewall Configuration

For a router/gateway with an outbound VPN, the only firewall rule needed on the site side is:

ALLOW: Outbound TCP/UDP traffic from [gateway IP] to [VPN server IP] on port 443 (or 1194)
BLOQUER : Tout autre trafic entrant

This minimum requirement is consistent with the most restrictive security policies of industrial IT departments.

The Eziwan Approach

The Eziwan Gateway is designed around the "outbound only" principle: as soon as it is powered on, it initiates an outbound connection to the Eziwan Cloud and keeps this tunnel active at all times. No port forwarding rules are required—you simply need to allow outbound HTTPS traffic, which is enabled by default in all network environments.

For more information: Secure Industrial VPN, Industrial Zero Trust, and Remote Access to Industrial PLCs.

Frequently Asked Questions

Secure Industrial VPNComprehensive VPN architecture for OT networks.Learn more Remote Access to the PLCAccess the PLCs securely.Learn more Industrial Zero TrustTaking the Zero Trust Approach a Step Further.Learn more 4G Router with VPNVPN built into the 4G router.Learn more IoT CybersecurityEziwan’s Comprehensive Security Strategy.Learn more Industrial Remote MaintenanceMaintain your equipment remotely.Learn more

The Dangers of Port Opening in OT Networks​

"Outbound-Only" Architecture: How It Works​

Comparison of Remote Access Methods​

Site-Side Firewall Configuration​

The Eziwan Approach​