A VPS acts as a WireGuard VPN concentrator for SCADA systems: each remote site’s router establishes a tunnel to the VPS hub, and engineers access PLCs, HMIs and historian servers through that tunnel. No SCADA protocols are exposed to the internet. No fixed-IP SIM cards needed. The VPS needs 2 vCPU and 2GB RAM for up to 50 sites with typical engineering traffic.
The SCADA remote access problem
SCADA systems were designed for isolated networks. Protocols like Modbus TCP, DNP3 and proprietary HMI communications were not built for internet exposure – they have no authentication, no encryption, and no defences against adversarial traffic.
Remote access is now expected: engineers need to view process data, acknowledge alarms and make configuration changes without being on-site. The challenge is providing this access without exposing SCADA protocols to the internet.
The VPS hub-and-spoke architecture
The correct pattern:
- Each SCADA site has a cellular router (Teltonika RUTX, Milesight UR, or similar)
- The router establishes a WireGuard tunnel to the VPS hub
- The engineer’s laptop or office PC connects to the same VPS hub via WireGuard
- Through the tunnel, the engineer accesses the PLC, HMI or historian as if on the site LAN
At no point do Modbus TCP, DNP3 or HMI protocols traverse the public internet. They only run inside the encrypted WireGuard tunnel. The only internet-facing port is the VPS’s WireGuard UDP port (51820).
This architecture is directly relevant to UK Cyber Essentials and IEC 62443 compliance. The VPS provides the network boundary isolation required by both frameworks without complex firewall rulesets.
VPS sizing for SCADA deployments
| Sites | Typical use | VPS specification |
|---|---|---|
| 1-10 sites | Occasional engineering access, some polling | 2 vCPU, 2GB RAM |
| 10-50 sites | Regular polling, SCADA historian sync | 2-4 vCPU, 4GB RAM |
| 50-200 sites | Continuous data aggregation | 4-8 vCPU, 8GB RAM |
| 200+ sites | Centralised SCADA/HMI | Architecture review needed |
Router requirements for SCADA sites
The site router needs:
- WireGuard client support (Teltonika RUTX series, Milesight UR series, InHand, Robustel all qualify)
- Static routes to direct SCADA subnet traffic through the tunnel
- Dual-SIM or failover capability for critical sites
See VPS for Teltonika Routers for configuration specifics on the most widely deployed cellular router for UK industrial remote access.
What protocols work through the WireGuard tunnel
Any TCP or UDP protocol works through WireGuard without modification:
- Modbus TCP (port 502)
- DNP3 over TCP (port 20000)
- IEC 61850 MMS (port 102)
- OPC-UA (port 4840)
- Proprietary HMI protocols (Ignition, Wonderware, FactoryTalk)
- RDP to engineering workstations
- VNC to HMI panels
Adding centralised data aggregation
The VPS hub is also the natural home for a central MQTT broker and dashboard. Site routers can forward telemetry from PLCs to MQTT topics on the VPS. Node-RED processes and routes this data. Grafana provides the central operational dashboard across all sites.
This pattern is covered in detail in Multi-Site Industrial IoT Data Aggregation.
Connecting to Ignition SCADA through the VPS
Ignition SCADA (Inductive Automation) uses TCP connections on port 8088 (HTTP) and 8043 (HTTPS) for the Designer and Vision Clients. All of these work transparently through a WireGuard tunnel: connect your Ignition Designer to the PLC’s IP on the site LAN via the tunnel, and the Ignition Gateway to the site’s historian or database server. No Ignition-specific configuration is needed to use WireGuard as the transport.
Monitoring SCADA site connectivity
Use Uptime Kuma on the VPS to monitor each site’s WireGuard peer activity. A script checks wg show for active handshakes from each site router; if a site goes quiet, an alert fires. This gives operational visibility of site-to-VPS connectivity independent of the SCADA historian or alarms, which might not alert if the connection is simply down.
Cellular connectivity for SCADA sites
Teltonika RUTX12 (dual-SIM, dual-modem) is the standard choice for SCADA sites that require high availability: two independent LTE connections on separate SIM cards from different operators, with automatic failover in under 30 seconds. The VPS sees this as one WireGuard peer regardless of which cellular link is active. See VPS for Teltonika Routers for the configuration specifics.
Security considerations for SCADA deployments
Running SCADA over a VPS introduces a network element that must be hardened. The VPS Security Hardening Checklist covers the essentials. For SCADA specifically, also apply:
- Per-site WireGuard keys (one key pair per router, not shared keys)
- AllowedIPs restricted to each site’s specific subnet (no overlapping ranges)
- Separate engineering access credentials from device-to-VPS tunnels
- Regular key rotation schedule
- Audit logging of all VPS SSH access
Compliance implications: UK Cyber Essentials and IEC 62443
UK Cyber Essentials requires boundary firewalls, secure configuration, access control and malware protection. The VPS WireGuard architecture directly supports these requirements: only UDP port 51820 is open on the VPS firewall (boundary control), all traffic is encrypted (secure configuration), per-site keys control access (access control). IEC 62443 (industrial cybersecurity) requires network segmentation between the enterprise and control network zones. The WireGuard tunnel provides the encrypted demarcation point between the internet and site LANs that satisfies this zone boundary requirement.
Remote firmware and configuration management for SCADA site routers
Teltonika RMS and Milesight Development Platform both provide remote configuration management for their respective router ranges – firmware updates, configuration templates, bulk changes – through their own cloud platforms. These work independently of and alongside the WireGuard VPS hub. When a new SCADA site is onboarded, the integrator configures the router remotely via RMS and sets up the WireGuard peer on the VPS hub; the engineer arrives on site with the router already configured and the tunnel already tested.
Frequently asked questions
Is it safe to use a VPS for SCADA remote access?
A properly configured WireGuard hub on a hardened VPS is significantly safer than most alternatives: fixed-IP SIMs with open ports, consumer VPNs with shared infrastructure, or direct internet exposure of SCADA protocols. The key requirements are per-site keys, AllowedIPs isolation between sites, and proper VPS hardening.
What is the latency impact of routing SCADA traffic through a VPS?
For a UK-hosted VPS, typical added latency is 5-20ms depending on the site location and cellular signal quality. Modbus polling at 1-second intervals handles this comfortably. For time-critical SCADA control (sub-100ms response), review latency requirements before deployment.
Can multiple engineers access different sites simultaneously?
Yes. Each engineer has their own WireGuard peer on the VPS. Access control (which engineer can reach which site subnets) is enforced by the AllowedIPs configuration on the VPS, or by firewall rules on the VPS between the WireGuard interfaces.
Does this architecture work with Ignition SCADA?
Yes. Ignition communicates over standard TCP connections that work transparently through a WireGuard tunnel. Remote Ignition Gateway connections, Perspective browser sessions and mobile apps all function through the tunnel as if on the local network.
What happens if the VPS or internet connection goes down?
SCADA continues to function locally at each site – the local PLC, HMI and any site-level historian operate normally. Remote monitoring and remote control are unavailable until connectivity is restored. For critical sites, dual-SIM routers with two separate cellular providers provide redundancy at the site level. The RUTX12 dual-modem architecture is the standard choice for UK SCADA deployments requiring high availability.