← Back to Blog
IoT July 30, 2026 · 6 min read

Connecting IoT devices behind CGNAT and 4G/5G

Reach PLCs, SCADA systems, and IP cameras on 4G gateways with no public IP. WireZTNA publisher on the edge gateway creates an outbound tunnel — zero inbound ports required.

The problem

Industrial devices — PLCs, SCADA HMIs, IP cameras, robot controllers — sit on OT networks behind cellular gateways. These gateways use 4G/5G SIMs from carriers that deploy Carrier-Grade NAT (CGNAT). The device has no public IP. Port forwarding is impossible. The carrier won't give you a static IP without an expensive enterprise plan.

This is the same situation with satellite links (Starlink, OneWeb) and many rural ISPs. Your field devices are completely unreachable from the outside.

But your engineers need to:

  • Program PLCs remotely (Siemens TIA Portal, Rockwell Studio 5000)
  • Access SCADA HMI panels for monitoring and configuration
  • View live IP camera feeds from remote sites
  • Push firmware updates to robot fleets
  • Troubleshoot network equipment without sending a truck

Traditional approaches and their problems

  • TeamViewer / AnyDesk — requires a Windows PC at the site, insecure (shared credentials), no granular access control, expensive per-device licensing
  • Reverse SSH tunnels — fragile (disconnects on IP change), no auto-reconnect, hard to manage at scale, requires SSH server on every device
  • Cellular VPN routers — €200+ per gateway, vendor lock-in, complex IPsec configuration, still gives full network access once connected
  • Cloud relay services — data leaves your control, latency spikes, subscription per device, often no support for raw TCP protocols PLC tools need

The solution: WireZTNA publisher on edge gateway

Install the WireZTNA publisher — an 8 MB static binary — on any Linux device that can reach the OT network. This can be a Raspberry Pi, a Teltonika gateway, a Siemens IOT2050, or any ARM/x86 Linux box at the site.

The publisher initiates an outbound WireGuard tunnel to the WireZTNA broker. It works through CGNAT, double NAT, or any firewall — because all connections are outbound. No inbound ports. No static IP needed.

Step 1: Install the publisher on the gateway

On your edge gateway (e.g., a Raspberry Pi connected to the OT network):

# Download the publisher (ARM64 for Raspberry Pi)
curl -fsSL https://your-broker.wireztna.com/api/v1/downloads/publisher/linux/arm64 \
  -o /usr/local/bin/wireztna-publisher
chmod +x /usr/local/bin/wireztna-publisher

# Enroll with the token from the admin panel
wireztna-publisher enroll --token "pub_factory_floor_01"

# Install as systemd service (auto-starts on boot)
wireztna-publisher install
systemctl enable wireztna-publisher
systemctl start wireztna-publisher

The binary is statically compiled — no dependencies, no Python, no Docker. It runs on any Linux with kernel 3.10+.

Step 2: Define exposed CIDRs

In the WireZTNA admin panel, configure which networks the publisher exposes:

Publisher: "Factory Floor - Building A"
Exposed CIDRs:
  - 192.168.1.0/24    # OT network (PLCs, HMIs)
  - 192.168.2.0/24    # Camera network

Or use Published Apps for tighter control:

Published Apps:
  - "Siemens S7-1500"    → 192.168.1.10:102  (TCP)
  - "SCADA HMI"          → 192.168.1.20:80   (TCP)
  - "Camera NVR"         → 192.168.2.1:554   (TCP)

Step 3: Assign engineers to a group

Create a group (e.g., "OT Engineers - Building A") and link it to the publisher. Add the engineers who need access. Each engineer can only reach the CIDRs or Published Apps you defined — they can't see other sites or networks.

Step 4: Connect from the engineer's laptop

The engineer installs the WireZTNA client and connects:

# Login (opens browser for SSO)
wireztna login

# Now the OT network is reachable directly
# Open TIA Portal and connect to 192.168.1.10
# Open browser to http://192.168.1.20 for SCADA HMI
# Open VLC for rtsp://192.168.2.1:554/stream1

The client creates a WireGuard tunnel to the broker, which routes traffic through the publisher at the site. The engineer's machine gets DNS entries for the remote network. It feels like being on-site.

Use cases

PLC programming (Siemens TIA Portal)

TIA Portal needs raw TCP access to port 102 on the PLC. With WireZTNA, the PLC appears as a local network device. Download/upload programs, monitor variables, and debug online — all from 500km away over a 4G link.

SCADA HMI access

Web-based HMIs (Ignition, WinCC) run on port 80/443. Engineers access them through the browser as if they were on the plant LAN. No RDP to a site PC, no screen sharing lag.

IP camera feeds

RTSP streams from cameras and NVRs work directly. Security teams can pull live feeds or recorded footage without exposing cameras to the internet. The camera's firmware (often unpatched) never sees the public network.

Robot fleet management

AGVs and robotic arms expose configuration interfaces on their local subnet. Maintenance engineers connect to individual robots for diagnostics, firmware updates, and path programming — all through the WireZTNA tunnel.

Why this works on any connectivity

  • 4G/5G with CGNAT — publisher only needs outbound UDP (port 51820). No inbound ports, no static IP.
  • Starlink / satellite — same principle. High latency doesn't break WireGuard; it adapts with persistent keepalives.
  • WiFi behind hotel/office NAT — the publisher punches through any NAT type because it initiates the connection.
  • Dual-SIM failover — if the gateway switches SIMs (new IP), the WireGuard tunnel re-establishes automatically within seconds.

Benefits over traditional remote access

  • Zero inbound ports — the gateway's firewall stays locked down. No port forwarding rules to maintain.
  • Per-engineer audit trail — you know exactly who accessed which PLC, when, and for how long. Essential for IEC 62443 compliance.
  • Group-based access control — OT engineers see factory floor devices. IT admins see network switches. Camera operators see NVR only.
  • 8 MB footprint — runs on Raspberry Pi Zero, Teltonika RUT955, Siemens IOT2050, or any embedded Linux with 32 MB RAM.
  • Auto-reconnect — survives IP changes, brief connectivity drops, and gateway reboots. No manual intervention.

Summary

If your industrial devices are behind CGNAT on 4G/5G or satellite, you don't need expensive cellular VPN routers or insecure TeamViewer setups. A single 8 MB binary on your edge gateway creates a persistent, encrypted outbound tunnel. Your engineers get secure, audited access to exactly the devices they need — from anywhere in the world.

Learn more about WireZTNA for IoT →