No inbound port
Reach your industrial equipment without opening a port
PipeLinker gets you onto your PLCs, HMIs and industrial equipment without opening an inbound port. The agent establishes an outbound flow to the hub you host. Before the job, telemetry says what answers; during it, rights say who does what; afterwards the log keeps it, and sessions replay.
The path, in this order. The equipment - PLC, HMI, controller - is reached by the agent placed on a machine of its own network. The agent opens an outbound flow to the hub you host: nothing listens on the site, and no inbound firewall rule is requested. The hub carries the telemetry, the rights, the log and the recordable sessions. The authorised person enters through the hub, and reaches only the targets opened to them - never the site's network.
Why you do not open a port on an industrial site
An inbound port is an address reachable from the internet, a firewall rule to obtain, and a surface someone will eventually probe. On an industrial site the request goes through the customer's IT, through their network provider, sometimes through the telecom operator: depending on the customer's network policies, the request takes several approvals, takes time, and can be refused at the end of it.
There is something worse than the refusal: the approval. A rule created for a one-off job can stay in place if nobody removes it; a few years later nobody remembers why it is there, and it appears in no inventory. A VPN has the same problem one notch higher: it does not grant access to a machine, it grants access to the network.
How outbound-flow access works
The agent placed on a machine of the site opens an encrypted connection to the hub you host, and keeps it. Everything goes through it: telemetry, commands, updates and remote access. A plain outbound internet connection is enough - 4G, 5G, a contractor's router, a site link.
On the site side, nothing listens. There is no port to expose, no fixed address to ask for, no inbound rule to keep alive over time. And equipment that cannot carry an agent - a PLC, an HMI - is reached through the agent of a machine on its network, by a service you declare: its address, its port, its protocol.
The case of PLCs and HMIs, protocol by protocol
Knowing what answers, before connecting
The agent reports the machine's state and metrics without being asked. Before opening a session you know what answers, what no longer does, and since when. That is the difference between preparing a job and discovering it: a machine silent for three days is not a session to open, it is a trip to plan.
Giving access to a team or to a contractor
Rights are granted by role, by fleet and by target, to named people: view, open a session, send a command, deploy an update, administer. A second factor can be required by role. Nobody reaches the site's network: each person opens only the services they have been allowed, one by one.
And when the target asks for a password, it can stay sealed in the hub: the person intervening receives the right to open the session, not the machine's credential.
Logging, and being able to show it
The audit log keeps who accessed what, when, on which machine and for how long. Terminal and screen sessions are recorded and replayed, with a time cursor. That is what you bring out the day you have to explain a manoeuvre, answer an auditor or investigate an incident.
Hosting the hub on your premises
The hub is one binary and a PostgreSQL database, on the machine of your choice. Your fleet data and your access logs stay there, and an outage at the vendor does not close your sites. A network fully cut off from the internet works: agent binaries are then dropped in by hand.
The questions we get
Is it really zero inbound ports?
Yes, on the remote site. The agent establishes the connection to the hub, outbound. It is the hub that is reachable - on your premises, behind your reverse proxy, and it is the only point to expose.
What about PLCs that cannot carry an agent?
An agent on a machine of the same network acts as their gateway. You declare the service in the console and it becomes reachable through the agent: web interface, SSH, SFTP, VNC, RDP or a raw port. Nothing to install on the PLC.
How long does it take to equip a site?
The time to place the agent on a machine and declare the services it serves. There is no firewall-rule request to make, and that request was what carried most of the delay.
Page last updated on 22 September 2026. Technical page, maintained by the PipeLinker team at LOOTUS SECURITY, publisher of the product. The date comes from the repository, not from a hand edit.