Remote access to OT equipment without an open inbound port
AdminKit OT Remote Access is a Netbase custom engagement that replaces port-forwarded VNC, RDP or Modbus access to PLCs, HMIs and OPC UA devices with outbound-only connections from the site, so no inbound port stays open on the factory firewall, and maintenance sessions are recorded and limited to agreed windows.
Updated
At a glance
What problem does OT Remote Access solve?
Keeping PLCs, HMIs, and OPC UA devices reachable for vendor maintenance often means opening an inbound port on the site firewall and forwarding it to the device, sometimes paired with a VNC or RDP session. That path stays open as long as someone remembers it’s there, which in practice can be a long time.
Industrial protocols were generally built for isolated plant networks, not the open internet, and many don’t include strong authentication of their own. Once a port is forwarded, anything that can reach it from outside can usually interact with the device the same way an authorized technician would.
There’s also often no record of who connected, when, or what they did once inside. If something goes wrong during a maintenance session, there’s little to look back on.
Who is OT Remote Access for?
Factories and OT sites
Sites relying on port-forwarded VNC, RDP or Modbus access for vendor maintenance.
See the solution →
System integrators
One consistent, auditable way to reach equipment at many client sites.
See the solution →
Plant operators
Maintenance access limited to specific windows, rather than left open indefinitely.
How does OT Remote Access work?
A small agent at the factory site makes an outbound-only connection, so nothing needs to be opened on the site firewall for a technician to reach it. The technician signs in, and the session is routed to the site agent and on to the target PLC or HMI. Sessions are recorded, and access can be limited to defined maintenance windows.
The site agent connects out
A small agent inside the factory network opens an outbound-only connection to the relay.
The technician signs in
Vendors and technicians sign in before any session starts.
The session reaches the device
The relay routes the session through the site agent to the agreed PLC, HMI or OPC UA device.
Recorded, within the window
Every session is recorded, and access can be limited to agreed maintenance windows.
What do you get with OT Remote Access?
No inbound firewall port
The connection starts from inside the site, so the factory firewall stays closed to the internet.
Replaces port-forwards
Outbound-only site agent
A small agent at the site carries sessions to your equipment over its outbound connection.
Installed by Netbase
Sign-in before every session
Nobody reaches a PLC or HMI without signing in first.
Sign-in required
Recorded sessions
A record of who connected, when and to what, for audit and evidence.
Session records
Maintenance windows
Access can be limited to the time windows you agree with each vendor.
Agreed per site
Industrial protocols
Modbus TCP, OPC UA and BACnet/IP devices, plus RDP and VNC sessions to HMIs.
Through the site agent
What does an engagement include?
| Part of the engagement | What Netbase does |
|---|---|
| Exposure review | Find open port-forwards, starting with modbus-check on your verified assets |
| Design | Map who needs access to which PLC or HMI, and when |
| Site agent | Install the outbound-only agent and remove inbound firewall rules |
| Session records | Record maintenance sessions for audit and evidence |
| Maintenance windows | Limit access to agreed time windows |
The modbus-check tool only reports exposure on your own IP or an asset you’ve verified you own; it does not open, close, or alter any connection to the device. Guidance from CISA on industrial control systems is the baseline for the review. Talk to our team to scope it for your sites.
Which other remote-access exposures does it replace?
Port-forwarded remote access is not unique to Modbus — see BACnet/IP exposure in building automation (detail page: is port 47808 exposed?) and RDP and VNC exposed to the internet (detail pages: is port 3389 (RDP) exposed?, is port 5900 (VNC) exposed?) — the same port-forward-and-forget pattern this engagement replaces with an outbound-only, zero trust connection.
What does OT Remote Access work with?
Protocols and sessions it carries
- Modbus TCP
- OPC UA
- BACnet/IP
- RDP
- VNC
Who builds and supports OT Remote Access?
AdminKit is a product of Netbase JSC, a software company founded in 2012 that delivers its projects remotely. The same team that wrote OT Remote Access scopes, builds and operates it for you. Read more about Netbase JSC and AdminKit.
What Netbase JSC's clients say
Reviews of Netbase JSC's project work, not of AdminKit — AdminKit is a newer product from the same company.
"They had nice and good solutions for all of our requests."
Daniel Popescu
Owner, Digital Art Studio · Romania
Source: Clutch"They’re good listeners, are understanding, and they remember things very well."
Syed Ali
Partner, Oriental Overseas Exports · India
Source: Clutch"Their Quick response in every step was impressive."
Olof Christensson
CEO, Skelderwikens Brygghus AB · Sweden
Source: ClutchHow does Netbase deliver OT Remote Access?
OT Remote Access is delivered by Netbase as a scoped engagement, quoted per project. Every engagement follows the same four steps.
Exposure review
We find open port-forwards, starting with modbus-check on your verified assets.
Design
We map who needs access to which PLC or HMI, and when.
Install and close
Netbase installs the outbound-only site agent and removes the inbound firewall rules.
Operate
We run the setup with you: session records, maintenance windows and access changes.
Netbase expert service
Factory remote-access redesign
Replace ad-hoc port-forwarding to Modbus, OPC UA and HMI devices with identity-based remote access, delivered by Netbase.
Does OT Remote Access fit a larger organisation?
- One consistent remote-access setup across several sites.
- Session records for audit and evidence.
- Maintenance windows agreed per vendor and per site.
Talk to an expert
Huy Nguyen (David), Founder & CEO, Netbase JSC
Ask about OT Remote Access for your organisation: scope, timeline or a quote.
What do people ask about OT Remote Access?
How do I get OT Remote Access?
Talk to our team at /contact/. Netbase starts with a review of how vendors and technicians reach your equipment today, then designs, deploys and operates the outbound-only setup for your sites. Every engagement is scoped and quoted per site.
Why is port-forwarding to a PLC or HMI a problem?
Port-forwarding opens an inbound path from the internet straight to the device. Industrial protocols like Modbus TCP were generally not designed with authentication in mind, so anything that can reach the open port can often interact with the device directly.
How does an outbound-only connection work?
A small agent at the factory site connects outward to a relay that technicians reach after signing in. Because the connection starts from inside the site, no inbound port has to be opened on the site firewall.
Are sessions recorded?
Yes. Recording sessions for audit and evidence purposes is part of the engagement, along with limiting access to defined maintenance windows if you want that.
Who typically needs this?
Factories and other OT sites that rely on ad-hoc port-forwarded VNC, RDP, or Modbus access for vendor or technician maintenance, and system integrators who manage that access for clients.
Where should you go next?
All AdminKit products →Product
Secure MQTT Broker with Auth and ACLs
Netbase sets up and runs a managed MQTT broker for you with required authentication and default-deny, per-topic access control.
Solution
See what's reachable on your factory floor before a contractor does
Factories can check Modbus and remote-access exposure for free with AdminKit. Netbase can redesign contractor remote access around identity, not open ports.
Guide
Is Modbus TCP (port 502) exposed to the internet, and how do I fix it?
Modbus TCP has no built-in authentication, so anything reachable on port 502 can usually be read or written by anyone. Check your exposure and fix it.
Talk to our team about OT Remote Access
Tell us what you run. Our team scopes the work with you and sends a quote, answered by a person.
How AdminKit works with you
- Delivered remotely — Netbase JSC, the company behind AdminKit, has worked with clients in 80 countries.
- Contracts and invoices are issued by Netbase JSC; payment goes to the company by bank transfer to Netbase JSC's company account or PayPal Business.
- Talk to the CEO, Huy Nguyen (David), directly on WhatsApp or by email at [email protected].