Organization VPN Services

An organization VPN service connects Mirox to a shared VPN gateway on your own network — one tunnel that several plants sit behind. Where a direct VPN is a per-plant tunnel to that plant's own router, an organization VPN is the right shape when your plants are already reachable through one central gateway: a headquarters firewall, a telecontrol network, or a carrier-managed VPN concentrator.

You manage VPN services in the Organization settings, on the VPN tab.

Open in Mirox

Open your organization's VPN services. In the app: Organization settings, VPN tab.

Concept

One VPN service = one WireGuard tunnel from Mirox to your gateway. Organization VPN services are WireGuard-only; a plant whose router needs OpenVPN or IPsec uses a direct VPN instead.
Plants are assigned to the service, each with the subnet (network range) that hosts its devices behind the gateway. Mirox routes exactly those ranges through the tunnel — never everything.
The same tunnel serves monitoring (data collection from loggers and inverters) and remote access for your team, subject to the normal permission system.
Each plant's Networking page shows the assigned VPN with its live connection state; the plant's connection pipeline on the Overview tab includes the VPN as its own stage.

The VPN Services Table

Column	What it tells you
Name	The service's name in your organization.
Type	The tunnel protocol — WireGuard.
Parks	How many plants are assigned to this service.
Region	Which Mirox cloud region terminates the tunnel.
Status	Whether the service is active, paused, or still being rolled out.
Availability	The tunnel's connection history.
Traffic	Bytes exchanged through the tunnel recently.

Creating a VPN Service

Click Create VPN service.
General — name and optional description.
WireGuard Config — upload the gateway's WireGuard configuration file (.conf) or enter the endpoint, keys and allowed ranges manually. This is the configuration of your gateway — Mirox dials it.
Save. Mirox rolls the tunnel out; the status switches to active once the gateway answers.

Who can manage VPN services

Creating, editing, pausing and deleting VPN services — and assigning plants — requires an organization Moderator or Admin. VPN configurations are never editable through job-level or cooperation permissions.

Assigning Plants

Each assignment maps one plant to the subnet that hosts its devices behind the gateway:

Open the service and choose Assign park.
Pick the plant and enter its subnet (CIDR), e.g. 10.20.30.0/24.
Optionally set a ping endpoint — a device inside that subnet (typically the gateway's inner address or a logger) that Mirox probes to judge whether the plant network behind the tunnel is actually reachable, not just the tunnel itself.

After assignment the plant's data collection and network device discovery run through the shared tunnel. A plant can combine an organization VPN with additional direct VPNs — devices are matched to the tunnel whose subnet contains them.

Operating a VPN Service

Pause / Resume — pausing keeps the configuration but stops the tunnel; every assigned plant's site network becomes unreachable until an admin resumes it. Paused is an intentional state: the plants' Networking pages show a banner rather than an error.
Restart — cycles the tunnel without changing configuration; useful after changing settings on your gateway.
Change region — moves the Mirox end of the tunnel to a different cloud region, e.g. after latency or routing changes on your side. Expect a short reconnect.
Edit — update name, description, or the WireGuard configuration (for example after rotating keys on your gateway).
Delete — removes the service; assigned plants keep their monitoring but lose the shared route to their devices. Reassign those plants to another VPN or set up direct VPNs first.

Tunnel up, plant down?

The service's availability reflects the tunnel to your gateway. Whether each plant's network behind the gateway answers is judged separately (the ping endpoint and the monitored devices). A healthy tunnel with a silent plant network points at routing on your gateway or the plant's local network — not at the VPN service.

Who Can Configure It

Role	VPN services
Organization Admin / Moderator	Create, edit, pause/resume, restart, change region, assign/remove plants, delete
Technical Manager on a plant	Sees the assigned VPN's state on the plant's Networking page
Other roles / cooperation partners	See connection status where they can see the plant; no configuration access

Concept	What it connects	Scope	Who controls it
Organization VPN service (this page)	Mirox ↔ one shared gateway on your network	Several plants behind one gateway	Org Moderator/Admin
Direct VPN	One plant's agent ↔ that plant's own router	One plant	Org Moderator/Admin
Personal VPN	One user's device ↔ all their authorized plants	Per user	Each user
Browser Proxy	The browser ↔ one device web interface	Per device, on demand	Plant operator

Direct VPN — the per-plant alternative when there is no shared gateway
Using the VPN — the personal profile for individual remote access
Managing Network Devices — discovery and monitoring through the tunnel
Local Network Inspector — how reachability through the tunnel is judged
Access Audit Logging — the audit trail covering all remote access