OT Security

Secure Industrial VPN: OT Access Without Exposing Your Network

Industrial VPN: Outbound Tunnel Architecture, OpenVPN vs. IPSec, Differences from Consumer VPNs, and Zero Trust Best Practices for OT Networks.

Quick answer
A Industrial VPN is an encrypted tunnel that connects an industrial site (via a gateway) to a cloud infrastructure or an engineering office, without opening any incoming ports on the OT network. The connection is initiated from the site to the cloud — never the other way around. It’s fundamentally different from a consumer-grade VPN (which protects your web browsing) or direct RDP access (which opens an exposed port). It secures remote access to PLCs, HMIs, and SCADA systems while logging every session.

Why Use a VPN Designed for Industrial Networks?

An OT industrial network is not an office network. PLCs, drives, SCADA systems, and HMIs communicate via proprietary protocols (Modbus, OPC UA, Profinet, DNP3) that lack any native security mechanisms. Exposing this equipment to the Internet—even behind a simple firewall—is a dangerous practice, as documented by dozens of incidents (notably attacks on water treatment plants and power plants via Shodan).

An industrial VPN solves this problem by creating a layer of isolation:

  • The OT network is never directly exposed to the Internet.
  • All communication goes through an encrypted tunnel.
  • Access is controlled, authenticated, and logged.

Outbound Tunnel Architecture

The tunnel runs from the gateway to the cloud—not the other way around. This is the fundamental difference from a traditional VPN approach or an exposed RDP connection. On the site side, the firewall only allows outbound traffic to the VPN server’s IP address. Everything else is blocked.

Industrial VPN vs. Other Access Solutions

SolutionOT SecurityOpen HouseIndustrial ProtocolsJournalisationCentralized Management
Outbound Industrial VPN★★★★★NonYes (L3 tunnel)OuiOui
RDP/VNC Port ForwardingOuiNonNonNon
TeamViewer / AnyDesk★★★NonNonPartiellePartielle
Site-to-Site IPSec VPN★★★★NonOuiPartielleComplexe
ZTNA / Zero Trust★★★★★NonOuiOuiOui
Direct access to port 502 (Modbus)OuiOuiNonNon

Unfortunately, direct access to Modbus port 502 is still common. Thousands of industrial devices are listed on Shodan, with their Modbus registers directly accessible without authentication.

OpenVPN vs. IPSec for Industrial IoT

OpenVPN is the most common choice for 4G IoT gateways:

  • Runs on UDP or TCP—can use port 443 to bypass firewalls.
  • Resilient to mobile network outages (quick automatic reconnection).
  • X.509 certificates for authentication, AES-256 encryption.
  • Easy to manage via an internal PKI or a cloud CA.

IPSec / IKEv2 is best suited for:

  • Permanent site-to-site connections over a fixed network.
  • Devices that natively support IPSec (industrial firewalls).
  • Performance on high-speed connections.

In practice, for industrial 4G networks with dozens or hundreds of sites, OpenVPN is easier to operate at scale.

Encryption and Authentication

A reliable industrial VPN must use:

  • Encryption — AES-256-GCM or ChaCha20-Poly1305.
  • Integrity — HMAC-SHA256 or SHA384.
  • Key exchange — ECDHE (elliptic curves) for persistent forward secrecy (PFS).
  • Authentication — X.509 certificates per device + user account with MFA.
  • Certificate Pinning — the gateway accepts only the Eziwan cloud server certificate, not just any signed certificate.

The Eziwan Approach

The Eziwan Gateway comes with OpenVPN and IPSec built-in. The VPN is enabled by default upon zero-touch provisioning—no manual on-site configuration is required. Through the Eziwan Cloud, you can manage certificates, user permissions, and temporary access, and view a complete audit trail.

To learn more about OT security: Industrial Zero Trust, remote access to PLCs, and the Eziwan IoT Cybersecurity Guide.

Frequently Asked Questions

You might also like