IT configuration for remote access
What the client's IT team needs to allow so the Rosepetal system can operate and be supported remotely, without exposing the plant network.
Remote support without exposing the client's network
We do not ask for incoming ports to be opened to the plant. The data plane works with outgoing connections from the controller to the cloud (HTTPS/gRPC), avoiding direct exposure of OT equipment to the internet.
For support and operational management we offer several options, from DMZ to managed VPN (recommended) or traditional VPN, depending on the client's policies:
- Managed VPN — Tailscale (WireGuard overlay): UDP 41641, UDP 3478, TCP 443/80 outbound and control domains; no need for inbound ports or NAT configuration, with identity control (ACLs) and session logging.
- Traditional VPN — WireGuard (UDP 443 to a dedicated IP) for environments that require a "classic" approach; some restrictive firewalls/NATs may require more specific treatment of UDP traffic.
Comparison of connection options
| Connection type | Security | Local network isolation | Cost | Difficulty (unrestrictive FW) | Difficulty (very restrictive FW) | Difficulty (NAT) |
|---|---|---|---|---|---|---|
| No LAN restrictions | 🔴 Low | 🔴 Low | 🔵 Low | Very low | Very low | Very low |
| No restrictions in DMZ | 🟠 Medium | 🟢 High | 🔵 Low | Very low | Very low | Very low |
| Managed VPN (Tailscale) ✅ | 🟢 High | 🟠 Medium | 🟢 Medium | Low | Medium | Low |
| Traditional VPN (WireGuard) | 🟢 High | 🟢 High | 🟠 High | Low | High | 🔴 High |
| Mobile connection 4G | 🟢 High | 🔵 Very high | 🔴 Very high | Very low | Very low | Very low |
Internet connection diagrams
| Managed VPN | Traditional VPN | 4G |
|---|---|---|
 |  |  |
Managed VPN (recommended)
The installed equipment requires access to remote access services (AnyDesk) and virtual private networks (Tailscale) for remote management. In industrial environments it is common for firewalls to block outbound connections by default, so certain ports and domains must be explicitly allowed.
Service: AnyDesk
Required outbound ports:
| Protocol | Port | Description |
|---|---|---|
| TCP | 80 | HTTPS fallback |
| TCP | 443 | HTTPS and main data channel |
| UDP | 50001 | Performance optimization |
Domains to allow:
*.anydesk.com*.net.anydesk.com
Notes:
- AnyDesk does not require incoming ports.
- If the firewall allows domain-based inspection, it is recommended to allow the listed domains.
- AnyDesk can work under the Tailscale VPN.
Service: Tailscale
Required outbound ports:
| Protocol | Port | Description |
|---|---|---|
| UDP | 41641 | VPN WireGuard |
| UDP | 3478 | STUN protocol |
| TCP | 443 | Tailscale control services |
| TCP | 80 | HTTPS fallback |
Domains to allow:
- Ideal:
*.banded-pythagorean.ts.net*.tailscale.com
- Mandatory:
rosepetal-dep-[project].banded-pythagorean.ts.netlogin.tailscale.comcontrolplane.tailscale.comlog.tailscale.com
Notes:
- Tailscale uses UDP port 41641 for point-to-point connections and network management. Allow your internal devices to initiate UDP from
:41641to*:*. - For best results, a device should be able to send to any IP address on any UDP port. Allowing outbound traffic from source
:41641and the corresponding inbound return traffic will likely work correctly. - We recommend configuring firewalls using domain names instead of IP addresses. However, if IP-based rules are required, the following ranges must be explicitly allowed: IPv4
192.200.0.0/24— IPv62606:B740:49::/48. - It does not require incoming ports or NAT configuration.
- It is essential to allow DNS resolution and outgoing UDP access.
Traditional VPN
For environments requiring advanced or customized remote access, a dedicated VPN can be used. This option involves more detailed configuration and associated additional costs.
Service: WireGuard
| Protocol | Port | Description |
|---|---|---|
| UDP | 443 | WireGuard encrypted traffic port |
IP address to allow:
82.223.19.64(vpn.rosepetal.ai, dedicated VPN at United Internet AG)
Notes:
- WireGuard uses UDP exclusively.
- Some routers and firewalls, especially those with advanced security features (advanced filtering rules, high-layer security policies, deep packet inspection), can block UDP traffic they do not recognize or manipulate it using restrictive NAT (symmetric NAT).
- This implies that UDP traffic sent by WireGuard may be discarded or not correctly associated in NAT tables, preventing the tunnel from being established. It must be ensured that the routers allow inbound and outbound UDP traffic and properly maintain NAT tables with active sessions.
Security model: Zero-Trust, encryption and identity control
- In transit: Controller↔Cloud communications encrypted with TLS 1.2+, strict certificate validation and additional authentication using secure credentials (OAuth2/JWT).
- At rest: encryption managed by the platform with keys per project/client.
- Software integrity: signed containers and models, with mandatory verification before execution.
Operational governance: OTA, rollback and audit
Rosepetal Meta provides centralized inventory, version visibility, and OTA orchestration by campaigns/batches/windows, with rollback in case of degradation. In addition, we maintain an exportable audit ("who did what, when and where") and a log of critical actions (deployments, rollbacks, access, changes), aligned with compliance needs.