Why Use a VPN Designed for Industrial Networks?
An OT industrial network is not an office network. PLCs, drives, SCADA systems, and HMIs communicate via proprietary protocols (Modbus, OPC UA, Profinet, DNP3) that lack any native security mechanisms. Exposing this equipment to the Internet—even behind a simple firewall—is a dangerous practice, as documented by dozens of incidents (notably attacks on water treatment plants and power plants via Shodan).
An industrial VPN solves this problem by creating a layer of isolation:
- The OT network is never directly exposed to the Internet.
- All communication goes through an encrypted tunnel.
- Access is controlled, authenticated, and logged.
Outbound Tunnel Architecture
The tunnel runs from the gateway to the cloud—not the other way around. This is the fundamental difference from a traditional VPN approach or an exposed RDP connection. On the site side, the firewall only allows outbound traffic to the VPN server’s IP address. Everything else is blocked.
Industrial VPN vs. Other Access Solutions
| Solution | OT Security | Open House | Industrial Protocols | Journalisation | Centralized Management |
|---|---|---|---|---|---|
| Outbound Industrial VPN | ★★★★★ | Non | Yes (L3 tunnel) | Oui | Oui |
| RDP/VNC Port Forwarding | ★ | Oui | Non | Non | Non |
| TeamViewer / AnyDesk | ★★★ | Non | Non | Partielle | Partielle |
| Site-to-Site IPSec VPN | ★★★★ | Non | Oui | Partielle | Complexe |
| ZTNA / Zero Trust | ★★★★★ | Non | Oui | Oui | Oui |
| Direct access to port 502 (Modbus) | ✗ | Oui | Oui | Non | Non |
Unfortunately, direct access to Modbus port 502 is still common. Thousands of industrial devices are listed on Shodan, with their Modbus registers directly accessible without authentication.
OpenVPN vs. IPSec for Industrial IoT
OpenVPN is the most common choice for 4G IoT gateways:
- Runs on UDP or TCP—can use port 443 to bypass firewalls.
- Resilient to mobile network outages (quick automatic reconnection).
- X.509 certificates for authentication, AES-256 encryption.
- Easy to manage via an internal PKI or a cloud CA.
IPSec / IKEv2 is best suited for:
- Permanent site-to-site connections over a fixed network.
- Devices that natively support IPSec (industrial firewalls).
- Performance on high-speed connections.
In practice, for industrial 4G networks with dozens or hundreds of sites, OpenVPN is easier to operate at scale.
Encryption and Authentication
A reliable industrial VPN must use:
- Encryption — AES-256-GCM or ChaCha20-Poly1305.
- Integrity — HMAC-SHA256 or SHA384.
- Key exchange — ECDHE (elliptic curves) for persistent forward secrecy (PFS).
- Authentication — X.509 certificates per device + user account with MFA.
- Certificate Pinning — the gateway accepts only the Eziwan cloud server certificate, not just any signed certificate.
The Eziwan Approach
The Eziwan Gateway comes with OpenVPN and IPSec built-in. The VPN is enabled by default upon zero-touch provisioning—no manual on-site configuration is required. Through the Eziwan Cloud, you can manage certificates, user permissions, and temporary access, and view a complete audit trail.
To learn more about OT security: Industrial Zero Trust, remote access to PLCs, and the Eziwan IoT Cybersecurity Guide.