Industrial VPNs Explained: Choosing the Right Remote Access Solution for OT Networks

By Dustin Guttadauro, Product Line Manager - Telecom & Fiber, Infinite Electronics  

Remote connectivity has become essential for modern industrial operations. Whether supporting a remote pumping station, troubleshooting a PLC on a production line, or maintaining equipment at a utility substation, engineers and service providers increasingly rely on secure remote access to diagnose issues and reduce costly site visits. However, the networking requirements of operational technology (OT) environments differ significantly from those of traditional enterprise IT, making consumer or enterprise VPN solutions an imperfect fit for industrial applications.  

Industrial VPNs are designed to provide secure, reliable remote access without compromising system availability or exposing critical control networks. From ruggedized hardware and support for industrial protocols to secure vendor access and resilient communications over wired or cellular networks, selecting the right VPN solution requires careful consideration of both cybersecurity and operational performance. This guide explains how industrial VPNs differ from enterprise VPNs, compares common deployment options, and outlines best practices for securing remote OT connectivity. 

Key Takeaways 

•   Industrial VPNs serve a fundamentally different purpose than enterprise VPNs: they provide scoped, logged, MFA-protected remote access to specific OT devices and systems for technicians and vendors — not broad network access for corporate users connecting laptops to file shares. 

•   The four requirements that distinguish industrial VPN selection from enterprise VPN selection are: deterministic low latency (sub-100ms for HMI responsiveness), OT protocol support or awareness (Modbus TCP, Ethernet/IP, DNP3), ruggedized hardware for industrial environments (DIN rail, 24VDC, wide temperature), and vendor access scoping that prevents lateral movement within OT networks. 

•   The VPN gateway's WAN port is a physical security vulnerability that almost no VPN comparison article addresses. It connects to an external cable run that carries both the WAN signal and any electrical surge energy present in the surrounding environment. 

•   Eight deployment pitfalls account for most industrial VPN security failures: split tunneling creating direct OT-to-internet paths, over-broad vendor access scopes, shared credentials across vendors, unprotected physical entry points, default-allow firewall policies on VPN-terminated sessions, missing session recording, unmonitored MFA gaps, and protocol translation problems.  

What makes an industrial VPN different from an enterprise VPN? 

An enterprise VPN connects a laptop in a hotel to the corporate network. The user logs in, gets broad network access, and connects to file servers, email, and business applications. The primary security concern is credential protection and device health. 

An industrial VPN connects a vendor laptop to a specific PLC in a petrochemical plant. The session should last exactly as long as the maintenance job requires, access exactly the device specified in the work order, and generate a complete record that can be reviewed if something goes wrong on the production line later that day. Broad network access in that scenario is the opposite of what's wanted. 

The difference isn't just a matter of scope — the physical environment, the protocol requirements, and the hardware specifications are all different.  

The physical vulnerability row in this table deserves attention. A corporate VPN gateway lives in a data center with controlled physical access, stable power, and no outdoor cable runs. An industrial VPN gateway lives on a DIN rail inside a cabinet at a remote site, connects to a WAN interface that runs from a telecommunications demarcation point or a cellular antenna — both of which are connected to outdoor infrastructure that is subject to surge events. The gateway is both a network security device and a piece of field hardware exposed to the industrial electrical environment. 

What are the main industrial VPN solution types? 

Five approaches to industrial remote access cover most deployment scenarios. They're not mutually exclusive; many organizations combine a hardware gateway for primary connectivity with a cloud-based secure access solution for vendor management. 

Hardware IPsec VPN gateways from industrial vendors (Moxa EDR, Cisco ISA, Secomea, Tosibox) represent the most common choice for fixed remote site connectivity because they operate independently of cloud services, are available in DIN rail industrial form factors, and integrate firewall capability alongside the VPN function. For environments with both cellular and fixed broadband WAN, SD-WAN adds intelligent link selection and failover that a pure IPsec gateway typically doesn't provide. 

Cellular VPN gateways from Cradlepoint, Digi, and Sierra Wireless address remote sites where a fixed WAN is unavailable or unreliable. For environments with many remote monitoring sites — pipeline monitoring, utility substations, water treatment outstations — cellular gateways are often the only practical WAN option. 

 Why are VPN gateway physical entry points a security vulnerability? 

This dimension of VPN security is absent from virtually every industrial VPN comparison article, which focuses on protocol support and latency. The physical entry points on a VPN gateway — the WAN Ethernet port and the cellular antenna connection — are the points where the electrical environment outside the enclosure meets the electronics inside it. 

The WAN port surge path 

A wired WAN connection to a VPN gateway at a remote site typically runs from a telecommunications provider demarcation point, a fiber media converter, or an outdoor cable entry to the gateway's WAN RJ45 port. If any part of that run is copper and exposed to outdoor or transitional environments, it carries surge exposure. 

A switching transient from a nearby power distribution system, a ground fault event, or a lightning strike on the telecommunications infrastructure can deliver hundreds of volts onto the WAN copper conductor. The WAN port's PHY (physical layer transceiver) has the same low surge tolerance as any Ethernet PHY — a few volts’ maximum. The surge destroys the WAN interface, takes the VPN down, and may cascade to damage the gateway's main board. 

AnEthernet surge protector installed on the WAN port — between the incoming cable and the gateway's WAN interface — clamps the surge voltage before it reaches the gateway. The protector must be bonded to a low-impedance earth ground to function. A protector with an ungrounded or poorly bonded ground lug provides marginal protection at best. 

The cellular antenna path 

Cellular VPN gateways connect to external antennas via coaxial cable. The antenna is an outdoor metallic structure — it collects transient energy from nearby lightning events and conducts it down the coax to the gateway's RF front end. The gateway's RF input has essentially no surge tolerance. An RF lightning protector installed on the coax at the enclosure entry point is required for any cellular gateway with an outdoor antenna. This applies equally to gateways mounted on building walls, rooftop mounting brackets, or antenna masts at remote sites. The same installation and grounding requirements described in the RF lightning protector guide apply here. 

The security consequences of gateway hardware failure 

When a VPN gateway fails due to surge damage, the VPN is down. Vendor access that was in progress terminates. Remote monitoring connectivity to the site is lost. The replacement and reconfiguration process starts, which, at a remote unmanned site, may take days. During that interval, the SCADA system has no visibility into the site; alarms that would trigger operator response aren't reaching the control room. 

The security exposure during the reconfiguration process is a separate concern: firmware restored from backup rather than re-downloaded from the vendor, firewall rules re-entered manually and potentially incomplete, and certificates regenerated with weaker parameters. Restoration under time pressure is where security configuration errors occur. Surge protection prevents both the outage and the security-exposing restoration process. 

What are the most common industrial VPN deployment pitfalls? 

The table below covers the eight pitfalls that account for most industrial VPN security incidents. The 'what happens' column is written to be specific — each describes a concrete security outcome, not a generic risk. 

Split tunneling (row 1) and over-broad vendor access (row 3) are consistently the highest-consequence pitfalls because they're configuration states that persist indefinitely once set. A vendor who was given broad access for a commissioning project two years ago still has that access unless someone actively narrowed it. Split tunneling, configured to simplify a technician's workflow during initial setup, remains in place unless specifically changed. Neither generates an alert in most configurations — they're quiet vulnerabilities. 

VPN gateway hardening checklist 

This 14-item checklist covers the controls required for a secure industrial VPN gateway deployment. Physical security items appear first — consistent with the principle that hardware integrity precedes software configuration. 

Industrial VPN Gateway Hardening Checklist 

1. Install the Gateway in a Locked Industrial Enclosure: Mount the VPN gateway inside a lockable, industrial-rated enclosure rather than on an exposed DIN rail or open rack. Physical access to the gateway can provide direct access to the OT network.  

1. Install Ethernet Surge Protectors on WAN Connections: Protect all external and WAN-facing copper Ethernet ports with surge protectors to prevent lightning strikes and switching transients from damaging the gateway.  

1. Protect Cellular Antenna Connections: If using a cellular WAN, install an RF lightning protector on the antenna coaxial cable at the building or enclosure entry point to protect against surge events.  

1. Replace All Default Credentials: Immediately change all factory-default administrator passwords, VPN pre-shared keys (if temporarily used), and SNMP community strings. Default credentials are publicly documented and commonly targeted by automated attacks.  

1. Use Certificate-Based VPN Authentication: Configure VPN access to use digital certificates instead of pre-shared keys. Certificates provide unique, revocable credentials for each user or device and offer stronger security.  

1. Enforce Multi-Factor Authentication (MFA): Require MFA for both the VPN management interface and all remote VPN user sessions to strengthen authentication and support compliance with IEC 62443 and NERC CIP.  

1. Apply a Deny-by-Default Firewall Policy: Configure firewall rules so that VPN users can access only explicitly approved systems and services. Avoid default-allow configurations that expose the entire OT network.  

1. Restrict Vendor Access: Limit vendor accounts to specific destination IP addresses and required ports. Vendors should have access only to the equipment necessary for their maintenance activities.  

1. Automatically Expire Vendor Accounts: Configure vendor accounts to expire immediately after scheduled maintenance windows to eliminate persistent, unmanaged remote access.  

1. Log All VPN Sessions: Record connection time, source IP address, destination, user identity, and session duration for every VPN session. Forward logs to a centralized SIEM or log management platform instead of relying solely on local storage.  

1. Alert on Unauthorized VPN Activity: Configure alerts for VPN sessions initiated outside approved maintenance windows to quickly detect unexpected or unauthorized remote access.  

1. Enable the Hardware Watchdog: Activate the gateway's hardware watchdog feature so the device automatically reboots if software becomes unresponsive, reducing the need for physical intervention at remote sites.  

1. Maintain Current Firmware and Security Advisories: Keep gateway firmware up to date and subscribe to CISA ICS-CERT advisories for the gateway manufacturer to promptly address newly disclosed vulnerabilities.  

1. Configure Out-of-Band Management: Implement an independent management path separate from the primary WAN connection. This ensures administrators can recover or troubleshoot the gateway even if the primary connection fails or is compromised. 

How do OT protocols affect VPN selection and configuration? 

OT protocols behave differently from IT application protocols under VPN conditions. Understanding those differences prevents deployment failures that only appear under production load. 

Modbus TCP timing sensitivity 

Modbus TCP uses a request-response pattern where the master polls slaves and expects a response within a defined timeout. The default Modbus timeout in most implementations is 1–3 seconds, which seems generous. In practice, SCADA systems that poll hundreds of PLCs on a fast cycle use much tighter timeouts to maintain scan rate. A VPN that adds 200ms of latency per transaction may cause the SCADA system to log communication errors and eventually mark PLCs as offline, even though the VPN connection is technically functional. 

Verify HMI and SCADA responsiveness over VPN in a test environment before production deployment. Measure round-trip latency for Modbus transactions with a network analyzer and compare it to the timeout configured in the SCADA application. Where latency is a concern, prioritize hardware VPN gateways with hardware-accelerated IPsec over software-based VPN clients. 

EtherNet/IP implicit messaging (UDP 2222) 

EtherNet/IP uses two ports: TCP 44818 for explicit messaging (command/response) and UDP 2222 for implicit messaging (continuous I/O data at high cyclic rate). VPN configurations that handle TCP correctly may still drop UDP traffic or introduce jitter that disrupts I/O communication. Test both messaging types explicitly. For Ethernet/IP environments where I/O is critical, a hardware VPN with QoS configuration that prioritizes UDP 2222 traffic is typically required. 

DNP3 unsolicited responses 

DNP3 supports unsolicited responses — the outstation sends data to the master without a preceding poll request. Standard VPN configurations that open sessions only on outbound connections from the headquarters end will block unsolicited DNP3 from the outstation — the session doesn't exist in the direction the outstation is trying to send. The VPN must be configured to allow initiated connections from the remote site, or the DNP3 unsolicited response feature must be disabled and polling used instead. Test this behavior in the lab before commissioning. 

The VPN gateway is an OT security control and a field device — it needs both kinds of protection 

Industrial VPN gateways are configured with firewall rules, certificate policies, and access scoping — and then mounted in a cabinet at a remote site where the WAN port connects to an outdoor copper run with no surge protection. The software configuration is correct; the physical installation has an unaddressed vulnerability. A single surge event on the WAN port destroys the hardware that runs all those carefully configured controls. 

Ethernet surge protectors on VPN gateway WAN ports are not optional at remote or field-mounted sites. They belong in the gateway bill of materials alongside the gateway itself — specified at procurement, installed at commissioning, and verified at each annual maintenance visit. 

Secure Remote Access Starts with the Right Foundation 

A secure VPN connection is only one part of a reliable remote access strategy. Gateway placement, physical protection, surge protection, and secure network design all contribute to maintaining connectivity and protecting critical OT assets. From industrial Ethernet connectivity and surge protection to ruggedized networking solutions for harsh environments, L-com helps organizations build the physical infrastructure that supports secure, dependable remote access across industrial networks. 

Frequently Asked Questions 

Q1: What is an industrial VPN? 

A: An industrial VPN is a virtual private network solution designed for the specific requirements of OT (Operational Technology) remote access — connecting technicians, vendors, and corporate systems to PLCs, SCADA servers, HMIs, and other industrial control system components. It differs from an enterprise VPN in hardware requirements (ruggedized, DIN rail-mountable, wide-temperature, 24VDC-powered), protocol support (awareness of Modbus TCP, EtherNet/IP, DNP3, OPC-UA), latency characteristics (sub-100ms for OT responsiveness), and access scoping (vendor access limited to specific devices rather than broad network access). The most common form is a hardware IPsec VPN gateway deployed at the remote site or at the IT/OT network boundary. 

 Q2: What is the difference between IPsec and SSL/TLS VPN for industrial use? 

A: IPsec VPN encrypts at the IP layer — the entire IP packet is encapsulated and encrypted before transmission. It requires dedicated VPN client software or hardware gateways at both ends. SSL/TLS VPN (often called 'clientless VPN') operates at the application layer and can be accessed from a standard browser without a dedicated client. 

Q3: Do industrial VPN gateways support MFA? 

A: Modern industrial VPN gateways from major vendors (Moxa, Cisco, Cradlepoint, Secomea, Tosibox) support MFA through RADIUS/LDAP authentication integration with external MFA providers, certificate-based authentication (which is effectively a hardware MFA factor — you have the certificate, you authenticate), or built-in TOTP (Time-based One-Time Password) support. IEC 62443-3-3 and NERC CIP CIP-005 R2.1 both require MFA on all interactive remote access — a VPN that doesn't support MFA doesn't meet these requirements. Verify MFA capability before purchasing any VPN gateway for an OT environment subject to either standard.