Remote access to plant equipment, done right

Remote access to the plant is one of the most useful things you can set up. A controls person diagnosing a fault from home at 6 AM instead of driving in; a machine builder in Germany supporting your line without a plane ticket; you checking the weekend run from your kitchen table. All good things.

It's also, done badly, the single most common way industrial equipment ends up exposed to the entire internet.

The shortcut that isn't worth it

The tempting quick fix is port forwarding: poking a hole in the router so a connection from outside goes straight to the HMI or PLC. It takes five minutes and works immediately. The problem is that the hole isn't just for you — it's for all four-plus billion devices on the internet.

Automated scanners sweep the entire internet continuously, and search engines like Shodan catalog exposed industrial devices by type and location. A forwarded PLC port is typically found within hours. Many industrial protocols were designed decades ago for trusted networks and have no meaningful login at all — knocking on the port is the access. The same goes for exposing an HMI's remote desktop to the internet: it will see password-guessing attempts around the clock, forever.

What good remote access looks like

The right pattern is one locked door instead of many holes: a VPN (virtual private network) at the edge of your network, with three properties that matter more than the brand name on the box:

• Every person gets their own account. No shared "maintenance" login. When someone leaves or a vendor contract ends, you delete one account — instead of wondering who else knows the password.
• A second factor (MFA). A stolen password alone gets an attacker nothing.
• Each account sees only what it needs. Your machine vendor gets a path to their machine — not your whole network. This pairs naturally with the network segmentation we cover in another article.

Add two operational habits: vendor accounts stay disabled except during scheduled support, and the gateway logs every session so there's a record of who connected, when, and to what. When a machine misbehaves the day after a remote session, that log answers questions that otherwise turn into finger-pointing.

What about the vendor's cloud box?

Many machine builders now ship a cellular or cloud-connected remote access appliance with the machine. These can be fine — the good ones are essentially a managed VPN — but they deserve the same questions: Can you see when it's used? Can you disable it? Does it reach only that machine, or your whole network? An appliance you can't audit or switch off is a hole in the wall you don't control. We recommend putting vendor boxes behind your own firewall rules so the answer to "what can it reach?" is decided by you.

The bottom line

Remote access isn't a risk to avoid — it's a capability to build properly. One gateway, individual accounts, MFA, scoped access, logging. If your current setup involves a port forward someone set up years ago "temporarily," that's worth fixing this month, not someday. (Related: see our article on the Windows 11 24H2 WireGuard issue if your VPN clients recently stopped connecting.)

Serlixer implements secure remote access for plants — VPN gateways, vendor access policies, and the firewall rules behind them. Contact us to review how your equipment is reached today.