r/IOT • u/banalytics_live • 12d ago

Question: Distributed equipment integration

Guys, how do you handle equipment integration in distributed & isolated networks?

For example: when you have different industrial equipment at multiple remote sites, with each site behind its own firewall/NAT.

Is the usual approach still just VPN between sites and then deal with everything on top of that?

I'm particularly interested in the security side - how much of a pain is it to get this approved by enterprise security teams? Things like opening ports, managing VPN credentials/certificates, etc.

3 Upvotes

100% Upvoted

9 comments sorted by

2

u/alanaro_ 11d ago

I would separate two things that often get bundled together: the telemetry data path and human engineering access.

For monitoring, each site can keep a collector inside the OT zone and have that collector initiate a mutually authenticated TLS connection to a central MQTT/HTTPS endpoint. The firewall policy then becomes a small outbound destination/port allow-list, with no inbound route and no lateral site-to-site path. Give every site or collector its own credential so one compromise can be revoked without touching the fleet, and buffer locally through WAN outages. A VPN or brokered remote-access service still makes sense for PLC programming, RDP and maintenance, but that should be a separate, MFA-protected and audited path rather than the permanent telemetry transport.

The security review usually goes better when you bring a data-flow diagram, zone boundaries, egress matrix, certificate issuance/rotation/revocation plan, update ownership and audit requirements instead of asking for "IoT access". At gigabytes per day, also decide explicitly which raw samples must leave the site. Aggregate or filter locally only where losing the raw resolution is acceptable.

We have built Connhex around this split, so I am not neutral. Connhex Edge can run on a Linux system at each site, collect OPC UA locally, keep a durable buffer and establish the cloud connection over MQTT, secure WebSockets or HTTPS using per-device X.509 credentials, without an inbound port or VPN. It does not replace OT segmentation or the controlled engineering-access path, and non-OPC-UA sources still need an appropriate local adapter. If the real requirement is only remote human access, use a standard VPN or zero-trust access product instead of an IoT platform.

1

u/banalytics_live 11d ago

what if you used an encrypted P2P tunnel for the TCP/UDP traffic?

Something like this:

[You] > [Site A Agent (server socket)] > encrypted P2P > [Site B Agent (client socket)] > [internal service]

2

u/alanaro_ 9d ago

That can work, but I’d classify it as a remote-access path rather than the normal telemetry path.

Encryption protects the traffic, but it does not solve every part of the problem. If both agents are behind NAT, the "server" side may still need a rendezvous mechanism, hole punching or a relay when a direct path cannot be established. More importantly, a generic TCP/UDP tunnel can recreate the lateral-access problem you were trying to avoid: compromise one agent and the attacker may gain a route to an internal service.

I’d therefore scope each tunnel to one explicitly allowed service and port, authenticate both agents independently, avoid subnet routing, make sessions time-limited where possible, log every connection and keep per-site revocation.

For continuous telemetry, outbound publishing to a central endpoint is usually simpler to approve and operate. The P2P tunnel is more useful for exceptional maintenance or protocols that genuinely require an interactive bidirectional session

1

u/banalytics_live 9d ago

Thx, I'm thinking along the same lines

1

u/rustingtoncat 12d ago

As soon as you mention IOT any IT department will immediately shut you down. Nobody trusts it. We do all of our deployments via cellular connection not touching the corporate LAN. Either LoRaWAN with cellular backhaul, or NB-IoT with cellular devices.

1

u/banalytics_live 12d ago

What about SCADA? Equipment monitoring, real-time data analysis, ... - when daily traffic exceeds gigabytes?