Remote access on SENVAS Touch is built on a Tailscale VPN. The goal was to manage a device installed at a customer site safely, without touching the customer’s network configuration. This post covers the VPN technology we ended up using.

Remote access to a device in the field — the perennial problem

Remote access to field devices is the question that never goes away in industrial HMI work: “how do I get into the device we installed at the customer site?” Each of the usual answers has a catch.

  • Port forwarding — you have to modify the customer’s router, it frequently breaks behind consumer NAT, and opening a port to the internet is a security risk.
  • TeamViewer or AnyDesk — fine for a human watching a shared screen, but hard to automate or integrate with software.
  • Self-hosted OpenVPN — certificate management plus running a VPN server is a real operational burden.

Tailscale — a WireGuard-based mesh VPN

Tailscale is the mesh VPN we went with, built on WireGuard, the modern VPN protocol. As long as both ends have internet, it traverses NAT on its own.

  • No port forwarding — the customer’s router stays untouched.
  • No VPN server to run — there is no server of our own to operate. A device just gets registered on our tailnet.
  • End-to-end encryption — WireGuard protects the link itself.

Tailnet and Funnel — two modes for safety and convenience

flowchart LR
    Device["SENVAS Touch · customer site"]
    TS["Tailscale · WireGuard mesh VPN"]
    Device --- TS
    TS -->|"default · secure"| Admin["Administrator · VPN members only"]
    TS -.->|"Funnel ON · when needed"| Pub["Anyone on the internet · public HTTPS"]
  • Tailnet mode (default) — only members inside our VPN can reach the device. It stays closed to the outside, which is the safe posture.
  • Funnel mode (only when needed) — when someone is on the road or doing an external inspection and has to get in without the VPN, the device is briefly exposed to the public internet over HTTPS. The TLS certificate is issued automatically, so there is nothing to configure.

Both modes are toggled from the web management console. The normal state is closed; you open it only when you need it.

Security — closed by default

The default security posture is closed: the device has no ports open to the outside. Remote access happens only inside the VPN (tailnet), and public exposure through Funnel is opened briefly, and only when an operator turns it on deliberately. Access is password-protected, so even when it is opened for convenience there is still a layer of defense in front of it.

SENVAS Touch remote access summary

TechnologyRole
TailscaleWireGuard-based mesh VPN — NAT traversal, no server, no port forwarding
WireGuardModern VPN protocol — end-to-end encryption
Tailnet modeVPN members only (default, secure)
Funnel modePublic HTTPS only when needed (automatic TLS)

No dedicated VPN server, no changes to the customer’s network — inspection and configuration happen remotely, without a site visit. The web technology behind the management launcher that hosts this remote access is covered in our post on the SENVAS Touch management launcher.

No port forwarding and no VPN server to run — closed by default and opened only when it is needed is the core of SENVAS Touch remote access.

Contact