What is a VPN?
A VPN (Virtual Private Network) is a technology that sets up an encrypted and authenticated connection, known as a tunnel, over an untrusted network such as the internet, so that remote networks or devices can communicate as if they were on the same local network. A VPN protects the confidentiality and integrity of traffic in transit and controls who is allowed to establish the tunnel. In industrial environments the VPN is the most common route for remote access by technicians and suppliers to SCADA, PLCs and an engineering station. Precisely for that reason, the VPN gateway is also one of the most popular attack routes into OT.
🔐 Why use a VPN?
- Secure Remote Access - employees and suppliers reach internal systems without those systems being exposed directly to the internet
- Protection against eavesdropping and tampering - encryption and integrity checks make intercepted packets useless
- Linking networks - two sites behave as if they were locally connected
- Access from IT to OT - managing and monitoring OT environments from the office or external locations, provided it is properly shielded
🏗️ How does a VPN work?
A VPN combines three mechanisms:
- Tunnelling - the original IP packet is wrapped (encapsulated) in a new packet between two endpoints, for example client ↔ VPN gateway or OT Network ↔ IT network
- Encryption - the contents of the tunnel are encrypted with modern algorithms such as AES-GCM or ChaCha20-Poly1305
- Authentication - both sides prove their identity with certificates, pre-shared keys or user accounts, ideally supplemented by MFA
After authentication the endpoints negotiate session keys, and from then on all traffic flows encrypted through the tunnel. Importantly, once a user has logged in, they are in principle inside the network. What they can reach there is determined by the firewall rules behind the VPN, not by the VPN itself.
🧩 Which types of VPN and protocols exist?
There are two main forms. A site-to-site VPN permanently connects two networks through gateways or routers, for example a pumping station with a central control room. A remote access VPN connects a single user running a client application to the corporate network.
| Protocol | How it works | Characteristics | Typical use |
|---|---|---|---|
| IPsec (IKEv2) | Network layer; IKEv2 (RFC 7296) on UDP 500, NAT traversal on UDP 4500, data via ESP (IP protocol 50) | Open standard, widely supported by firewalls and routers | Site-to-site, increasingly also remote access |
| SSL/TLS VPN | Over TCP 443, often with DTLS over UDP as a faster variant | Passes through almost any firewall; also available as a clientless web portal | Remote access for staff and suppliers |
| OpenVPN | Own protocol that uses TLS for key exchange, over UDP or TCP | Open source, flexible, common in industrial remote access routers | Remote access and small site-to-site links |
| WireGuard | Network layer over UDP (default 51820), in the Linux kernel since 5.6 (March 2020) | Around 4,000 lines of code, fixed modern cryptography (Curve25519, ChaCha20-Poly1305) | Modern remote access and mesh networks |
The term “SSL VPN” is historical: in practice TLS is used, because SSL itself has long been deprecated. Notably, Fortinet removed the tunnel mode of its SSL VPN in FortiOS 7.6.3 (2025) in favour of IPsec (optionally over TCP 443), a move widely seen in the light of the long series of vulnerabilities in SSL VPN portals.
🏭 How is a VPN used in industrial environments?
| Application | Example |
|---|---|
| Remote access | A technician securely logs in to a PLC or SCADA system to troubleshoot a fault |
| Remote maintenance | A machine builder supports a production line from abroad |
| Remote monitoring | A cloud platform analyses data from the historian |
| Remote administration | Managing IT/OT networks from other locations |
| Inter-site connections | Connecting multiple plants, pumping stations or substations via site-to-site VPN |
VPNs often form one layer of the Defense in Depth principle for network security. The IEC 62443-3-3 standard, through requirement SR 1.13 (Access via untrusted networks), requires that all access via untrusted networks is monitored and controlled, and its rationale cites VPN technology as a way to prevent unauthorised connections.
⚠️ Why is the VPN gateway such an attractive target?
A VPN gateway is exposed to the internet by definition and, after a successful login, grants access to the internal network. That has made VPN appliances a favourite target of both state actors and ransomware groups since 2019:
| Incident | Year | What happened? |
|---|---|---|
| Fortinet CVE-2018-13379 | 2019–2021 | Path traversal in the SSL VPN portal leaked passwords; credentials for around 87,000 devices were published online |
| Colonial Pipeline | 2021 | Intrusion via an unused but still active VPN account without MFA; the pipeline was shut down from 7 to 12 May 2021 |
| COATHANGER (FortiGate) | 2022–2023 | A Chinese state actor exploited CVE-2022-42475, including at the Dutch Ministry of Defence; according to Dutch military intelligence (MIVD) at least 20,000 FortiGate systems worldwide were hit |
| Citrix Bleed (CVE-2023-4966) | 2023 | Leaked session tokens from NetScaler gateways, allowing attackers to bypass both password and MFA |
| Ivanti Connect Secure | 2024 | A combination of CVE-2023-46805 and CVE-2024-21887 enabled remote code execution; CISA demanded immediate mitigation in Emergency Directive ED 24-01 |
Many of these flaws were zero-days: they were exploited before a patch existed. Even after patching, an appliance can remain compromised; COATHANGER even survived firmware upgrades. The Dutch NCSC and the US CISA therefore explicitly warn about edge devices such as VPN gateways.
🛡️ How do you secure a VPN for OT access?
The CISA/NSA guidance Selecting and Hardening Remote Access VPN Solutions (September 2021) and OT practice lead to these steps:
- Never terminate the VPN directly in the OT network - let the tunnel end in a DMZ or IDMZ, in line with the Purdue Model
- Place a jump server behind the VPN - users only land on a managed intermediate host, from which sessions to OT systems are set up and recorded, possibly via PAM
- Enforce MFA on every account - preferably phishing-resistant (FIDO2 or certificate-based), and disable unused accounts immediately
- Apply least privilege - firewall rules per user or role, only to the specific installation and ports that are needed
- Patch the gateway as a priority - VPN appliances belong at the top of patch management; actively track CVEs and vendor advisories
- Reduce the attack surface - disable unused features such as web portals and use a standards-based, certified solution
- Log and monitor everything - send logs of login attempts and sessions to a SIEM and watch for logins from unexpected locations or at unusual times
- Suppliers on demand only - enable supplier accounts only for a specific maintenance job and make this part of supplier security
For organisations covered by NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet) this carries extra weight: Article 21 of NIS2 explicitly lists the use of multi-factor authentication as a measure, where appropriate.
🔄 What is the difference between a VPN and ZTNA?
A traditional VPN grants access to a network segment after login. Zero Trust Network Access (ZTNA) follows the Zero Trust model from NIST SP 800-207: a broker verifies identity, device posture and context, and then grants access to one specific application or system only.
| Characteristic | VPN | ZTNA |
|---|---|---|
| Access level | Network or subnet | Specific application or asset |
| Trust | Implicit after login | Reassessed per session and per request |
| Visibility | Gateway visible on the internet | Applications hidden behind a broker, often without inbound ports |
| Lateral movement | Possible if firewall rules are broad | Heavily restricted |
| Use in OT | Widely available, simple, also for site-to-site | Growing, mainly for supplier and user access |
In OT the VPN will not disappear soon: site-to-site links between locations remain common. For user access, however, many organisations are moving towards ZTNA or towards a VPN combined with a jump server, session recording and strict network segmentation.
❓ Frequently asked questions
Is a VPN enough to access OT systems securely from a distance?
No, a VPN only secures the connection, not the user’s device or the OT system itself. Secure remote access to OT also requires MFA, a jump server in a DMZ, least privilege and logging of all sessions.
Which is better for OT: IPsec or an SSL VPN?
IPsec is the common choice for fixed site-to-site connections and is increasingly used for remote access as well. An SSL VPN passes through firewalls more easily, but SSL VPN portals have had many serious vulnerabilities in recent years. More important than the protocol is that the gateway is patched, hardened and protected with MFA.
Why are VPN appliances so often targeted by attackers?
VPN appliances are exposed to the internet by definition and, once compromised, give direct access to the internal network. They also often run closed firmware without endpoint protection, so an intrusion can go unnoticed for a long time. Flaws in products from Fortinet, Ivanti and Citrix have therefore been exploited on a large scale.
What went wrong with the VPN at Colonial Pipeline?
Attackers logged in through an old VPN account that was no longer in use but had not been disabled, and that was protected by a password only. That password had appeared in a leaked collection. With MFA and timely removal of unused accounts, this access would very likely have been blocked.
Is WireGuard suitable for industrial applications?
WireGuard is fast, compact and uses modern cryptography, and it has been part of the Linux kernel since 2020. More and more industrial routers support it. For larger environments, however, the base protocol lacks features such as central user management, so a management layer or commercial solution is needed.
Will ZTNA replace the VPN in OT environments?
ZTNA mainly replaces the remote access VPN for users and suppliers, because it grants access per application rather than to an entire network. Site-to-site VPNs between locations remain in normal use in OT. Many organisations combine both during a gradual transition.
📌 In summary
A VPN makes it possible to gain remote, encrypted access to internal networks and systems, but the VPN gateway itself is one of the most attacked points of any network. In industrial environments a VPN is therefore only one layer for secure IT/OT integration and remote management: combine it with MFA, patching, a jump server in the DMZ, least privilege and monitoring, and consider ZTNA for user access.