No products in the basket.
Remote access is one of the main reasons to put a router on a site: engineers can check a PLC, view a camera or update a controller without travelling. Done badly, it is also one of the main ways attackers get in. The good news is that doing it well is now straightforward.
Avoid open ports
The old way was a fixed public IP SIM with port forwarding: anyone on the internet could reach the device's login page. That is exactly what automated scanners look for. Where a fixed public IP is needed, lock it down with firewall rules that only allow known addresses, and never expose web management or remote desktop directly.
Use a VPN or a vendor platform
A VPN creates an encrypted tunnel, so devices are only reachable by people who are connected to it. Vendor platforms go further: with Teltonika RMS Connect and VPN Hubs, the router connects out to the platform, so no public IP or open port is needed at all, and access is controlled by user accounts. A private APN keeps traffic off the public internet altogether.
Good habits
- Strong, unique passwords for every device, and change any defaults on installation.
- Individual accounts for engineers rather than one shared login, so access can be removed when people leave.
- Two-factor authentication on management platforms.
- Only the access each person needs, to the devices they need.
- Logs and alerts, so you know when someone connects.
Keep it simple
Security works best when it is the easy option. A vendor platform that engineers find quicker than the old method gets used; a complicated one gets bypassed. Combined with regular firmware updates and an up-to-date estate list, it covers most of the risk on most sites. See our IoT and OT security hub for more.
Frequently asked questions
Is a fixed public IP SIM insecure?
Not on its own, but anything you expose on it can be found. Restrict access with firewall rules, or use a VPN, vendor platform or private APN instead.
Do I need a VPN for remote access?
You need some form of secure access. A VPN or a vendor platform such as Teltonika RMS are the usual choices, and both avoid exposing devices directly to the internet.
How do we remove access when an engineer leaves?
Use individual accounts on your management platform or VPN, so you can remove one person without changing every password.
Need help with your project?
Talk to our UK technical team about the right router, SIM and antenna.