A machine has shipped to a customer plant. Inside the cabinet sit a PLC and an HMI, and the only path out is the router. One parameter needs changing, so an engineer drives over and plugs in a cable. Keeping that trip from happening comes down to three things: whether the site has a public IP address, whether the customer IT team will open a port for a single device, and how far into the network an incoming session is allowed to reach. An industrial VPN router is not an encryption checkbox in this setting. It answers two narrower problems: making a device without a public address reachable, and confining whoever arrives to the part of the network where the work is.
The first thing to check is the address the device itself is given. Most cellular plans hand out carrier-internal addresses: the WAN port shows something in the 10.x or 100.64.x range, or disagrees with the egress address an external lookup returns, either of which means another layer of NAT sits in front. Waiting behind such an address for a connection from outside means port forwarding or a return route on the customer switch, and both require touching a network that belongs to someone else. Commissioning tends to stall on exactly that step.
Letting the site end initiate changes the picture. A tunnel is an outbound connection; only outbound traffic has to be allowed along the path, and no inbound port needs to be opened on the customer side. Portable travel routers handle the same situation the same way: join a hotel or public network, complete captive portal authentication where it is required, then have every client attach to the router side, with traffic returning through a tunnel to a gateway somewhere else. The only differences are that the borrowed network is now the plant egress and the devices being protected are PLCs rather than laptops.
Three paths outward are worth keeping open: wired broadband where a line can be pulled; cellular as the primary link rather than a fallback where it cannot; and the site wireless network as a temporary option. Whether data collection inside the station breaks during a switchover should be tested during commissioning.
The most common symptom once a tunnel is up: the router answers pings, the PLC beneath it does not. The reason is that each end of the tunnel needs two address ranges written in, the local LAN subnet and the subnet at the other end. Fill in only the device's own range and packets reach the gateway with nothing telling them where to go next. The fix is to list both ranges in the tunnel configuration and add a static route wherever one is missing.
The second frequent rework item is overlapping subnets. Dozens of identical machines leave the factory on the same LAN range, and once they are connected together the two networks collide. Assigning ranges per site or per machine number before shipment costs far less than renumbering later.
Acceptance testing is simple. After connecting, do not stop at pinging the gateway address. Ping the PLC address as well, then go online once with the programming software. Online means the link actually works.
Multi-protocol support pays off here by allowing a connection to a server that is already running and already approved by the end customer. Enhanced OpenVPN works as a client toward up to three servers and can also act as a server itself; configuration supports one-click import of .ovpn and PKCS#12 certificate files, and the peer can be open-source OpenVPN on an internal server or one of several common third-party servers. There is no need to bring in an entire new platform just to support remote maintenance.
Permissions line up with that approach: one certificate per person or per contractor, revoked or reissued the moment the person leaves site; routine maintenance runs over a long-lived tunnel while third parties get a separate one that stops existing when its term expires.
A tunnel solves reachability, not scope. What a session can see after arriving is set by rules on the LAN side: destinations restricted to the specific IP addresses and ports of the PLC and the supervisory computer, everything else denied. A few defaults are worth watching while writing rules: source MAC and source IP are mutually exclusive, so the source IP field stays empty when matching by MAC; the catch-all deny goes on the last line; and a restart has to be performed in the system before changes take effect. Testing that addresses on the list can connect and addresses off it cannot is itself the acceptance record.
Routine work does not have to travel over that tunnel every time. Parameter changes, reboots and firmware upgrades go to the remote management platform, whose SD-VPN reaches devices such as PLCs and HMIs directly. What still needs a person on site is limited to parts replacement, wiring and cleaning.
Walking through the three questions in order: whether that site has a public address, which end initiates the tunnel, and confining whoever arrives to the right place. With an industrial VPN router that speaks several protocols and can originate the tunnel from its own side, remote maintenance stops being a one-off project and becomes routine.
1. Which VPN protocols does the router support?
Official specifications for the USR-G816 and USR-G806w list five: PPTP, L2TP, IPSec, enhanced OpenVPN and GRE. More protocols means more room to match a server the customer already runs, without introducing a separate platform for remote maintenance.
2. Does static routing need configuring after the tunnel comes up?
It depends on the destination. Reaching the router's own management page remotely needs nothing. Reaching a PLC, HMI or camera behind it requires writing the remote subnet into the tunnel configuration and adding static routes where they are missing. The usual symptom is a gateway that answers pings while devices under it stay invisible.
3. Can a device behind NAT still be reached?
Yes, and no public address has to be requested for it. The site end initiates the tunnel, only outbound traffic is allowed along the path, and the customer needs no port forwarding and no return route. This holds even when the cellular network assigns a carrier-internal address.
4. How should subnets be planned for multiple devices?
Assign LAN ranges per site or per machine number before shipment so that ranges from different sites do not overlap and cause routing conflicts. Renumbering dozens of identical units after they are all online is work of a different scale.
5. How is temporary access handled for a third-party service contractor?
Open a separate tunnel, issue one certificate or account, and revoke or reissue it when the job ends. The tunnel kept permanently is for internal maintenance only.
6. Does routine maintenance still have to go through that tunnel?
Parameter changes, reboots, firmware upgrades, online status and signal quality all belong to the remote management platform. Only physical tasks such as parts replacement, wiring and cleaning still need a person on site.
7. How are offline status, weak signal and data overuse reported?
The manufacturer lists three real-time alerts: device offline, weak signal and data usage over limit, delivered by em
