Glossary · OT security engineering
Remote access server
Also known as: Remote access gateway, VPN gateway
German: Fernzugriffsserver
In network security, a remote access server is a system that accepts and terminates connections from remote users or sites, typically through VPN or a remote access protocol, authenticates them and forwards permitted traffic into the internal network according to policy.
- Security engineering
- OT security
In one sentence
A remote access server accepts and terminates remote connections, authenticates users and forwards permitted traffic into the internal network.
Example
Service partners connect to the plant's remote access server with MFA; the server only forwards their sessions to the jump server in the DMZ, never directly to the production network.
How it applies
- Engineering: The remote access server sits at the boundary, usually in a DMZ, and is part of a Conduit to the plant. It should enforce MFA, individual accounts, per-user policies and logging, and hand sessions to a Jump server rather than opening network-level access to production.
- Operation: The operator controls when remote access is enabled. Some plants keep the server disabled until a service request is approved.
- Maintenance: Remote access servers and VPN appliances are frequently targeted, and their vulnerabilities are often exploited quickly after disclosure. They need priority patching and monitoring.
- Documentation: Service documentation from machine builders often includes their own remote service boxes. Their manuals should state how the device connects (outbound only or inbound), which ports it uses, how the operator can enable and disable access and how sessions are logged.
Remote access server vs. jump server
The remote access server terminates the external connection. The Jump server is where users work from when accessing target systems. Combining both functions in one system is possible but reduces separation.