Voltrus Remote connects a support engineer to an industrial PLC subnet through a self-hosted WireGuard mesh. TIA Portal, GX Works, and SoMachine talk to the PLC as if they were on the local network, with no inbound firewall ports and no third-party control plane. Early access with a 3-month free pilot.
Demo video
A real run of the Voltrus Remote stack on a local test setup. A gateway enrols outbound-only from the dashboard, an engineer laptop joins the WireGuard mesh, the PLC route is approved, and a stub PLC on 192.168.10.5 port 502 becomes reachable. The audit log records the enrolment keys and the route approval.
Chapters
When a machine stops, someone has to reach the PLC fast. The usual answers all have a cost. A remote-desktop tool such as TeamViewer puts a graphical remote-control path on the OT network and routes it through a third party. A "quick" VPN can open an inbound port on the firewall that nobody remembers to close. Site-to-site VPNs mean a lot of paperwork per site.
Each of these widens the attack surface of the PLC network.
A lightweight agent on the Linux machine at the OT edge enrols into your self-hosted WireGuard mesh and advertises only the PLC subnet behind it.
The support engineer connects with --accept-routes. A direct WireGuard path is preferred; DERP over TCP/443 is the fallback through restrictive firewalls.
Your engineering tool gets a route to the PLC subnet. S7 on TCP/102, Modbus on TCP/502: reach the PLC at its local IP, directly.
The SI or panel maker claims the site in the dashboard, installs the agent on a Linux gateway already sitting in the PLC subnet, and pastes the preauthkey. The PLC CIDR is then approved once with an admin API call (POST /nodes/{id}/approve-routes); the dashboard has no approve button yet, and the approval is written to the audit log.
The customer asks for help, the engineer connects over the mesh and works on the PLC at its local IP. Enrolment keys, route approvals and device removals are written to the audit log. Time-boxed grants that expire on their own are on the roadmap.
The gateway phones home. The OT firewall opens nothing inbound. The PLC is never directly exposed to the internet.
Engineers reach only the PLC CIDRs you list, never the wider corporate LAN or the public internet through the tunnel.
We don't reimplement crypto. The agent drives the official audited WireGuard/Noise stack. The private key never leaves the device; Headscale holds the public key only.
You own the Headscale control plane. No per-user SaaS fees, no third party holding your customers' network topology.
When symmetric NAT blocks a direct path, traffic falls back to DERP over TCP/443, the port most firewalls already allow.
No screen-sharing lag, no RDP hop. The engineering tool talks to the PLC directly over the tunnel, full-speed online access.
Captured from the live stack: the gateway inventory an admin sees. In the same session, the enrolled client reached an isolated PLC stub (10.5.0.20:502) through the tunnel.
| Threat | Mitigation |
|---|---|
| PLC exposed to internet | Outbound-only agent. No inbound ports on the OT firewall. |
| Engineer reaches corp LAN | Default-deny ACL; destinations limited to advertised PLC subnets. |
| Lateral movement across sites | Each gateway advertises only its specific PLC CIDR. |
| Private key theft | WG private key never leaves the device. |
| Untraceable admin changes | Append-only audit log of enrolment-key creation, route approval and device removal. |
| Standing access | On the roadmap: time-boxed grants, default-deny between sessions. |
No special hardware. The gateway is any Linux box already in the PLC subnet: an old PC, a Raspberry Pi, or an edge router.
net.ipv4.ip_forward=1 enabled192.168.10.0/24During early access the Voltrus team does the first site with you at no cost, on a call.
Part of: Monitor & connect · See the plant: dashboards and alarms, machine OEE, remote access, messaging.
Voltrus Gateway gives software data access to PLCs over gRPC. Remote gives engineers network access, so TIA Portal or GX Works reach the PLC directly.
Voltrus SCADA shows the plant on dashboards. Remote is for when you need to work on the PLC itself from elsewhere.
| Phase | What you get | Price |
|---|---|---|
| Early access pilot | 1-3 sites, first setup assisted by the Voltrus team, direct feedback loop. | Free for 3 months |
| Production | Per enrolled gateway. All your engineers included, dashboard, admin audit log. Time-boxed grants when they ship (roadmap). | $5 / gateway / month |
| Integrator | Up to 25 gateways across your customers' sites under one account. Same features as Production. | $49 / month |
| Multi-site / OEM | Many sites under one account, DPA. SSO and per-organization isolation are on the roadmap. | Talk to us |
Why per gateway: a site needs one gateway no matter how many engineers use it. Seat-based licensing punishes exactly the sharing this tool exists for.
TeamViewer gives remote graphical control of a PC on the OT network and routes your traffic through a third party. Voltrus Remote gives the engineer a network route to the PLC subnet only, no graphical access to operator PCs, no third-party control plane, no inbound ports. You run the control plane yourself.
No. The gateway makes an outbound connection to the control plane. That is the only direction. If UDP is blocked, traffic falls back to the DERP relay over outbound TCP/443, the same port used for HTTPS, which most firewalls already permit.
No. The gateway advertises only the specific PLC subnet you configure (e.g. 192.168.10.0/24), and the default-deny ACL limits the engineer to exactly that. The wider corporate LAN is never reachable through the tunnel.
Yes. The engineer gets a route to the PLC subnet, so the native engineering tool connects to the PLC at its local IP (S7 on TCP/102, Modbus on TCP/502), exactly as if the laptop were on the LAN. No screen-sharing latency.
On the gateway device only. The Headscale control plane stores the public key, never the private key. Crypto is the audited Noise/WireGuard implementation in the official tailscale client: Voltrus Remote drives it, it does not reimplement it.
The reach-PLC MVP works today and early-access pilots run free for the first 3 months. After the pilot, pricing is $5 per gateway per month, or $49 per month for up to 25 gateways on the Integrator plan. Request a slot and the team sets up your first site with you.
Self-hosted WireGuard mesh. Outbound-only. Default-deny. Join the early-access cohort.
Request early access →