Remote Access

Securely remote-maintain distributed sites, machines and IoT devices - without VPN client chaos and without a US SaaS in the tunnel to the plant. We build sovereign remote access and remote management platforms with browser-based access (Apache Guacamole), WireGuard site connectivity, role-based access and traceable audit trails - proven in production at ABCO Water Systems and nextGYM. Here we explain the fundamentals, the security and compliance requirements (NIS2, IEC 62443) and the architecture behind them.

Basics

Security & compliance

Remote access for NIS2 requirements

NIS2-compliant remote access: how NIS2UmsuCG and IEC 62443 require RBAC, MFA, full audit logging and just-in-time access - and how to implement it.

RBAC & audit for remote access

Role-based access control (RBAC) and tamper-evident audit trails for remote access: least privilege, session recording, NIS2 and IEC 62443 compliant.

What is ZTNA? (Zero Trust Network Access)

ZTNA grants per-application access instead of full network access - based on identity, device posture and context. Zero Trust Network Access vs. VPN explained.

IEC 62443 for remote access to OT

IEC 62443 for OT remote access: zones and conduits, security levels SL1-4, parts 62443-3-3 and 4-2, and what the standard concretely requires for secure access.

SSO & MFA for the remote-access portal

SSO and MFA for the remote access portal: central identity via SAML 2.0 and OIDC, MFA with TOTP, WebAuthn and passkeys, conditional access, SCIM provisioning.

Retrofitting MFA for VPN

NIS2 requires multi-factor authentication. The three paths for existing VPNs: RADIUS with OTP, MFA on the appliance, identity-based overlay - compared.

Privileged access management & session recording

PAM and session recording for remote maintenance: just-in-time access, credential vaulting, four-eyes approval and SIEM export, NIS2 and IEC 62443 ready.

Remote maintenance & GDPR (data processing)

Remote maintenance and GDPR: when it is processing under Art. 28 needing a DPA, the Art. 32 security measures, plus third-country transfer and logging.

Architecture & connectivity

WireGuard for site connectivity

WireGuard for secure site-to-site connectivity across distributed plants: tunnels, NetBird and Headscale mesh, no open inbound port. Step by step.

What is NetBird? (Zero-trust mesh VPN)

NetBird explained: an open-source WireGuard mesh VPN for encrypted connections between users, servers and sites without inbound port forwarding.

NetBird with Authentik or Keycloak

Connect NetBird to a self-hosted identity provider: OIDC setup for Authentik and Keycloak, group sync via JWT claim, where MFA is enforced, and pitfalls.

What is Headscale?

Headscale is an open-source, self-hosted implementation of the Tailscale control server: a WireGuard mesh without the Tailscale cloud, using official clients.

Expose internal services without a VPN

Expose internal web apps, dashboards and APIs securely - no open ports, no VPN for everyone. Use a self-hosted reverse proxy with an outbound tunnel and SSO.

Multi-tenant operator portal for plants

Multi-tenant operator portal for plants: separating operator, customer and end customer, per-tenant RBAC, white-label and OEM service portals explained.

OT/IT segmentation, DMZ & the Purdue model

OT/IT segmentation with a DMZ and the Purdue model for remote maintenance: jump host and browser gateway in the DMZ, IEC 62443 conduits, no direct PLC access.

SSH bastion / jump host

SSH bastion and jump host explained: ProxyJump, agent-forwarding risks, hardening with key-only, MFA and logging, when a mesh VPN (NetBird/ZTNA) replaces it.

Siemens S7 / PLC remote access without open ports

PLC remote access without open ports: never expose S7 or HMI online. Outbound WireGuard tunnel, browser HMI via Guacamole - a sovereign Ewon alternative.

Decision & comparison

NetBird vs Tailscale vs WireGuard

NetBird, Tailscale, Headscale and plain WireGuard compared: open source, self-hosting, control plane, IdP, ACLs and licenses. A sovereign decision guide.

OpenVPN vs WireGuard

OpenVPN vs WireGuard compared for businesses and site-to-site connectivity: protocol, performance, code size, security - and when to use which VPN.

Secure remote maintenance of machines & plants

Secure remote maintenance for machines and plants: WireGuard, Guacamole gateway, RBAC, full audit and NIS2 - your own platform, not a vendor cloud.

Migration & replacement

Migrate FortiGate SSL-VPN to NetBird

FortiOS 7.6.3 removes SSL-VPN tunnel mode. The migration path to NetBird: inventory, IdP, peers, policies, sites via routing peer, cutover.

Migrate OpenVPN to NetBird

Replace OpenVPN without MFA and user management: map certificates, connect an IdP, build peers and policies, add sites, switch over without downtime.

From one team

WZ-IT builds and runs Remote Access in production for companies - design, build and operations from one team.

See the remote management platform

Companies worldwide trust WZ-IT

Read client reviews

Free intro call

Let's talk about your project - no obligation

Straight with Timo and Robin - no sales team, no pitch
A professional assessment of your situation
Concrete next steps for infrastructure, software or AI

The conversation is free and non-binding.

WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.

Jakob ÖschlbergerInno7 GmbH

Email[email protected]Phone+49 2922 875068

Let's Talk About Your Idea

Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.

1 / 3 · Topic Selection

What is your inquiry about?

First select the service area that best matches your project.