Secure Remote Access (VPN)
Reach a node and its remote devices securely over your own network, with no exposed ports and no site-to-site VPN to manage.
Overview
ControlBird nodes can join your own Tailscale network: a private, encrypted mesh network that you control from your own Tailscale account. This is not a ControlBird-hosted network. You generate the key that lets a node join from your own Tailscale admin console, and the node joins as a device on your network like any other. ControlBird never gains access to a network you haven't explicitly connected it to.
Joining your network gives you two capabilities:
- Remote admin access. Once a node is connected, you can reach its dashboard securely from anywhere on your network, without opening any firewall ports.
- Remote field-device reach. Any protocol endpoint (Modbus, HTTP, EtherNet/IP, OPC UA, MQTT, DNP3, BACnet, or CoAP) can be configured to reach a device at a different site over your network, so a node no longer needs to sit on the same local network as every device it talks to.
No special network privileges are required to use this. It works the same way whether a node runs on your own hardware or as a managed cloud node, including in deployments where you don't control the underlying network.
Bring your own network
You need a Tailscale account (a free account covers most single-organization setups). A node connects to your network using a key you generate; ControlBird has no network of its own that your nodes join.
Where to find it
Remote access setup lives in the Device Manager app, at the node level. Open Device Manager, select a node in the device tree, and look for the Secure Remote Access section in its detail pane.
Connect a node
- Click Generate an auth key, which opens your Tailscale admin console in a new tab. Create a key that is tagged and set to non-expiring, so the node doesn't lose its connection later when the key expires.
- Paste the key into the Tailscale auth key field.
- Click Connect. The section shows Connecting while the node joins your network.
- Once connected, the section shows Connected along with the node's network address, its DNS name, and how many other devices (peers) are on the network. Both the address and DNS name have a one-click copy button.
- Click Disconnect at any time to take the node off your network immediately.
If a connection fails
A failed connection shows an Error status with a reason. If the key expired or was revoked, generate a new one and enter it to retry. Otherwise, leave the field blank and retry with the key already on file.
Route a specific endpoint to a remote device
Every protocol endpoint has a Route via VPN toggle, available in its detail pane in Device Manager and shown automatically when you add a new endpoint. Turn it on for an endpoint that needs to reach a device at a different site over your network; leave it off for endpoints reaching devices on the node's own local network. You can mix both on the same node: some endpoints stay direct and local, others route to one or more remote sites, with no conflict between them.
The remote site needs to be on your network too
Routing an endpoint only configures the ControlBird side of the connection. The remote site needs its own Tailscale-connected device (commonly a subnet router) already set up and on the same network as the node, so the node has a path to the device's local network. Setting up that remote-side device is a Tailscale configuration step, done once per site.
Reaching multiple sites from one node
Because your Tailscale network is a mesh rather than a point-to-point link, a single node can route different endpoints to different remote sites at the same time. For example, one cloud-hosted node could route a Modbus endpoint to a PLC at Site A while simultaneously routing a BACnet endpoint to a building controller at Site B, each reaching its own site independently.
Supported protocols
Routed endpoints work for the same reads and writes as a direct connection, for every supported protocol. A few protocols have specific behaviors worth knowing about when a device is reached remotely instead of on the local network.
| Protocol | Supported when routed | Not yet supported when routed |
|---|---|---|
| Modbus TCP | Reads and writes | None |
| HTTP | Requests and responses | None |
| EtherNet/IP | Tag reads and writes | None |
| DNP3 | Reads and writes | None |
| OPC UA | Unsecured and secured connections, including strict certificate hostname verification | None |
| MQTT | Plain MQTT, and MQTT over TLS, including brokers that select certificates by server name (SNI) | None |
| BACnet | Unicast reads and writes (ReadProperty, WriteProperty, and similar), and device discovery through a BBMD at the remote site | Broadcast-only discovery on sites without a BBMD |
| CoAP | Plain CoAP, and CoAP over DTLS in both PSK and Certificate mode | None |
Certificate checks work against the device's real hostname
When traffic is routed over your network instead of going directly to a device, the connection no longer originates from the device's own network identity. Protocols that validate a certificate's hostname (OPC UA, MQTT over TLS, Modbus TLS, and CoAP over DTLS in Certificate mode) still verify against the hostname you configured for the device, so certificates issued for the device's real name keep working on a routed connection, with no need to relax certificate verification.
Troubleshooting & Limitations
- BACnet discovery at a remote site works through a BBMD. Broadcast traffic doesn't cross your network the way unicast traffic does, so a routed network scan needs a BBMD (BACnet Broadcast Management Device, usually the site's BACnet router) at the remote site: point the endpoint at the BBMD and fill in its BBMD fields, and discovered devices appear with their real addresses. On sites without a BBMD, add routed BACnet devices manually with their known IP address, port, and Device ID.
- The remote site needs to be set up first. Reaching a device at a remote site requires that site to already have a Tailscale-connected router or device on the same network. Routing an endpoint doesn't configure the remote side for you.
- Disconnecting a node stops all of its routed endpoints. If you disconnect a node from your network, every endpoint currently routed through it loses its path to its remote devices until the node reconnects.