When equipment is scattered across multiple sites, sending an engineer to the field every time is not realistic. This article covers three things: restricting access sources with firewall rules, encrypting data with VPN tunnels, and managing devices centrally through a cloud platform. Combined with real-world scenarios, it helps equipment manufacturers set up remote maintenance that is both secure and manageable.

1. The Challenge of Remote Maintenance

Manufacturing equipment, environmental monitoring stations, and water pump stations are typically deployed in factory areas or outdoors. Equipment manufacturers and system integrators need to accomplish the following without dispatching engineers on-site:

• Remote configuration and parameter adjustment

• Firmware and software updates

• Fault diagnosis and log collection

• Real-time operational monitoring

Remote access brings efficiency but also introduces risk—without secure channels and controlled access sources, industrial networks may be exposed to unauthorized connections.

2. The First Line of Defense: Whitelist Firewall

Firewall communication rules are the first layer of protection for remote access. The approach is straightforward: only allow IPs that should be there.

IP Whitelist Example

Industrial routers like the USR-G806w support source IP whitelist configuration. The steps are as follows:

• Log in to the router's web management interface
• Navigate to "Security Settings → Firewall → Communication Rules"
• Create a new rule and select "Whitelist" as the type
• Enter allowed source IP addresses (e.g., company office network IP, or engineers' fixed home broadband IP)
• Set the allowed port range (e.g., port 22 for SSH, port 3389 for RDP)
• Enable the rule and save

This way, even if the router's 4G public IP is scanned, IPs not on the whitelist cannot establish a connection.

Domain Name Whitelist

In addition to IP whitelists, some models (such as the USR-G806w) also support domain name blacklists and whitelists. When remote management tools use dynamic DNS (DDNS) or cloud platform domain addresses, domain whitelists can block access to malicious domains at the DNS resolution stage, preventing the router from being redirected to phishing servers.

Real-World Scenario

An industrial automation integrator operates more than 300 CNC machines nationwide that require remote maintenance. Engineers are based in Beijing, Shanghai, and Shenzhen, and the company's office network IPs are fixed. By configuring IP whitelists for each device (allowing access from the three office exit IPs), engineers can safely access devices whether they are in the office or on a business trip, as long as they connect through the company's designated VPN client. Public internet scans and attack requests from IPs not on the whitelist are dropped directly.

3. The Second Line of Defense: VPN Encryption

Even when the source is legitimate, transmitted data needs encryption. Control commands, process parameters, and operational logs of industrial equipment are sent over public networks. Without encryption, any intermediate node can intercept them.

Industrial routers typically support the following VPN protocols:

• IPSec: The most widely used, ideal for site-to-site encrypted connections, stable performance

• OpenVPN: Based on SSL/TLS, highly flexible, supports multiple authentication methods

• PPTP / L2TP: Good compatibility, simple to configure

Selection guidance:

• If engineers need to access devices over public networks, use IPSec to establish a tunnel that encrypts all traffic.

• For flexible remote access scenarios (e.g., engineers on different networks), OpenVPN is a solid choice.

4. Centralized Operations: RuiYi Cloud Platform

When the device count grows to a certain scale (more than 50 units), logging into each router's web interface one by one becomes impractical. A centralized operations platform is needed at that point.

5G industrial router like the USR-G816 natively support the RuiYi Cloud platform, with capabilities including:

• Remote Configuration: Deploy router configurations in batches through the cloud platform, without per-device operations

• Firmware Updates: Push firmware upgrades from the cloud; devices complete updates automatically in batches

• Fault Diagnosis: Monitor device online status, signal strength, CPU and memory usage

• Anomaly Alerts: The platform proactively sends notifications when devices go offline, base station signals weaken, or data usage exceeds limits

5G networks (USR-G816 supports theoretical speeds up to 1.76 Gbps) provide the foundation for high-bandwidth scenarios such as remote video inspections and large-volume log uploads.

Real-World Scenario

A smart water conservancy project deployed more than 20 reservoir monitoring stations nationwide. Each station is equipped with a USR-G809s industrial router, responsible for collecting water level, rainfall, and gate status data and transmitting it back to the central office. The project operations team manages all routers centrally through the RuiYi Cloud platform:

• The cloud platform monitors each device's online status and automatically pushes alerts when devices go offline unexpectedly

• Engineers remotely adjust data collection frequency and transmission strategies from the cloud, without visiting the site

• After a heavy rainstorm, one station experienced weakened signal. The platform immediately notified the operations team, and the engineer remotely adjusted the data transmission interval to prevent data loss

5. Industrial-Grade Design: Keeping Devices Online for Remote Access

Security matters, but only if the device is actually online. Industrial equipment is often deployed in harsh environments. Two features directly impact remote accessibility:

Wide Temperature and Wide Voltage Range

Devices may sit in cabinets without air conditioning, exposed to summer heat and winter cold. Routers like the USR-G816, with a working temperature range of -35°C to 75°C and DC 9-36V wide-voltage power supply, maintain stable operation under significant voltage fluctuations.

Hardware Watchdog

Industrial routers are commonly equipped with a hardware watchdog. When the device freezes for any reason, the watchdog automatically reboots the system, restoring remote connectivity.

6. Multi-Network Backup: What If the Primary Channel Fails

4G signals are affected by base station coverage and may become unstable at times. Industrial routers with multi-network backup support, such as the USR-G809s, enable automatic 4G/wired dual-link switching—when the 4G signal weakens or disconnects, the router automatically switches to the backup wired network, keeping the remote connection uninterrupted.

7. Security Checklist

When planning for secure remote access, verify each item:

Firewall: Is an IP whitelist configured to allow only operations team IPs to access devices?

Encryption: Is IPSec or OpenVPN enabled for encrypted transmission?

Port Management: Are unnecessary ports (e.g., Telnet port 23) disabled?

Account Security: Have default passwords been changed? Is a strong password policy in place?

Firmware Version: Is the firmware regularly updated to the latest version to fix known vulnerabilities?

Monitoring and Alerts: Are alerts configured for device offline events, weak signals, and data overage?

Remote Updates: Are firmware updates pushed through the cloud platform in batches, avoiding mass reboots from a single simultaneous upgrade?

Multi-Network Backup: Is there a backup link (4G + wired) to prevent single-point failures?

FAQ

1. What is the difference between an industrial router and a consumer router?

Industrial routers support wide-temperature and wide-voltage operation (e.g., -35°C to 75°C working temperature, DC 9-36V power supply), hardware watchdog auto-reboot, EMC electromagnetic protection, and other industrial-grade designs. They are suited for factory or outdoor environments without air conditioning, unstable power, or strong electromagnetic interference. Consumer routers typically operate stably only at 0°C to 40°C.

2. For remote access to industrial equipment, is 4G or wired better?

4G suits outdoor scenarios where cabling is not feasible (e.g., water monitoring stations, mobile equipment). Wired networks suit stable environments within factory areas. When conditions allow, a multi-network backup solution (4G + wired) balances both flexibility and reliability.

3. Will an IP whitelist restrict engineers' flexibility?

No. Engineers can access devices through the company's exit IP, or connect via a VPN client to a whitelisted network first, then reach the devices from there. During business trips, as long as the device supports remote management, engineers can operate it from within the company network.

4. How to prevent industrial routers from being attacked by hackers?

At minimum: configure IP whitelists to restrict access sources, enable IPSec or OpenVPN encryption, change default passwords, disable unnecessary high-risk ports (e.g., Telnet 23), and update firmware regularly. These four steps cover most known risks.

5. Which VPN protocols do industrial routers support?

Common industrial routers support IPSec, PPTP, L2TP, OpenVPN, and other protocols. IPSec is best suited for site-to-site encrypted connections; OpenVPN offers greater flexibility for diverse remote access scenarios.

6. How to manage devices efficiently as the number grows?

When the device count exceeds 50, logging into each web interface individually is impractical. A cloud platform (such as the RuiYi Cloud platform) is recommended for centralized management, supporting remote configuration, batch updates, status monitoring, and anomaly alerts.

7. Will unstable 4G signal affect remote access?

It can. If base station coverage is weak or weather conditions interfere, the 4G link may disconnect. Industrial router with multi-network backup support (such as the USR-G809s) automatically switch to the backup wired network when 4G disconnects, maintaining an uninterrupted remote connection.

8. How to calculate industrial router data usage?

Data usage depends on reporting frequency and data volume per report. Taking water level monitoring as an example: reporting 100 bytes once per second generates approximately 2.6 GB per month. Reducing the frequency to once per minute brings that down to about 4.3 MB per month. Adjusting reporting frequency to actual needs can effectively control data costs.