# A multi site VPN setup **URL:** \ **Category:** General Discussion\ **Created:** [November 28, 2021, 3:55am UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510 "2021-11-28T03:55:34Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![chaoliang](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@chaoliang](https://forum.inductiveautomation.com/u/chaoliang)\ **Post date:** [November 28, 2021, 3:55am UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/1 "2021-11-28T03:55:34Z")
Hi, I have a ongoing project to deploy containerized control systems to remote site. Each container consists PLC, Ignition Edge and multiple other TCP/IP devices under local subnet. I would like to install a 4g modem in each container, to allow the container to connect to a central VPN server, so all containers are within the VPN network. Can anyone shine some light on how it can be achieved? My initial thought is to purchase 4g modem with vpn server/client function, so I can define DDNS and OpenVPN to connect each container to the cloud VPN before dispatching to site. I found the ASUS 4G-AC68U has the requirement function, but it’s very difficult to find it on the market. All ignition edge devices are talking to the cloud via MQTT at the moment, it does not require VPN setup. But I would like to install ptz camera as well, once installed, the video files are too large to send to the cloud, they have to stay in local HDD, once under the same VPn, the ignition client should be able to view the files easily. ---
**Author:** ![dcamp1](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@dcamp1](https://forum.inductiveautomation.com/u/dcamp1)\ **Post date:** [November 28, 2021, 12:25pm UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/2 "2021-11-28T12:25:37Z")
Talk with your ISP provider, most of them offer a PRIVATE VPN that can be setup and mine with VERIZON work great. Very affordable. I maintain remote locations just as you describe, I setup a local LAN at each site and each site may have all kinds of other devices on the lan. I can manage every device just as if they were on my shop bench. This is all done through our Private Cellular Network which is just a large scale VPN. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [November 28, 2021, 1:45pm UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/3 "2021-11-28T13:45:46Z")
Private cellular is the simplest to administer. If that isn’t an option for you, consider deploying OpenVPN yourself on the Ignition Edge system. If you are wise, that system is Linux, and OpenVPN on Linux can do just about anything. ---
**Author:** ![diat150](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diat150](https://forum.inductiveautomation.com/u/diat150)\ **Post date:** [November 28, 2021, 5:16pm UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/4 "2021-11-28T17:16:03Z")
a private apn from a cellular provider will work well. Only downside is that you would have to setup port forwarding to access your devices. this may or may not work well in some instances. a vpn would get you direct access to every device behind your modem without the need for using port forwarding. Depending on your setup, this may be necessary. At a minimum I would use a private apn so you dont have a device on a public IP. ---
**Author:** ![chaoliang](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@chaoliang](https://forum.inductiveautomation.com/u/chaoliang)\ **Post date:** [December 7, 2021, 2:33am UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/5 "2021-12-07T02:33:02Z")
I am talking to cooperate IT to see any solution from the IT team. ---
**Author:** ![wbaker](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/wbaker/32/85315_2.png) [@wbaker](https://forum.inductiveautomation.com/u/wbaker)\ **Post date:** [December 12, 2021, 6:15am UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/6 "2021-12-12T06:15:16Z")
TosiBox would work well for this and be very secure. ---
**Author:** ![chaoliang](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@chaoliang](https://forum.inductiveautomation.com/u/chaoliang)\ **Post date:** [December 12, 2021, 7:35am UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/7 "2021-12-12T07:35:02Z")
Does Tosibox have a 4g modem with VPN inbuilt? I couldn’t find the right device from their website. What’s the price range I should be look at for each device? ---
**Author:** ![wbaker](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/wbaker/32/85315_2.png) [@wbaker](https://forum.inductiveautomation.com/u/wbaker)\ **Post date:** [December 12, 2021, 1:49pm UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/8 "2021-12-12T13:49:32Z")
@chaoliang, We use the lock 500i (TBL5iCPS) model. Built in VPN that is plug and play. There are good videos on YouTube demonstrating how it works. We have their Virtual Central Lock that resides on our server and then we connect the locks that are in various regions to it over generic 4G cellular. This setup allows that always on VPN connection for Ignition to receive/request data. I’d recommended inquiring for info through TosiBox so they can set you up with the right team/Vendors for best support and pricing. ---
**Author:** ![chaoliang](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@chaoliang](https://forum.inductiveautomation.com/u/chaoliang)\ **Post date:** [December 13, 2021, 2:43am UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/9 "2021-12-13T02:43:06Z")
Wonderful. Thanks for sharing the information. I will contact local sales for further discussion. ---
**Author:** ![Kyle\_Chase](https://avatars.discourse-cdn.com/v4/letter/k/9de0a6/32.png) [@Kyle\_Chase](https://forum.inductiveautomation.com/u/Kyle_Chase)\ **Post date:** [December 15, 2021, 7:02pm UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/10 "2021-12-15T19:02:51Z")
OpenVPN? Gross. Use wireguard. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 15, 2021, 8:16pm UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/11 "2021-12-15T20:16:02Z")
I find OpenVPN much more reliably passes through others’ firewalls. Otherwise I’d be delighted to use wireguard. ---
**Author:** ![SKA](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ska/32/29528_2.png) [@SKA](https://forum.inductiveautomation.com/u/SKA)\ **Post date:** [December 16, 2021, 8:32am UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/12 "2021-12-16T08:32:10Z")
The upside with wireguard is its less resource hungry that openvpn are. I wish my router could do wireguard, but still it maxes out my 500/500 Mbit connection with openvpn tho. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 16, 2021, 2:17pm UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/13 "2021-12-16T14:17:43Z")
> [@SKA](#): > > still it maxes out my 500/500 Mbit connection with openvpn You must be doing something else wrong. My OpenVPN infrastructure adds a few percent overhead to the traffic it carries. ---
**Author:** ![chaoliang](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@chaoliang](https://forum.inductiveautomation.com/u/chaoliang)\ **Post date:** [March 9, 2022, 6:48am UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/14 "2022-03-09T06:48:03Z")
Just to update: I have contacted local tosibox sales and a quote has been provided for my next project. I will see how it goes with the tosibox system. Meanwhile, just a quick question regarding the vpn setup on the commercial LTE router. I have a tplink 4G router, it has inbuilt function for DDNS and OpenVPN. I have them setup and hope it can work so I can remote access the site PLC from the software installed on my laptop. Then I realized that the sim card has a ISP provided private IP, instead of a public IP. I can ask the ISP to assign a public IP to it, but it will be long process. Instead of using Tosibox, or similar product, is there any way I can get a local sim card, pluging to the off the shelf commercial router and quickly setup a VPN connection to site, with budget under 500 hundred bucks? ---
**Author:** ![Matrix\_Engineering](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/matrix_engineering/32/19781_2.png) [@Matrix\_Engineering](https://forum.inductiveautomation.com/u/Matrix_Engineering)\ **Post date:** [March 9, 2022, 1:57pm UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/15 "2022-03-09T13:57:31Z")
Why do you need a static IP on the SIM? I have an OpenVPN setup at one of my clients. Running OpenVPN on my laptop I can create a connection to any device in the field, they are on private IP sims. OpenVPN creates a tunnel from the server to the end device, the sim IP doesn’t matter. ---
**Author:** ![chaoliang](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@chaoliang](https://forum.inductiveautomation.com/u/chaoliang)\ **Post date:** [March 10, 2022, 3:57am UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/16 "2022-03-10T03:57:36Z")
DDNS does not work with private ip sim behind the ISP firewall. I have just changed the topology, instead of creating a VPN server on the site router, I created a VPN client on the site router. The site VPN client connects to the VPN server at the office, with my laptop connecting to the VPN server as another VPN client, I can remote access the site PLC now. Not many routers support the VPN client function, TP Link AX20 is the one, and less $200. With multiple sites connecting to the same VPN server, I believe it achieves the requirements I listed in the post. All clients should be able to talk to each other and I can centralise the monitoring from the office. Just don’t know how many clients can be connected to the server in this way before the whole VPN network slows down or crush. Any suggestions? ---
**Author:** ![chaoliang](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@chaoliang](https://forum.inductiveautomation.com/u/chaoliang)\ **Post date:** [September 25, 2022, 11:15pm UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/17 "2022-09-25T23:15:27Z")
Just to update: I end up using the complete solution provided by Tosibox. Current cost is around AUD1000 per site setup (TLK175) and AUD3000 per year for setup of the cloud based VPN server. 6 sites connected for now. Ignition Gateway talking to site Ignition edge via MQTT. Not bad experience, so far. ---
**Author:** ![wbaker](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/wbaker/32/85315_2.png) [@wbaker](https://forum.inductiveautomation.com/u/wbaker)\ **Post date:** [September 28, 2022, 4:18am UTC](https://forum.inductiveautomation.com/t/a-multi-site-vpn-setup/53510/18 "2022-09-28T04:18:10Z")
That’s exciting to hear!