Most industrial cellular router datasheets list four or five VPN protocols and stop there. In practice, IPsec, OpenVPN, WireGuard, and ZeroTier solve different problems, and picking the wrong one causes real deployment pain — firewall exceptions that never get approved, tunnels that drop on carrier NAT, or a mesh that will not scale past a pilot.
This guide compares the four VPN protocols most commonly supported on Yifan industrial routers and 5G CPE — including the NR610 / NR610-Q outdoor ODUs and the NR330-Q indoor CPE — and gives a practical decision path for SCADA, fleet, and remote-site connectivity.
The four protocols in one paragraph each
IPsec — the enterprise default. Runs at the network layer, integrates with existing firewalls (Cisco, Fortinet, pfSense) and cloud VPN gateways (AWS, Azure). Strong choice when IT already has IPsec infrastructure and needs the router to plug into it without a new client stack.
OpenVPN — the flexible generalist. Works over TCP or UDP, tunnels through almost any firewall (including port 443), and has the widest server ecosystem. Slightly heavier CPU cost than WireGuard on constrained hardware, but very forgiving of difficult networks.
WireGuard — the modern, low-overhead choice. Smaller codebase, faster handshake, better throughput per CPU cycle — meaningful on router-class hardware running many other services (firewall, NAT, monitoring agent) at the same time. Growing default on newer firmware.
ZeroTier — mesh-style software-defined networking. Devices join a virtual network and talk to each other directly (peer-to-peer where possible) without manually managing a hub-and-spoke tunnel topology. Strong fit for growing fleets where new sites are added often and central VPN concentrator capacity is a bottleneck.
Decision path: which one for which job
- Router terminates into an existing corporate VPN gateway (Cisco ASA, FortiGate, AWS VPN) → IPsec. It is the lingua franca of enterprise VPN concentrators.
- Site has an unpredictable or locked-down firewall (hotel Wi-Fi style networks, some cellular APNs) → OpenVPN over TCP/443. Most likely protocol to get through without a firewall change request.
- Router hardware is CPU-constrained, or you are running many tunnels per device and want lower latency/overhead → WireGuard, if your server/controller stack supports it.
- You are scaling from a handful of sites to hundreds and do not want to reconfigure a VPN concentrator every time → ZeroTier or another SD-WAN mesh approach.
- Regulatory or customer contract mandates a specific standard (common in utilities and government) → check the requirement first; it may force IPsec regardless of the other tradeoffs.
Many deployments end up running two protocols side by side — for example IPsec back to head office plus WireGuard between field routers for peer-to-peer diagnostics. Confirm your router supports running more than one VPN client concurrently before assuming this is possible.
What to check on the datasheet, not just the marketing page
- Concurrent tunnel count — some routers cap simultaneous VPN sessions; verify against your fleet size, not just “supported: yes”
- Hardware acceleration — whether IPsec/AES is offloaded in silicon or handled by the CPU affects real-world throughput once the tunnel is loaded with SCADA polling or video traffic
- Failover behavior — does the VPN tunnel automatically re-establish after a dual SIM failover event, or does it need a manual reconnect?
- Certificate vs pre-shared key support — certificate-based auth scales better across large fleets; PSK is simpler for small pilots but harder to rotate at scale
- Central management — whether VPN configuration can be pushed remotely via the Yifan IoT Management Platform instead of touching each router on-site
VPN and SCADA / serial integration
For RS232/RS485 SCADA and PLC integration, the VPN protocol matters less than making sure the tunnel stays up under intermittent cellular signal — a Modbus poll timeout every time the tunnel renegotiates will look like a flaky RTU, not a network problem. This is one more reason dual SIM failover and VPN reconnection behavior need to be tested together, not assumed. See our Industrial IoT & SCADA solution page for connectivity patterns, and the Smart Grid and Fleet Management pages for site-to-cloud examples.
Yifan models with multi-protocol VPN support (starting points)
- NR610 / NR610-Q — outdoor 5G ODU/CPE with PPTP, L2TP, IPSec, WireGuard, and ZeroTier
- NR330-Q — indoor 5G CPE with PPTP, L2TP, IPSec, WireGuard, and Zerotier
- Yifan industrial routers — RS232/RS485 serial models for SCADA/PLC integration behind a VPN tunnel
Confirm the exact protocol list and concurrent tunnel limit on the datasheet for your specific SKU before finalizing a design — VPN feature sets can vary between hardware revisions.
FAQ
Is WireGuard secure enough for industrial use?
Yes. WireGuard uses modern, well-reviewed cryptography and has seen wide adoption since being merged into the Linux kernel. The more common limiting factor is ecosystem support (does your existing VPN concentrator or controller support it) rather than the protocol’s security.
Can I run IPsec and WireGuard on the same router at the same time?
On many industrial routers, yes, provided the hardware and firmware support multiple concurrent VPN clients. Check the concurrent tunnel limit on the datasheet, since this varies by model and CPU.
Why does my VPN tunnel drop every time the router fails over to the backup SIM?
A new SIM often means a new WAN IP and sometimes a different NAT environment (carrier-grade NAT is common on cellular). The VPN client needs to detect the WAN change and re-establish the tunnel automatically; not all firmware does this cleanly. Test this scenario specifically during commissioning, not just the failover itself.
Does ZeroTier require a VPN concentrator at head office?
No — that is the main appeal. Devices join a virtual network and can reach each other with less manual server-side configuration than a traditional hub-and-spoke IPsec/OpenVPN design, which is why it fits fast-growing fleets well.
Next step: Tell us your fleet size, existing VPN infrastructure, and whether SCADA/serial integration is involved. Request a VPN and router recommendation from Yifan sales engineering.