Designing remote access to industrial PCs and other site equipment can be challenging. Integrators and engineers need to understand what works, what doesn’t and what will avoid compromising security in each particular application before going ahead.
An electricity retailer we work with uses our M2M SIM cards, with industrial routers on a private M2M network carried on Telstra’s 4G mobile network, to connect their metering servers to hundreds of residential electricity meters across their service area. The meters aren’t on the internet. They aren’t accessible from the internet. The only path to them is through the private network, and only authorised devices can see them. It’s simple, secure, and has been running reliably for years.
At the other end of the spectrum, we have seen industrial data loggers deployed with standard SIMs with extranet access enabled, giving each device an IP address on the public internet. The result was predictable: devices were accessed by unauthorised parties, data was wiped, and abnormally high data usage patterns indicated the devices were being actively probed or exploited.
Between these two extremes sits every remote access decision an integrator or engineer will make for an industrial site. The right approach depends on what equipment is on site, how critical it is, and whether a general-purpose industrial PC is involved. Getting it wrong doesn’t just create an inconvenience. It creates a security exposure that compounds over time.
Sites without a PC are the simplest case
Many remote industrial sites don’t have a PC. They have a data logger, a PLC, an electricity meter, a flow sensor or some other task-specific device that needs to communicate back to a central system. Remote access to these sites is primarily about data retrieval and basic configuration, not full desktop interaction.
For these sites, M2M SIM cards provisioned on Telstra to have a private 4G network are the most practical and secure approach. The devices are not on the internet, can’t be reached from the internet and communicate only within the private network.
There are two common configurations, depending on the number of sites:
1. SIM-to-SIM networking works well for smaller numbers of remote sites. Each SIM receives a private static IP address, and the SIMs can see each other across the 4G network. One SIM is installed in an industrial router at each remote site, and another is kept by the engineer or operator with a 4G router at their office or in a vehicle. The engineer can connect to any remote site directly through the private network.
2. VPN to multiple 4G sites suits larger deployments. A VPN service is established that connects into the private 4G network. The user installs VPN software on their computer, logs in, and gains access to the remote devices through the private network. The remote SIMs can’t see each other, which provides an additional layer of isolation between sites. Only the VPN connection can reach the remote devices.
In both cases, the M2M SIMs can be configured with or without internet egress, depending on requirements. Some site equipment may need outbound internet access for NTP time synchronisation or firmware updates. If internet egress is enabled, the network is firewalled to prevent inbound access from the public internet. If it’s not needed, disabling internet egress entirely eliminates the attack surface.
One of our customers uses serial modems at both ends of 4G links to connect several tide gauges and wave buoys back to their head office. The links carry serial data only, which means there is no IP-level attack surface at all. Even so, their IT department requires us to monitor data usage on each link and flag any usage above normal patterns. That level of vigilance is appropriate. Even on a well-designed private network, monitoring for anomalies is good practice.
Why sites with PCs are more complicated
When an industrial PC is part of the remote site, the remote access problem changes fundamentally. A PC runs a general-purpose operating system with a large attack surface. It may be networked to PLCs, SCADA systems, I/O devices and other equipment on a local site network. Remote access to the PC potentially provides access to everything it can reach.
This is why IT and OT teams treat remote PC access differently from remote access to a simple data logger or meter. A data logger has a small, fixed set of functions and a minimal attack surface. A Windows PC has a full operating system, network stack and the ability to run arbitrary software. If compromised, it becomes a foothold into the entire site network.
There are several approaches to remote access in this scenario, each with different trade-offs.
Cloud-based remote access tools such as Splashtop, TeamViewer or AnyDesk are straightforward to set up and work across most network configurations. The connection routes through the vendor’s cloud infrastructure, which means the PC needs internet access. This introduces two concerns for industrial applications. First, the PC is now on the internet, and will attempt to download updates, telemetry and other outbound connections automatically. Second, the security of the remote access depends on the vendor’s cloud infrastructure and authentication systems, which are outside your control. For office environments this is often acceptable. For industrial PCs controlling critical processes, many OT teams are understandably uncomfortable with it.
RDP or VNC over a private network avoids the internet entirely. If the PC has an embedded 4G module or is connected through an industrial 4G router with an M2M SIM on a private network, RDP or VNC can provide direct remote access without any data passing through the public internet or a third-party cloud service. Combined with Windows 11 IoT Enterprise LTSC, which does not receive feature updates and can be tightly configured, this provides a stable and controllable remote access path. RDP should be configured for encrypted connections, and the firewall should be set to allow connections only from specific IP addresses on the private network. M2M SIMs with static IP addresses make this practical.
IPMI out-of-band management provides the deepest level of remote control. IPMI operates independently of the operating system, through a dedicated network port on the server motherboard. It allows full remote access to the BIOS, the ability to power cycle the machine, mount virtual media and reinstall the operating system, all as if the operator were physically at the console. We built custom industrial servers for an electricity utility with IPMI on a dedicated management network. Their engineers could fully recover a server remotely without a site visit, even if the operating system had failed completely. RDP and VNC only work while the OS is running. If the OS crashes or fails to boot, software-based remote access is useless. IPMI works regardless of the OS state, which makes it the only true remote recovery option for critical systems.
Embedded 4G module or external router?
When a PC needs cellular connectivity, the choice between an embedded 4G module inside the PC and an external industrial 4G router affects both the network design and the recovery options.
In our experience, most customers choose an external industrial router. The reasons are practical. An external router provides a single point of network management for the site, handles routing and firewall rules independently of the PC and keeps the cellular connection separate from the PC’s operating system. Many industrial routers also include relay outputs or digital outputs that can be wired to the PC’s power supply, enabling remote power cycling of the PC if it becomes unresponsive. This is a simple but valuable capability. If the PC locks up and software-based remote access fails, being able to power cycle it remotely through the router can avoid a site visit.
An embedded 4G module makes sense when the PC is a standalone unit with no other networked devices on site. In that case, the simplicity of a single device with built-in connectivity may outweigh the flexibility of a separate router. But if the PC is connected to a local site network with PLCs, switches or other equipment, an external router provides better separation and more options for managing the network.
Router reliability and recovery
Industrial 4G and 5G routers from manufacturers like Lantronix, Teltonika and Advantech are designed for unattended operation at remote sites. They include features that consumer and enterprise routers do not, and these features matter for maintaining reliable remote access over months and years without a site visit.
Connectivity watchdogs automatically reboot the router if connectivity is lost. These typically work by pinging a specified IP address at regular intervals. If the ping fails repeatedly, the router reboots itself. On a private network without internet access, the ping target needs to be chosen carefully, as public addresses like 8.8.8.8 may not be reachable, although some private networks do allow access to specific addresses like this for the purpose of ping watchdogs. Alternatively the watchdog could be pointed to a server or device on the private network that is known to be always available.
Timed automatic reboot is another popular feature of industrial routers. This simply restarts the router at timed intervals, for example you might set it to reboot every 48 hours. We have been asked to enable this by several customers with distant remote sites, as it gives an additional layer of assurance that the router will at least attempt to restart by a particular time if there’s no other way to gain remote access to it.
Dual SIM support allows the router to fail over to a second cellular network if the primary network goes offline. Cellular outages do happen, and for critical sites, having a backup path on a different carrier provides an additional layer of resilience.
SMS diagnostics and remote SSH provide alternative access paths if the primary data connection fails. An engineer can send an SMS command to check the router’s status, retrieve diagnostic information or trigger a reboot, even when the data connection is down. SSH access, where available, provides full command-line management of the router. However, it’s important to configure the security settings for SMS commands, to prevent unauthorised use. This can include whitelisting phone numbers and setting up passwords for SMS commands.
These capabilities mean that in most failure scenarios, the router itself can be diagnosed and recovered remotely. The site visit becomes the last resort rather than the first response.
Maintaining security
Every remote access path is a potential attack vector. The question is not whether to provide remote access, but how to provide it with the minimum necessary exposure.
For sites without a PC, M2M SIMs on private networks with no internet egress provide a strong security posture with minimal complexity. For sites with a PC, keeping the PC off the public internet, using private network connectivity and restricting access to known IP addresses reduces the attack surface to a manageable level. IPMI on a dedicated management network provides the deepest remote control without depending on the operating system.
The worst outcome is a remote access design that provides convenience at the expense of security. A PC on the public internet with RDP open to all addresses is not a remote access solution. It is an invitation for security compromises and failures.
What to configure before a PC goes to site
Remote access that works reliably months or years after commissioning requires deliberate configuration at the outset. The specific settings depend on the site network design, but the following principles apply broadly.
Set static IP addresses on all site equipment and maintain documentation of the IP address map. This applies to the PC, the router, PLCs and any other networked devices. DHCP is convenient but unreliable for long-term unattended operation. A device that acquires a different IP address after a power cycle can break remote access and inter-device communication.
Configure RDP or VNC with encryption and restrict access to specific source IP addresses in the Windows firewall. On a private M2M network with static IPs, this is straightforward and provides a meaningful layer of access control.
Control Windows updates deliberately. Disable automatic updates and schedule them for times when engineering staff can monitor the process. Automatic updates introduce a risk of unexpected changes to firewall rules, network configuration, or system behaviour. Windows 11 IoT Enterprise LTSC reduces this risk significantly by eliminating feature updates entirely, but security patches should still be applied on a controlled schedule.
Configure the router watchdog and failover settings before deployment and test them. Verify that the ping target is appropriate for the network design and that the reboot behaviour is correct.
Wire the router relay output to the PC power supply if the router supports it. Test that a remote power cycle command successfully reboots the PC and that it comes back up correctly, reconnects to the network, and resumes normal operation.
Design the PC to tolerate a hard power loss. Another way that remote industrial PCs can stop working is if an SSD gets corrupted by a sudden power loss during a write cycle. While Windows 11 includes several features to recover from unexpected power loss, it’s better to take a few extra measures to minimise SSD corruption. Specify industrial SSDs with power loss protection bult in, so they complete any pending writes in the event of a power failure. Disable write caching in Windows. And if the application allows it, Windows 11 IoT Enterprise’s Unified Write Filter can make the operating system partition read-only and separated from data partitions, which gives excellent protection from systems failing due to power loss data corruption.
Document everything. The remote access configuration, credentials, IP addresses, SIM details, VPN settings, Windows configuration settings and router login details should all be recorded and stored as part of the site handover package. Remote access that nobody can log into because the credentials were lost is not remote access at all.
How ESIS can help
We supply industrial 4G and 5G routers, M2M SIM cards with private network configurations, industrial PCs with optional embedded 4G modules, and servers with IPMI remote management. We can help you design a remote access approach that matches the security requirements and operational realities of your site.
Whether you are connecting a single data logger at a remote location or designing remote access for a network of industrial PCs across multiple sites, we can advise on the hardware, the network configuration and the practical details that keep remote access working reliably over the long term.
