VPN Connectivity

A dedicated WireGuard tunnel between your plant and our concentrator. We never enter your network; you open a minimal pipe that only lets traffic through to the OT subnet where your PLC lives.

What it's for

PLCs live behind the plant's firewall. For Rela AI to read their Modbus, OPC UA, S7 or EtherNet/IP registers, it needs a way to cross the firewall without exposing the PLC to the internet. The self-service VPN solves this with a dedicated tunnel — auditable and revocable in seconds — without touching your corporate VPN or opening public ports.

How it works

1. Go to Settings → VPN Connectivity in the dashboard.
2. Give the tunnel a name (e.g. "Torreón Plant") and click Create.
3. We automatically assign you a private /24 subnet within 10.200.0.0/16.
4. You pick your equipment (pfSense, OPNsense, Mikrotik, Ubiquiti, Linux, Windows, Docker) and download the tailored config.
5. You paste it into your router/firewall — once.
6. On the first handshake (10–30 seconds later), the dashboard shows Connected and you can create Modbus sources pointing at your PLC's private IP.

The private key of your end of the tunnel never leaves your equipment: if you switch providers, you delete it and we can no longer reach your network.

Benefits

Tunnel onboarding — step by step

1. Create the peer in the dashboard

Go to /settings/connectivity and click Create tunnel. Give it a label that identifies the plant (e.g. "Monterrey Plant North"). On creation, the system:

• Assigns a unique private subnet (10.200.X.0/24).
• Generates a WireGuard keypair. The private key is encrypted with GCP KMS and served only once on download.
• Publishes an event to the concentrator to accept your peer.

2. Download the config for your equipment

At the top of the panel, a 7-equipment selector appears. Pick yours:

3. Apply on the router and verify

Once the config is pasted and the interface is up, the tunnel performs a handshake every 25 seconds (PersistentKeepalive). The first one typically arrives in 10–30 seconds.

In the dashboard you'll see the widget change:

• Connection pending (initial state).
• Connected (first handshake arrived — done).
• No recent connection (handshake older than 5 minutes — check your router).

4. Create the Modbus/OPC UA source

Once the tunnel is connected, you can create a source pointing at the PLC's private IP on your internal network. Routing is automatic: any packet to the 10.200.0.0/16 range goes out via the tunnel.

Per-equipment details

pfSense

Open the downloaded XML and copy the contents. In the router's web console:

1. VPN → WireGuard → Tunnels.
2. Click Import (upload-file icon).
3. Paste the XML and Save.
4. The interface comes up automatically; Status → WireGuard shows the peer and the latest handshake.
5. Verify Firewall → Rules has a rule allowing traffic between your OT LAN and the rela_vpn interface.

OPNsense

Same idea as pfSense but the menu path is VPN → WireGuard → Instances:

1. VPN → WireGuard → Instances → Add.
2. Copy the XML values manually (OPNsense doesn't have a direct WireGuard XML importer — use the values from the file).
3. VPN → WireGuard → Peers → Add, paste the server's pubkey.
4. Activate the interface in Interfaces → Assignments.

Mikrotik RouterOS 7+

Open Terminal (WinBox or SSH) and paste the contents of rela-vpn-mikrotik.rsc line by line. The script creates:

• A WireGuard interface named rela-vpn.
• An address on that interface.
• A peer pointing at the concentrator with allowed-address set to our subnet.
• A static route to 10.200.X.0/24 via rela-vpn.

Then check /interface wireguard peers print — last-handshake should be under 30 seconds.

Ubiquiti EdgeRouter / EdgeOS

SSH to the router and paste the configure... set... commit... save... exit batch. If saving fails, verify you have the WireGuard package installed (EdgeOS 2.x ships it natively; v1.x requires a manual .deb).

Linux / Raspberry Pi

sudo mv ~/Downloads/rela-vpn.conf /etc/wireguard/rela-vpn.conf
sudo chmod 600 /etc/wireguard/rela-vpn.conf
sudo wg-quick up rela-vpn
sudo systemctl enable wg-quick@rela-vpn

systemctl enable ensures the tunnel survives a reboot.

Windows

1. Download the official client: wireguard.com/install/
2. Add Tunnel → Import tunnel(s) from file → pick rela-vpn.conf.
3. Click Activate.
4. Windows Services → Run on startup so it reactivates at boot.

Docker Compose

Put docker-compose.yml and rela-vpn.conf in the same directory. Then:

docker compose up -d
docker compose logs -f rela-vpn

If the container dies on capability errors, ensure the host allows NET_ADMIN and SYS_MODULE (any modern Linux does).

Troubleshooting

The handshake never shows up

• Verify outbound UDP 51820 isn't blocked by your firewall or ISP.
• Check the pubkey your router shows matches what the dashboard generated (copy-paste sometimes clips characters).
• If your router is behind NAT, make sure PersistentKeepalive = 25 is active so the NAT mapping doesn't close.

Active handshake but no traffic reaches the PLC

• Check that the PLC and the router are on the same subnet.
• On pfSense/OPNsense: Firewall → Rules → WireGuard interface must have an Allow rule between your OT LAN and the router.
• On Mikrotik: /ip route print must show the route 10.200.X.0/24 → rela-vpn.

Dashboard says "No recent connection"

• Your router lost the tunnel. Common causes: ISP DHCP rotated your public IP, router rebooted without systemctl enable, power outage.
• Check the router logs. On Linux: sudo journalctl -u wg-quick@rela-vpn.

Why don't we use your corporate VPN?

This is the most common question from your IT team. The short answer: for security, for compliance, and because your corporate VPN is designed for humans, not machines. The 9 detailed technical reasons are in Why a dedicated tunnel?.