4G/5G Industrial VPN Solution

In industrial IoT projects, engineers often face an awkward situation: the equipment is installed and data is being generated, but it simply cannot be transmitted back to the central server.

The field site is in city A, while the server is in city B. A physical cable cannot be laid, and obtaining a public IP is difficult. To make matters worse, some industrial protocols only operate over broadcast (e.g., IEC 61850 Goose messages, or Layer 2 communication between certain PLCs). Once you route traffic across subnets, these devices simply cannot "see" each other.

This isn't a case of the network being "bad"—it's that the network doesn't provide a path for this type of communication.

1. The Limits of Traditional Networking: Reachable Routes, Blocked Broadcasts

Traditional IP networks operate at Layer 3 (Network Layer). Data travels from point A to point B based on IP addresses and routing tables. As long as the route is reachable, data can be forwarded.

However, many industrial sites have more complex requirements:

• Dependence on Layer 2 Broadcast: Protocols like IEC 61850 Goose messages for substations, or the automatic discovery mechanisms of certain PLCs, rely on the Layer 2 broadcast domain. Once traffic crosses subnets, routers block these broadcast packets.

• Lack of Fixed Public IP: Most 4G/5G SIM cards are assigned dynamic private IPs, making them unreachable directly from the public internet. If you want to set up a VPN, deploying the server end without a fixed public IP becomes a real challenge.

• High Networking Costs: Laying fiber optics or leasing carrier private lines (e.g., MPLS VPN) has long deployment cycles and high costs, making it cost-ineffective for widely distributed end nodes.

So, how can you make devices in different locations behave as if they were plugged into the same switch, without a physical cable? The answer is yes—by implementing Layer 2 VPN technology over 4G/5G wireless networks.

2. The Solution: Using GRETAP to Build a "Virtual Switch"

GRETAP (Generic Routing Encapsulation Tunnel Access Point) is a Layer 2 tunneling protocol. It establishes a virtual tunnel between two 4G/5G routers over an IP network (in this case, the carrier's wireless network). This effectively connects the two local area networks (LANs) with a virtual "cable," forming a virtual Layer 2 switch that spans the WAN.

Here's how it works conceptually:

1. Physical Connection: Each site is equipped with an industrial router that supports 4G/5G, connecting to the carrier's network via a dedicated IoT SIM card. All routers can communicate with each other over the carrier's private or public network (this requires SIM cards with fixed, routable IPs or a private APN).

2. Tunnel Establishment: One router at the central site is configured as the GRETAP server, while routers at the other sites are configured as GRETAP clients. A point-to-point Layer 2 tunnel is created between them by configuring each end with the other's IP address.

3. Logical Unification: This virtual tunnel (the GRE TAP interface) is bridged to the router's local LAN bridge. As a result, all terminals behind the remote routers appear to be directly connected to the central router, sharing the same broadcast domain. The central router can then assign IP addresses to all devices (using DHCP), and devices across different locations can receive each other's broadcast packets.

In this topology, all IP addresses for the field devices are centrally managed by the central-site router. Regardless of physical location, all devices reside on the same subnet and can discover and communicate with each other seamlessly.

3. Key Considerations for Deployment

This solution has been practically applied in remote monitoring scenarios across industries like power, transportation, and water utilities. Key points for successful deployment include:

1. SIM Card is Critical: This solution typically requires SIM cards with reachable, fixed IP addresses. These are not standard public internet SIMs but rather dedicated IoT cards. You need to contact the carrier (or work through a hardware vendor) to set up a private APN and assign fixed private IPs, ensuring all routers can ping each other.

2. Configuration Process:

   • Central Site (Server): Configure the tunnel (specifying local and remote addresses) and enable DHCP to centrally manage the IP subnet for all end devices.

   • Remote Site (Client): Configure the tunnel (pointing to the central site's address) and crucially, disable the local DHCP server to avoid IP address conflicts, allowing the central router to handle IP assignment.

3. Suitable Scenarios: This approach is particularly well-suited for environments with strong dependencies on Layer 2 broadcast, such as transmitting Goose messages in substations, enabling auto-discovery in PLC networks, or collecting data from multiple sites in real-time.

4. Limitations of Legacy Solutions and a Better Path

While the traditional GRETAP Layer 2 VPN is effective, its deployment and maintenance can be complex and technical. It relies on dedicated SIMs with fixed IPs, configurations are not user-friendly for non-experts, and it typically lacks a unified management platform.

A more advanced approach is to leverage SD-WAN (Software-Defined Wide Area Network) technology, which offers several advantages:

• No Public IP Required: Devices can be set up without fixed public IPs; they connect and establish tunnels via a cloud-based controller.

• Compatible with Layer 2 Communication: Mature SD-WAN solutions support Layer 2 networking, similarly enabling geographically dispersed devices to communicate as if they were on the same local network, resolving industrial protocol interoperability issues.

• Simplified Operations: SD-WAN provides a unified management platform, allowing for remote monitoring, configuration, and "zero-touch" provisioning, drastically reducing on-site maintenance costs and complexity.

5. Conclusion

The core value of "building an end-to-end VPN over 4G/5G" for wireless network connectivity is that it transcends the limitations of physical geography and traditional network architecture. It logically "extends" a local area network across physically dispersed industrial sites. By solving the problem of Layer 2 broadcast communication that Layer 3 routing cannot handle, it becomes an essential tool for remote monitoring, data acquisition, and system integration.

As technology evolves, more intelligent and user-friendly SD-WAN solutions are lowering the barrier to adopting this technology, enabling faster and more stable industrial IoT connectivity across the board.