The most common objection I get is not about price, features or robot brands. It is this:
“IT won’t let us put the robot on the network.”
They are absolutely right to say it! A twelve-year-old robot controller running an operating system that stopped getting patches a decade ago should not be sitting on the same flat network as the finance PCs, and it certainly should not be reachable from the internet. Any IT department that waves that through is not doing its job.
The answer is not to argue with them. The answer is to not put the machine on their network at all.
What Network Segmentation Actually Means Here
Older industrial equipment was never designed to be exposed. Controllers use protocols with no authentication, no encryption and no concept of an attacker. That is not a criticism of the machines — they were built to be on an isolated cell network with a cable to a teach pendant, and for that job they are fine. The risk only appears when someone drops them onto a network that has a route to the outside world.
Segmentation means putting the machine on its own small network, separated from everything else, with one controlled path in and out. Nothing on the wider site network can see it. Nothing on the internet can see it. The only thing that can reach it is RoboVigil, through an encrypted tunnel that the site itself initiates.
That is the whole model. Everything below is how you get there.
Why WireGuard
WireGuard is the VPN protocol we use for every connection into RoboVigil. There are three reasons for it.
The cryptography is modern and fixed. WireGuard uses ChaCha20 for encryption, Poly1305 for authentication, Curve25519 for key exchange, BLAKE2s for hashing. There is no cipher negotiation, so there is nothing to downgrade and no weak option to accidentally leave enabled. When people say “military grade encryption”, this is the sort of thing they mean.
Nothing is opened to the internet. The tunnel is established outbound from the site to our server. There is no port forwarding on the customer’s firewall, no inbound rule, no public IP on the machine, no exposed service. To a port scanner, the site looks exactly the same after installation as it did before. WireGuard also does not respond to unauthenticated packets at all — if you have not got the key, the server does not answer you.
It is small enough to trust. WireGuard is a few thousand lines of code and has been in the mainline Linux kernel since 2020. It is audited, it is fast, and it is in the firmware of most decent routers already.
The machine data and the camera stream both travel inside that tunnel. Camera video never goes to the camera manufacturer’s cloud, because it never leaves the local network except through the tunnel to us.
The Teltonika RUT200
If you are connecting your first machine, this is what I would use. It is an industrial 4G router, roughly £100 including VAT, DIN rail mountable with the optional bracket, and it does the segmentation and the VPN in one box.
It works like this. The RUT200’s LAN port is a network of its own, and that is where the machine lives — plugged straight into the controller’s service port, along with an IP camera if you are using one. The RUT200’s own uplink goes to the outside world. The machine has no route to the site network and the site network has no route to the machine. All that crosses the boundary is the WireGuard tunnel to RoboVigil.
You import the WireGuard configuration through the RUT200’s web interface — Services, VPN, WireGuard, paste the file we generate for your factory. There is no command line involved.
The RUT200’s WireGuard connection can handle a few machines and cameras, you can plug a switch (ideally with PoE for the cameras) into the LAN socket of the RUT.
Three Ways to Get It Online
The RUT200 needs an internet connection of its own. There are three options, and the right one depends entirely on what IT will agree to and the bandwidth you need.
1. Wired into the site network. The WAN port goes into any spare network socket and picks up an address by DHCP, like a printer would. From IT’s point of view they have added one device to their network — a router with an outbound VPN — and the machine sits behind it, invisible. This is the tidiest option and usually the easiest one to get approved, because you can describe exactly what it does in one sentence.
2. Over site Wi-Fi. The RUT200 can join an existing Wi-Fi network as a client and use that as its uplink instead of a cable. Useful when the cell is nowhere near a network socket, or when running a cable means a permit, a contractor and three weeks. Same result as option one.
3. Over 4G. Put a data SIM in it and the RUT200 brings its own internet connection. This is the one that ends the conversation with IT, because there is no conversation to have — the machine never touches their infrastructure at any point. Nothing is plugged into their network, nothing appears on their firewall, nothing needs their approval. If you go this route and you are also connecting a camera, the WAN port needs reconfiguring as a second LAN port so both devices sit behind the tunnel; Teltonika document the procedure on their wiki.
A SIM is a few pounds a month for telemetry alone. Add more data if you intend to stream camera views regularly. You even can buy RUT200’s with unlimited data packages, the RUT hardware often comes at a discount but the monthly data cost varies depending on supplier.
Or Use the Router You Already Have
RoboVigil does not require our hardware, because we do not sell hardware. If the site already has a router with WireGuard support — most modern business routers do, and so do OPNsense, pfSense, MikroTik, Ubiquiti and the GL.iNet range — you import the same configuration file into it and you are connected. No extra box, no extra cost.
The reason I still recommend the RUT200 for a first installation is that it removes every variable at once. Segmentation, VPN, and internet access are all handled by one device you configure yourself in a web interface, without needing anybody else to change anything. Once you have seen it working on one machine and you know what the traffic looks like, having the conversation about the site’s own router is a much easier conversation to have.
If you have over 5 or 6 machines with cameras that need connecting you will want to look at something more powerful than the RUT200. There are lots of options out there from Teltonika and many others. You simply need something to create a WireGuard isolated segment with the bandwidth for the cameras and machines you have.
What You Don’t Need
- No inbound firewall rules — the tunnel is established outbound
- No public IP address and no port forwarding
- No software on the controller — nothing installed, nothing loaded, no programs modified
- No on-premises server — no gateway PC, no edge box, no middleware
- No change to the site network — the machine sits behind the gateway, not on their LAN
Getting Started
- Create an account at app.robovigil.com
- Download the app — App Store, Google Play or Amazon Appstore
- Create a factory and download your WireGuard configuration
- Import the .conf file into the RUT200, or into your own router
- Connect the machine to the gateway’s LAN port
- Enter the machine’s details in Machine Setup, test the connection and save
- Connect an RTSP camera to the cell, enter its details in Camera Setup and save
Under half an hour for a straightforward installation, and no production downtime.
Any questions: hello@robovigil.com
https://www.teltonika-networks.com/products/routers/rut200
https://www.mikrotik-store.eu/en/teltonika-rut200-industrial-cellular-router
The Technology Doctors RUT200 with data