Secure remote service uses an industrial router that opens an outbound VPN tunnel to the technician, with no port forwarding on the customer's firewall. Access should be on demand, logged and limited to the machine network.
Why OEMs need it now. End users expect response in hours, while plant IT rejects anything that exposes the factory network. A machine-level VPN meets both constraints.
Three architectures. Hardware point-to-point VPN (plug & go, no third-party cloud); cloud-brokered VPN (central user management); self-hosted OpenVPN/IPsec (full control, needs in-house IT skills). Reuse the comparison table above.
Minimum security. Network segmentation, MFA for technicians, local consent switch, retained session logs, IEC 62443 as the OT reference.
Choosing the router. LAN ports, WAN plus 4G/5G uplink, digital inputs for consent, DIN-rail mounting, 24 V DC supply, central firmware management.
Do I need to open ports on the customer's firewall?
No, modern industrial routers connect outbound.
Can I use a 4G SIM instead of the customer network?
Yes, with a router that has a built-in cellular modem.
How do I prove access is controlled?
Local consent, session logs and named users with MFA.
What if two machines share a subnet?
Use 1:1 NAT on the router or a separate VPN per machine.
