→ commissioning
Setup, once per site
The SI or panel maker claims the site in the dashboard, installs the agent on a Linux gateway already sitting in the PLC subnet, and pastes the preauthkey. The PLC CIDR is approved once from the dashboard.
● Early access: 3-month free pilot
Reach any PLC, securely,
Reach any PLC, securely,
without TeamViewer.
Voltrus Remote connects a support engineer to an industrial PLC subnet through a self-hosted WireGuard mesh. TIA Portal, GX Works, and SoMachine talk to the PLC as if they were on the local network, no inbound firewall ports, no third-party control plane.
The problem
Remote PLC support is a security nightmare.
When a machine stops, someone has to reach the PLC fast. The usual answers are all bad. TeamViewer installs an always-on graphical backdoor on the OT network. A "quick" VPN punches an inbound hole through the firewall that nobody remembers to close. Site-to-site VPNs are a week of paperwork per site.
Every one of these exposes the PLC to the internet, exactly what every OT security standard tells you not to do.
How it works
A gateway. A mesh. A direct route to the PLC subnet.
01 / Gateway
Enrol the edge
A lightweight agent on the Linux machine at the OT edge enrols into your self-hosted WireGuard mesh and advertises only the PLC subnet behind it.
02 / Mesh
Tunnel in
The support engineer connects with --accept-routes. A direct WireGuard path is preferred; DERP over TCP/443 is the fallback through restrictive firewalls.
03 / Reach PLC
Engineer as local
Your engineering tool gets a route to the PLC subnet. S7 on TCP/102, Modbus on TCP/502: reach the PLC at its local IP, directly.
Day to day
Setup once per site. Every support call after that takes minutes.
→ support call
Support, every incident
The customer asks for help, an admin approves access with a time limit, the engineer logs in and works on the PLC. When the window closes, access expires on its own and the session stays in the log.
What you get
Self-hosted control plane you own and can audit.
→ outbound-only
No inbound OT ports
The gateway phones home. The OT firewall opens nothing inbound. The PLC is never directly exposed to the internet.
→ default-deny
ACL by subnet
Engineers reach only the PLC CIDRs you list, never the wider corporate LAN or the public internet through the tunnel.
→ wireguard
Key stays on device
We don't reimplement crypto. The agent drives the official audited WireGuard/Noise stack. The private key never leaves the device; Headscale holds the public key only.
→ self-hosted
Billable & white-label
You own the Headscale control plane. No per-user SaaS tax, no third party holding your customers' network topology.
→ derp relay
Works behind strict NAT
When symmetric NAT blocks a direct path, traffic falls back to DERP over TCP/443, the port every firewall already allows.
→ native tools
TIA Portal, GX Works, SoMachine
No screen-sharing lag, no RDP hop. The engineering tool talks to the PLC directly over the tunnel, full-speed online access.
The actual product
The MVP running end to end. Not a mockup.
Captured from the live stack: the gateway inventory an admin sees, and the control-plane registry behind it. In the same session, the enrolled client reached an isolated PLC stub (10.5.0.20:502) through the tunnel.
Security model
Built against the threats that actually breach OT.
| Threat | Mitigation |
|---|---|
| PLC exposed to internet | Outbound-only agent. No inbound ports on the OT firewall. |
| Engineer reaches corp LAN | Default-deny ACL; destinations limited to advertised PLC subnets. |
| Lateral movement across sites | Each gateway advertises only its specific PLC CIDR. |
| Private key theft | WG private key never leaves the device. |
| Standing access | Roadmap: time-boxed grants (2h), default-deny between sessions. |
For buyers
What a site needs before the first engineer connects.
No special hardware. The gateway is any Linux box already in the PLC subnet: an old PC, a Raspberry Pi, or an edge router.
Technical checklist
- One Linux gateway on the PLC subnet (old PC, Raspberry Pi, edge router)
net.ipv4.ip_forward=1enabled- Outbound HTTPS (443) from the gateway. No inbound ports, ever
- The agent installed with a preauthkey from the dashboard
- The PLC subnet you want to share, e.g.
192.168.10.0/24
Non-technical checklist
- A Voltrus account for your company
- A list of which engineers may access which site
- An internal rule: time-boxed access, noted in the ticket
- Optional: alignment with plant IT policy and PDP law (UU 27/2022)
Setup help
During early access the Voltrus team does the first site with you at no cost, on a call or on site around East Java.
Pricing
Priced per gateway. No per-engineer seats.
| Phase | What you get | Price |
|---|---|---|
| Early access pilot | 1-3 sites, first setup assisted by the Voltrus team, direct feedback loop. | Free for 3 months |
| Production | Per enrolled gateway. All your engineers included, dashboard, time-boxed grants, audit log. | Rp50,000-100,000 / device / month |
| Multi-site / OEM | Many sites under one account, SSO, on-prem control plane for air-gapped plants, DPA. | Talk to us |
Why per device: a site needs one gateway no matter how many engineers use it. Seat-based licensing punishes exactly the sharing this tool exists for.
Roadmap
Reach-PLC first. The hard, valuable use case.
- MVP (now)Reach-PLC over a self-hosted WireGuard mesh. Linux gateway, Headscale control plane, default-deny ACL.
- NextTime-boxed access grants with expiry scheduling and default-deny between sessions.
- ThenSession recording / audit (gateway pcap or RustDesk recording) and screen-share.
- LaterBilling, multi-tenant isolation, Windows HMI agent, and an on-prem (air-gapped) Headscale option.
FAQ
Questions integrators ask.
How is this different from TeamViewer or AnyDesk?
TeamViewer installs an always-on graphical remote-desktop backdoor on the OT network and routes your traffic through a third party. Voltrus Remote gives the engineer a network route to the PLC subnet only, no graphical access to operator PCs, no third-party control plane, no inbound ports. You run the control plane yourself.
Do I need to open any ports on the customer's firewall?
No. The gateway makes an outbound connection to the control plane. That is the only direction. If UDP is blocked, traffic falls back to the DERP relay over outbound TCP/443, the same port used for HTTPS, which every firewall already permits.
Can the engineer see the whole plant network?
No. The gateway advertises only the specific PLC subnet you configure (e.g. 192.168.10.0/24), and the default-deny ACL limits the engineer to exactly that. The wider corporate LAN is never reachable through the tunnel.
Does it work with TIA Portal / GX Works / SoMachine?
Yes. The engineer gets a route to the PLC subnet, so the native engineering tool connects to the PLC at its local IP (S7 on TCP/102, Modbus on TCP/502), exactly as if the laptop were on the LAN. No screen-sharing latency.
Where does the WireGuard private key live?
On the gateway device only. The Headscale control plane stores the public key, never the private key. Crypto is the audited Noise/WireGuard implementation in the official tailscale client: Voltrus Remote drives it, it does not reimplement it.
When can I use it?
The reach-PLC MVP works today and early-access pilots run free for the first 3 months. After the pilot, pricing is Rp50,000-100,000 per gateway per month. Request a slot and the team sets up your first site with you.
Stop routing PLC support through TeamViewer.
Self-hosted WireGuard mesh. Outbound-only. Default-deny. Join the early-access cohort.
Request early access →