Remote access to PLCs, HMIs and field devices is required in industrial automation for commissioning, maintenance and diagnostics. Two popular architectures include industrial gateways with VPN support access and cloud-based remote access solutions.
Both provide secure connectivity between field networks and external users, but they differ significantly in network topology, data routing, deployment complexity, and operational control.
This article provides a structured comparison of both approaches and uses a real-world industrial gateway (Tespro TG-325) as a reference implementation of the VPN-based edge architecture.
1. Industrial Gateway with VPN Support
An Industrial Gateway with VPN Support serves as an edge node that creates a secure VPN tunnel to a trusted remote location within a plant network from a corporate VPN or engineering workstation.
The Gateway is located adjacent to the field devices. It usually performs protocol conversions is capable of basic data filtering and processing, and then transmits the data over a VPN to secure the channel.
Core Architecture Characteristics
• Encrypted point-to-point tunneling
VPN sessions are terminated at the Gateway. The Gateway is the only exposed device to an external network.
• On-site protocol aggregation and conversion
Supports industrial protocols such as Modbus RTU/TCP, OPC UA, DL/T 645, etc. to facilitate/ensure unified data transmission.
• Edge computing capability
On-site processing, filtering, and logic execution can minimize data transmission, and even possibly improve telemetry latency.
• Operational continuity during network failure
Data transfer and device monitoring can continue to operate with the same logic, even if the external WAN is disconnected.
2. Cloud-Based Remote Access Systems
Cloud-Based Remote Access Systems use field devices to connect to a centralized cloud service to generate a remote access session for users to connect to the plant network.
This architecture eliminates direct plant network connections and simplifies firewall policy.
Core Architecture Characteristics
• Cloud-Based Remote Access
All sessions are managed and brokered via services on the cloud.
• No inbound port exposure
Field devices create outbound connections to services on the cloud via HTTPS, simplifying the policy on the firewall.
• Centralized device and user management
User management, device management, permission management, and logging are provided via web interfaces on the cloud.
• Variable latency path
Datapaths are commonly: user → cloud → plant. Each leg may add latencies depending on the cloud region and the routing.
3. Technical Comparison
| Dimension | Industrial Gateway with VPN Support | Cloud-Based Remote Access |
| Connectivity Model | Direct encrypted tunnel to VPN endpoint | Cloud-based session broker |
| Data Path | Plant ↔ Remote endpoint | Plant ↔ Cloud ↔ Client |
| Deployment Complexity | Medium to High (VPN config, routing, certificates) | Low (Agent, cloud registration) |
| Firewall Requirements | Controlled VPN config | No inbound ports required |
| Edge Processing | Supported | Agent dependent |
| Offline Operation | High local autonomy | Variable, platform dependent |
| Security Model | Plant perimeter control | Cloud provider co-shared |
| Protocol Handling | Supports multi-protocol at edge | Requires cloud-compatible agents |
| Cost Structure | Hardware dependent, low recurring costs | High recurring costs, per user/device/license |
4. Typical Application Scenarios
Industrial Gateway with VPN Support best meets the needs of:
• Industrial sites with stable internet access that require on-premise data control
• Sites with unstable or intermittent internet access
• Legacy industrial systems which require on-site protocol conversion
• Real-Time Control applications which require low latency and high determinism
Cloud-Based Remote Access best meets the needs of:
• Industrial sites with distributed assets and minimal IT presence
• Site control applications which require control and data aggregation and are
• Low barrier to entry and rapid deployment business model.
5. Hybrid Deployment Model (Most Common)
Many contemporary industrial designs utilize a hybrid model. Here are few examples:
• Embedded IPsec gateways provide secure, low-latency remote engineering and maintenance on demand. The cloud provides a fleet-level service with monitoring, telemetry, and analytics.
Some of the advantages of this model are:
• Deterministic control paths provided by the VPN
• Cloud architecture provides scalable information visibility.
6. Reference Implementation: Tespro TG-325
The Tespro TG-325 is a VPN industrial gateway with a contemporary design featuring edge computing, multi-protocol integration, and industrial connectivity.
VPN and Connectivity Options
• 5G/4G cellular + 4 ports of Gigabit Ethernet LAN
• OpenWrt/LEDE based Linux architecture
• Supports tunneling with standard VPN protocols (OpenVPN, WireGuard) to enterprise VPNs
Integration of Industrial Protocols
• Interfaces: 2 × RS485, 1 × RS232, GPIO
• Supports protocols such as Modbus RTU/TCP, DL/T 645, MQTT, OPC UA, etc.
Edge Computing Support
• Supports execution of Python, C++, and Lua
• Allows edge pre-processing of data and execution of control logic
• Decreases VPN bandwidth by sending the processed data instead of raw data
Design for Industrial Reliability
• Temperature range: –40°C to +75°C
• Reverse polarity protection and surge protection
• Designed for extreme industrial environments
Example of Field Deployment
Over 1,000 TG-325 units were deployed in remote sites for solar energy and grid monitoring across a distribution energy project in Latin America.
The reported outcomes included:
• 99.5% reliability of data transmission
• Monitoring response time improved by almost 35%
• Resilience through multi-network redundancy including cellular connections
The design integrated a cloud-based monitoring system with VPN-based edge protection. This located the gateway as the main on-site data aggregation and secure communication unit.
Final Words
When choosing an industrial gateway with VPN capability or a cloud-hosted remote access solution, the choice is largely based on the design rather than the available functionality.
VPN-focused gateways prefer:
• Local control
• Deterministic performance
• Edge autonomy
Cloud-focused technologies prefer:
• Centralized control
• Ease of deployment
In many contemporary industrial systems, the aforementioned systems integrate to provide the gateway secure industrial connectivity and the cloud system service provide industrial system visibility and analytics.
The TG-325 is a good example of how industrial gateways have moved beyond the capability of a simple communication bridge to a multifunction edge computing and secure connectivity gateway.
FAQS
Q1: How does remote access via cloud service work?
User-device connections are established via a communication-brokering cloud platform.
Q2: What is more secure, VPN gateway or cloud access?
Both systems can be secured if configured as such, but controlling infrastructure-bound VPN gateways increases security levels.
Q3: Do VPN gateways require internet connectivity?
Yes, though they can function locally in internet downtime.
Q4: What is the key benefit of remote access via cloud services?
This enables easy access and management with limited infrastructural set up requirements.
Q5: Can a number of protocols be supported by industrial gateways?
Yes, the majority support a number of protocols for device integration, such as Modbus, OPC UA and MQTT.
