Networking · 9 min read · Updated November 2026
Secure Remote Access for OEM Machines: Zones, VPN and the Rules That Keep Everyone Happy
Every machine builder wants remote access to its machines and every plant IT department wants to refuse it. Both are right. The architecture that satisfies both — a controlled gateway, per-machine zones, per-user accounts and logging — is well understood and not expensive. What to buy, how to configure it, and the contract language that makes it stick.
The typical bad arrangement: the OEM installs a cellular router in the machine cabinet with its own SIM, connects it to the machine PLC and to the plant network "for the HMI", and keeps a permanent VPN to its own service centre. Nobody at the plant knows the router's password or what it can reach; the OEM's technicians share one login; the plant's firewall never sees the traffic. It works until an audit, an incident, or a technician who left the OEM two years ago still having the credentials. The good arrangement costs about the same and takes a day to set up per site.
Principles
- The plant owns the door. Remote access enters through a gateway the plant controls, not through OEM-owned side channels. OEM cellular routers are acceptable only if they are configured and monitored by the plant, or isolated so they reach only their machine.
- One machine, one zone. Each OEM machine is its own IEC 62443 zone behind a router/firewall; an OEM session is confined to that zone. Two machines from the same OEM do not see each other unless the plant explicitly allows it.
- People, not companies, get accounts. Named users, MFA, time-limited sessions, access requested and approved per session or per maintenance window.
- Everything is logged — who connected, when, to what, and ideally a session recording for engineering connections.
- Access is default-off. The plant enables it for a window; the OEM does not have standing access unless a contract says so and the plant has decided to accept that.
Three architectures that work
| Architecture | How it works | Fits | Products |
|---|---|---|---|
| Central VPN gateway + machine firewalls | Technicians VPN into a plant DMZ gateway with MFA, then are routed by firewall rules to the specific machine zone; each machine has a small security router doing NAT and filtering | Plants with IT capacity and many OEMs | Plant gateway: FortiGate/Palo Alto/Sophos or Hirschmann EAGLE; machine router: EAGLE40, Phoenix mGuard, Siemens SCALANCE S, Moxa EDR |
| Cloud-brokered remote access (OEM style, plant controlled) | A machine router with outbound-only TLS connection to a broker service; plant admin approves users and sessions in the portal; no inbound ports on the plant firewall | Machine builders with a fleet, plants without IT staff | HMS Ewon Cosy/Flexy with Talk2M, Secomea SiteManager, Siemens SINEMA Remote Connect, Phoenix mGuard Secure Cloud, Moxa Remote Connect |
| Cellular out-of-band with isolation | Machine router with LTE (OnCell G3150A) connected only to the machine zone, never bridged to the plant LAN; VPN to a plant-controlled or broker endpoint | Remote sites, standalone machines, pilot plants | Moxa OnCell, Ewon Cosy+ 4G, Teltonika RUT, InHand |
Of the three, cloud-brokered gateways are the most common in 2026 because they need no inbound firewall rules and give the plant a portal where it can see and approve every session. The condition is that the plant, not the OEM, administers the account for its site — the OEM is a user, the plant is the owner.
Configuration checklist for the machine router
- WAN side to the plant network or LTE; LAN side to the machine only. No bridging. Static route or NAT so the machine's internal addresses are not exposed.
- Firewall: deny all; allow the specific protocols the OEM needs (engineering port of the PLC, HMI VNC/web, OPC UA) only from the VPN tunnel; allow the plant SCADA to read the machine (Modbus TCP/OPC UA) on defined ports; log drops.
- Management interface only from the plant management VLAN; HTTPS/SSH only; default credentials changed; firmware current; configuration backed up.
- VPN: IPsec or OpenVPN/WireGuard with certificates, per-user credentials, MFA at the gateway or broker, idle timeout, maximum session length.
- Time-limited enable: a physical key switch, an HMI button or a portal approval that opens the tunnel for a defined window. Many plants use a key switch on the cabinet door connected to the router's digital input — simple and auditable.
- Logging to the plant syslog/SIEM; session start/stop and rule hits.
Contract and process language
The technology fails without the paper. Clauses we recommend in machine purchase and service contracts: remote access only through the plant's designated gateway; named technicians with individual credentials, revoked within 24 hours of leaving the OEM; access limited to the machine zone; sessions approved by the plant and logged; no standing access except for defined monitoring data flows (outbound telemetry only); OEM notifies the plant of changes made during a session and provides a change log; the OEM meets IEC 62443-2-4 or equivalent and names a security contact; the plant may audit. For NIS2-covered operators these clauses are also supply-chain evidence (see the NIS2/CRA checklist).
Monitoring data is a separate, easier problem
OEMs often want remote access mainly to collect machine data. That does not need an inbound connection at all: an edge gateway publishes MQTT or OPC UA data outbound to the OEM's platform through a data diode-style rule (outbound only, no return path to the machine). Separate the two use cases — data out, engineering in — and the engineering access can be rare, approved and short, which is what everyone wanted in the first place.
Need engineering help with this?
Our engineers apply this to real projects every week — selection, specification, commissioning. Send your question or a part number.
Quick answers
Can the OEM keep its own cellular router in the machine?
Yes, if the router is isolated to the machine zone, the plant holds the administrator credentials or has an equivalent portal role, sessions are logged and approved, and the router cannot bridge into the plant LAN. Otherwise it is an uncontrolled backdoor and most IT departments will rightly refuse it.
Which is better, a site VPN or a cloud broker like Talk2M or SINEMA RC?
For plants with IT staff and many OEMs, a central VPN gateway gives the most control. For plants without IT capacity and for machine builders managing fleets, a cloud broker is simpler and needs no inbound ports; insist that the plant administers its own site in the portal.
Do you supply and configure remote-access hardware?
Yes — Hirschmann, Moxa, Phoenix mGuard and HMS Ewon routers and gateways, pre-configured with the zone, firewall rules and VPN profile for your site, with documentation for the 62443 evidence file.