Modbus TCP devices (PLCs, drives, meters, sensors) are never exposed directly to the internet. A VPS acts as a WireGuard hub: engineers connect through it to access Modbus devices on site LANs, and Node-RED on the VPS polls Modbus devices over the tunnel to collect data for dashboards. The VPS needs 2 vCPU and 2GB RAM for typical deployments.
Why Modbus TCP and the internet do not mix directly
Modbus TCP was designed for trusted, isolated industrial networks. It has no built-in authentication, no encryption and no protection against command injection. Exposing a Modbus device directly on the internet (port 502 open) would be a serious security risk – anyone who found it could read all data and potentially write control registers.
The correct pattern is to keep Modbus devices entirely on the site LAN, accessible only through an encrypted WireGuard tunnel that terminates at your VPS hub.
Two VPS patterns for Modbus deployments
Pattern 1: Engineering access
Engineers connect to the VPS via WireGuard. The tunnel extends to the site LAN. Engineering software (Modbus Poll, Ignition, anything) communicates with the PLC as if on the local network. This is used for commissioning, troubleshooting and configuration changes.
Pattern 2: Central data aggregation
Node-RED runs on the VPS. It connects to site routers via WireGuard tunnels. Node-RED polls Modbus registers on each site’s PLC on a schedule, transforms the data, and writes it to InfluxDB. Grafana provides the central dashboard across all sites.
Most deployments use both patterns simultaneously.
VPS and router requirements
The site needs a router that:
- Supports WireGuard (Teltonika, Milesight, Robustel, or any Linux-based router)
- Has Ethernet connectivity to the Modbus TCP device
- Can maintain a cellular or fixed-line connection to the VPS
The VPS needs:
- WireGuard hub configuration with one peer per site
- Node-RED with the node-red-contrib-modbus package (for Pattern 2)
- InfluxDB and Grafana for storage and visualisation
Node-RED Modbus polling configuration
# Install Modbus nodes in Node-RED
cd ~/.node-red
npm install node-red-contrib-modbusIn the Node-RED flow editor:
- Add a Modbus Flex Getter node – configure it with the PLC’s WireGuard tunnel IP (e.g. 192.168.1.10 on the site LAN), port 502, and the polling interval
- Connect an Inject node set to trigger every 30 seconds (or your required interval)
- Connect a Function node to extract specific registers from the response
- Connect an InfluxDB out node to store the values
Set the Modbus timeout in Node-RED to 3 seconds and add a Catch node to handle timeouts gracefully. Cellular connections occasionally add 1-2 seconds of latency; a short timeout causes spurious errors.
Supported Modbus register types
| Function code | Register type | Access | Typical use |
|---|---|---|---|
| FC01 | Coils | Read/Write | Digital outputs, relays |
| FC02 | Discrete inputs | Read only | Digital inputs, sensors |
| FC03 | Holding registers | Read/Write | Setpoints, configuration |
| FC04 | Input registers | Read only | Measurements, process values |
Security and isolation between sites
When multiple sites connect to the same VPS hub, configure WireGuard’s AllowedIPs to restrict each site to its own subnet. Site 1 can only access 192.168.1.0/24; Site 2 can only access 192.168.2.0/24. This prevents an issue at one site from affecting data integrity at another.
The full approach is covered in Multi-Site Industrial IoT Data Aggregation.
Building a Modbus dashboard in Grafana
Once Node-RED is writing Modbus data to InfluxDB, Grafana connects to InfluxDB as a data source and displays the values. Create a dashboard with panels for each process variable: current value (stat panel), trend over time (time series), and alarm state (threshold-coloured gauge). Add template variables for site selection, so one dashboard serves all sites by switching the site filter.
The full time-series storage and dashboard setup is covered in Grafana + InfluxDB on a VPS.
Protocol variations: Modbus RTU vs Modbus TCP
Modbus RTU runs over serial connections (RS-232 or RS-485). It cannot be polled directly from the VPS. A serial-to-Ethernet converter or a gateway router (Teltonika TRB140, TRB145 or Robustel R1510) bridges RS-485 Modbus RTU to Modbus TCP on the local LAN. The VPS and Node-RED then poll it as Modbus TCP over the WireGuard tunnel. This covers the vast majority of legacy industrial equipment with serial interfaces.
Alerting on Modbus values through the VPS
Node-RED compares each polled Modbus value against configurable thresholds. When a value breaches a threshold (motor temperature above 85C, tank level below minimum), Node-RED fires an alert through Telegram, SMS or email using the patterns covered in SMS and Email Alerting. This gives the same alerting capability as a dedicated SCADA alarm system, built from three Node-RED nodes and a notification service, running on the same VPS as everything else.
Centralised alarm management across Modbus sites
Node-RED running on the VPS evaluates alarm conditions across all polled sites simultaneously. A function node compares the latest value from each Modbus register against its configured alarm thresholds. When a condition triggers, Node-RED logs the event to InfluxDB (for historical alarm analysis) and sends an alert via the notification pattern covered in SMS and Email Alerting. This replaces per-site alarm relay hardware and the corresponding per-site maintenance overhead with a single software configuration that covers all sites.
The alarm record in InfluxDB provides the audit trail that industrial compliance frameworks require: every alarm, timestamped, with duration and the value that triggered it, accessible in Grafana as a table panel alongside the process trend data.
Frequently asked questions
Can I write to Modbus registers remotely, not just read?
Yes. Through the WireGuard tunnel, Modbus writes work the same as reads – the tunnel is transparent to TCP traffic. Use FC03 write (for holding registers) or FC05/FC06 coil writes. Exercise caution: unexpected writes to control registers can cause equipment to respond. Test write operations thoroughly before deployment.
What is the polling latency over a cellular WireGuard tunnel?
Typically 30-150ms round-trip on a good 4G connection. Modbus TCP handles this without issues for monitoring purposes (1-second poll intervals or slower). For very fast control loops (below 100ms response time), local automation at the site is more appropriate.
How do I find the correct Modbus register addresses for my PLC?
The Modbus register map is specific to each device. Check the PLC or device documentation – it will list the register numbers, data types (16-bit integer, float, etc.) and scaling factors. Contact the manufacturer if the documentation is incomplete.
Does this work with serial Modbus (RS-485) as well as Modbus TCP?
Yes. A serial-to-TCP converter (or a gateway device like the Teltonika TRB140) converts RS-485 Modbus RTU to Modbus TCP. The VPS and Node-RED then interact with it as normal Modbus TCP. See Modbus to MQTT Gateway for the full pattern.
Can Grafana alerts trigger actions on a remote PLC?
Grafana alerts fire webhooks. A Node-RED endpoint receives the webhook and can write to a Modbus register on the relevant PLC through the WireGuard tunnel. This enables alert-triggered remote actions, such as switching equipment states when a threshold is exceeded.