How to debug Modbus & OPC-UA over SSH without a VPN
Industrial and IoT engineers often need a Modbus TCP or OPC-UA client on a laptop, while the PLC or gateway sits on a plant or lab LAN with no clean VPN. If you already have SSH to a jump host on that network, you can ride an encrypted tunnel instead of standing up site-wide remote access.
Not a policy bypass. This is an eng/debug pattern for labs and approved jump hosts. OT zoning, change control, and vendor guidance still win. Prefer short-lived forwards and hosts you already trust.
The problem general SSH tools ignore
Termius, PuTTY, and friends get you a shell. They don’t help you point a Modbus poller or OPC-UA browser at 192.168.10.50:502 when that address only exists behind the edge gateway. A full VPN works — and is often overkill for “read three holding registers before the truck leaves.”
Pattern: SSH local port forward
- SSH to a Linux jump host that can already reach the PLC/gateway.
- Forward a local port on your laptop through that session to the industrial endpoint.
- Aim your Modbus/OPC-UA tool at
127.0.0.1:<localport>.
# Modbus TCP example (PLC at 192.168.10.50:502) ssh -L 5020:192.168.10.50:502 user@jump-host # Then point your Modbus client at 127.0.0.1:5020 # OPC-UA example (endpoint on gateway :4840) ssh -L 4840:192.168.10.60:4840 user@jump-host
Traffic between laptop and jump host is SSH-encrypted. The last hop (jump → PLC) stays on the plant/lab LAN as it already would for local tools.
When Cloud Portal beats a VPN
If the edge device is NAT’d and you can’t open inbound ports, a reverse tunnel from the device (or a field agent) to a broker is often cleaner than hairpin VPN. AidaIDE’s Cloud Portal is built for that “no open ports” shape — still not a substitute for OT architecture review.
Keep shell, files, and protocol tools aligned
Debugging OT is rarely “just registers.” You also pull journalctl, tweak a gateway YAML, and sometimes attach serial for boot logs. That’s why a dual-pane SFTP + terminal workspace beats juggling PuTTY + WinSCP + a Modbus GUI:
- Same saved session / vault for the jump host
- Edit gateway config in place over SFTP
- Leave the port-forward session up while you poll
- Optional Pro AI on terminal context when a service dump is noisy
Free forever covers the SSH/SFTP workspace. Pro is $19/mo for the AI suite. General SSH clients (including Termius) don’t compete here — this is the industrial/edge niche.
Checklist before you forward
- Is the jump host approved for eng access?
- Are you forwarding only the ports you need (502 / 4840 / vendor port)?
- Can you prefer read-only Modbus functions while testing?
- Do you have a rollback for any config you edit over SFTP?
- Will the forward die when the laptop sleeps? (Plan reconnect.)
Related comparisons
If your baseline is a consumer SSH client or a full remote IDE, these pages spell out the trade-offs: