A common setup is appearing across production sites: acellular routeruses 4G or 5G to connect a remote production cell, pumping station, or equipment cabinet to a central system. The same cabinet may also contain PLCs, HMIs, switches, cameras, and a maintenance laptop.
Connectivity makes remote operation possible, but it raises a design question: if a router management account, firmware vulnerability, or remote-access path is compromised, can an attacker move on to the PLCs and SCADA system?
The answer cannot rely only on making the router harder to compromise. Once a router is breached, a flat network behind it may also be exposed. A more resilient design ensures that reaching one network zone does not provide a direct next hop into the control network.
Many small sites place PLCs, engineering laptops, cameras, and the cellular router on one LAN. It is quick to deploy, but once any device is compromised, a scan of the subnet can reveal controllers, HMIs, and shared files.
Start by defining three zones:
The control zone should not sit directly on a LAN that the cellular router can access freely. At a smaller site, an independent gigabit edge router or industrial firewall can be placed in front of the control zone. At a larger site, managed switches can create VLANs, with a boundary device enforcing policy between zones. The key point is not the number of devices. It is whether the control zone has its own boundary.
Lateral movement often succeeds because systems can already communicate with each other. Rules should therefore follow actual traffic flows, rather than being based on the convenience of managing one subnet.
For example, if SCADA only needs to poll a PLC at a specific address and port, allow only “SCADA address → PLC address → required protocol port.” If a PLC reports to a historian, add a separate, directional rule for that flow. A maintenance laptop should not have default access to every PLC. Cameras, printers, and guest Wi-Fi should have no path into the control zone.
After the policy is applied, test it from an endpoint that is not on the approved list. It should not be able to discover the PLC or connect to the HMI. If the access zone containing the cellular router is compromised, these boundary rules interrupt the attack path.
Mapping a PLC's Modbus TCP service, an HMI web page, or a remote desktop port directly to the public internet for commissioning is one of the configurations to avoid. Industrial protocols and older HMIs are generally not designed to face the internet directly.
Remote maintenance can first enter through a VPN, then reach the target device through a jump host or controlled engineering workstation. VPN accounts should be assigned to individuals and removed promptly when personnel leave, a project closes, or outsourced maintenance ends. Connection logs should also be retained to verify who accessed which site and when.
For sites using 4G or 5G, an industrial cellular router that supports OpenVPN or IPsec can act as the encrypted tunnel endpoint. The USR-G816 and USR-G806w list OpenVPN, IPsec, L2TP, PPTP, and GRE in their product information. OpenVPN can operate as a client connected to a server, so remote access does not depend on a public port on the PLC. In a live deployment, use the encryption protocols and certificate-management process approved by the organization, and disable remote services that are not required.
Router web administration, remote upgrades, and device alerts belong to the management plane. PLC communications belong to the data plane. When both share the same entry point, a leaked management account has a wider impact.
Limit management access to the VPN or a dedicated management network, and apply the following controls:
The USR-G816 and USR-G806w provide remote-management capabilities and list offline, weak-signal, and traffic-overrun alerts. A sudden traffic increase does not necessarily indicate an intrusion; it may also result from a configuration change. It is still a signal worth investigating promptly. Remote management helps with maintenance, but it does not replace access boundaries or account management.
The protection chain is straightforward: the cellular link provides connectivity; the VPN provides encryption and identity verification; an edge router or firewall provides segmentation and policy; a SCADA jump host supports controlled operations; and PLCs remain inside the control zone.
The most important outcome is this: even if a cellular router is fully controlled, an attacker can reach only the device access zone, not move directly into the PLC or SCADA zone. When evaluating an industrial router, review more than cellular performance and environmental ratings. Confirm VPN, remote management, and alerting capabilities, then confirm that the site design can use an independent boundary device to implement segmentation and least privilege.
This approach does not eliminate all risk. It does limit an edge-device incide
