→ outbound-only
No inbound OT ports
The gateway phones home. The OT firewall opens nothing inbound. The PLC is never directly exposed to the internet.
● Coming soon — early access
Reach any PLC, securely,
Reach any PLC, securely,
without TeamViewer.
Voltrus Remote connects a support engineer to an industrial PLC subnet through a self-hosted WireGuard mesh. TIA Portal, GX Works, and SoMachine talk to the PLC as if they were on the local network — no inbound firewall ports, no third-party control plane.
The problem
Remote PLC support is a security nightmare.
When a machine stops, someone has to reach the PLC fast. The usual answers are all bad. TeamViewer installs an always-on graphical backdoor on the OT network. A "quick" VPN punches an inbound hole through the firewall that nobody remembers to close. Site-to-site VPNs are a week of paperwork per site.
Every one of these exposes the PLC to the internet — exactly what every OT security standard tells you not to do.
How it works
A gateway. A mesh. A direct route to the PLC subnet.
01 / Gateway
Enrol the edge
A lightweight agent on the Linux machine at the OT edge enrols into your self-hosted WireGuard mesh and advertises only the PLC subnet behind it.
02 / Mesh
Tunnel in
The support engineer connects with --accept-routes. A direct WireGuard path is preferred; DERP over TCP/443 is the fallback through restrictive firewalls.
03 / Reach PLC
Engineer as local
Your engineering tool gets a route to the PLC subnet. S7 on TCP/102, Modbus on TCP/502 — reach the PLC at its local IP, directly.
What you get
Self-hosted control plane you own and can audit.
→ default-deny
ACL by subnet
Engineers reach only the PLC CIDRs you list — never the wider corporate LAN or the public internet through the tunnel.
→ wireguard
Key stays on device
We don't reimplement crypto. The agent drives the official audited WireGuard/Noise stack. The private key never leaves the device; Headscale holds the public key only.
→ self-hosted
Billable & white-label
You own the Headscale control plane. No per-user SaaS tax, no third party holding your customers' network topology.
→ derp relay
Works behind strict NAT
When symmetric NAT blocks a direct path, traffic falls back to DERP over TCP/443 — the port every firewall already allows.
→ native tools
TIA Portal, GX Works, SoMachine
No screen-sharing lag, no RDP hop. The engineering tool talks to the PLC directly over the tunnel — full-speed online access.
Security model
Built against the threats that actually breach OT.
| Threat | Mitigation |
|---|---|
| PLC exposed to internet | Outbound-only agent. No inbound ports on the OT firewall. |
| Engineer reaches corp LAN | Default-deny ACL; destinations limited to advertised PLC subnets. |
| Lateral movement across sites | Each gateway advertises only its specific PLC CIDR. |
| Private key theft | WG private key never leaves the device. |
| Standing access | Roadmap: time-boxed grants (2h), default-deny between sessions. |
Roadmap
Reach-PLC first. The hard, valuable use case.
- MVP — nowReach-PLC over a self-hosted WireGuard mesh. Linux gateway, Headscale control plane, default-deny ACL.
- NextTime-boxed access grants with expiry scheduling and default-deny between sessions.
- ThenSession recording / audit (gateway pcap or RustDesk recording) and screen-share.
- LaterBilling, multi-tenant isolation, Windows HMI agent, and an on-prem (air-gapped) Headscale option.
FAQ
Questions integrators ask.
How is this different from TeamViewer or AnyDesk?
TeamViewer installs an always-on graphical remote-desktop backdoor on the OT network and routes your traffic through a third party. Voltrus Remote gives the engineer a network route to the PLC subnet only — no graphical access to operator PCs, no third-party control plane, no inbound ports. You run the control plane yourself.
Do I need to open any ports on the customer's firewall?
No. The gateway makes an outbound connection to the control plane. That is the only direction. If UDP is blocked, traffic falls back to the DERP relay over outbound TCP/443 — the same port used for HTTPS, which every firewall already permits.
Can the engineer see the whole plant network?
No. The gateway advertises only the specific PLC subnet you configure (e.g. 192.168.10.0/24), and the default-deny ACL limits the engineer to exactly that. The wider corporate LAN is never reachable through the tunnel.
Does it work with TIA Portal / GX Works / SoMachine?
Yes. The engineer gets a route to the PLC subnet, so the native engineering tool connects to the PLC at its local IP — S7 on TCP/102, Modbus on TCP/502 — exactly as if the laptop were on the LAN. No screen-sharing latency.
Where does the WireGuard private key live?
On the gateway device only. The Headscale control plane stores the public key, never the private key. Crypto is the audited Noise/WireGuard implementation in the official tailscale client — Voltrus Remote drives it, it does not reimplement it.
When can I use it?
The MVP (reach-PLC) is in active development. Early-access deployments are being lined up now — reach out to join the cohort for your site.
Stop routing PLC support through TeamViewer.
Self-hosted WireGuard mesh. Outbound-only. Default-deny. Join the early-access cohort.
Request early access →