On-Premise IIoT: Remote Access Without Exposing the Plant

On-premise does not mean you cannot reach it from outside.

On-premise means the data and servers belong to the company. Remote access is a separate design choice.

• VPN: users join the company network first, then open the dashboard
• Reverse proxy in a DMZ with HTTPS and MFA
• Zero-trust tunnels such as Cloudflare Tunnel or Tailscale, with no open inbound ports
• Hybrid: sensitive data stays local, summaries go to the cloud
• Avoid plain port forwarding to the internet

Keep layers: Internet, firewall, DMZ, IT network, firewall, OT network. Outsiders reach the dashboard, never the PLCs. A SaaS product should support cloud, on-premise and hybrid deployment.