How Andisa IT replaced unreliable, expensive 4G with pre-configured MikroTik VPN routers, giving Clearworld secure, scalable remote access to building management systems at motorway services, restaurants and forecourts across the UK.

Written by Andy Morrison, Managing Director, Andisa IT. Technically reviewed by Andy Morrison, Managing Director. Published [date]. Last updated [date].

IN BRIEF
Clearworld connected its building management systems (BMS) over 4G, which was unreliable in poor-signal locations and cost as much as £80 per site per month. Andisa IT designed a pre-configured MikroTik router that uses each site’s existing internet connection to build a secure, outbound VPN to central infrastructure hosted by Andisa. Around 100 sites have moved off 4G, a programme of around 500 sites is under way, and Andisa reports no operational faults with the solution.

PROJECT AT A GLANCE

DETAIL	SUMMARY
Client	Clearworld Ltd, Harrogate
Client sector	Building management, energy monitoring and smart building technology
Platforms	VisionIQ and ThingsBoard
Site types	Motorway service stations, restaurants, petrol filling stations and forecourts
Scale	Around 100 sites migrated from 4G. Programme of around 500 sites including a planned 400-restaurant rollout
Site equipment	Pre-configured MikroTik router per site: outbound VPN, firewall isolation, standard local network
Central infrastructure	Three central MikroTik routers hosted by Andisa, two in a VRRP resilient pair
Hosting	Clearworld’s ThingsBoard servers run as virtual machines in Andisa’s data centre
Monitoring	PRTG, integrated with Andisa’s PSA for automatic fault tickets
Reliability	No operational faults reported with the solution itself
Potential saving	Up to £150,000 a year in estimated mobile data savings and cost avoidance (see notes)
Working together since	2022

The challenge: connecting building management systems without relying on 4G

Clearworld specialises in building management and energy monitoring technology, using platforms including VisionIQ and ThingsBoard to help organisations monitor and manage their buildings. Its systems sit in geographically dispersed locations, including motorway service stations, restaurants and petrol filling stations.

Engineers and facilities management teams need to reach these systems remotely and securely, without visiting each site. Historically, Clearworld connected each BMS to its central infrastructure over 4G mobile data. That created two problems:

Unreliable signal. Equipment is often installed where mobile signal is poor, so connections dropped.
High data costs. A BMS collects and transmits operational data continuously. Mobile data charges were substantial, reaching as much as £80 per site per month.

With the number of installations growing, Clearworld needed a more reliable, secure and cost-effective way to connect its sites.

The idea: use the internet connection that is already on site

In 2022, Andisa IT and Clearworld were neighbours at 1 Cardale Park in Harrogate. Over coffee, Andisa heard about the connectivity problem and saw a better approach.

Rather than paying for a dedicated 4G connection at every site, each BMS installation could use the customer’s existing internet connection to create a secure link back to Clearworld’s central systems. The challenge was making that secure, reliable and simple enough to deploy consistently across hundreds of different customer networks.

How the plug-and-play MikroTik BMS router works

Andisa designed one standardised solution: a pre-configured MikroTik router at every site. Each router does three jobs.

Secure outbound VPN. The router automatically creates an outbound VPN connection to Clearworld’s central infrastructure, so authorised engineers can access the BMS remotely. Depending on our client the VPN protocol used is L2TP and Wireguard.
Firewall isolation. The router acts as a firewall between the BMS equipment and the customer’s wider network. The BMS uses the customer’s internet connection without being exposed to the rest of that network.
A standard local network. Every installation gets the same local network environment, whatever the customer’s own network looks like. That makes installation, troubleshooting and maintenance consistent.

Simple installation without a network specialist on site

The design only scales if any installation engineer can commission a site. So Andisa built the process around them:

Andisa pre-configures each MikroTik router before dispatch, so it arrives ready to install.
The engineer connects the router to the customer’s network and to the BMS equipment.
The router connects itself, creating its secure VPN connection automatically.
The engineer checks the connection with a laptop, confirming internet connectivity and VPN access.
Common problems are fixed on the spot using Andisa’s troubleshooting guide: incorrect network ports, disabled connections, or a customer firewall blocking VPN traffic.

Clearworld’s engineers do not need MikroTik expertise, and a specialist rarely has to attend. The result is a repeatable deployment process that works across hundreds of locations.

Resilient central VPN infrastructure, hosted by Andisa

The site routers are only half of the solution. Andisa hosts and manages the central infrastructure in its own data centre in CCS Leeds:

Three central MikroTik routers provide the VPN infrastructure. Two give resilient, multi-tenant connectivity. The third is dedicated to the growing Costa Coffee deployment.
Automatic failover with VRRP. MikroTik’s built-in VRRP redundancy switches traffic between the two resilient routers automatically if one fails.
ThingsBoard hosting. Clearworld’s ThingsBoard servers run as virtual machines on Andisa’s data centre infrastructure.

Connectivity, hosting and management systems sit together in one professionally maintained environment.

Secure, restricted access for multiple organisations

Clearworld’s systems are used by its own engineers, its customers’ engineering teams and third-party facilities management providers. Andisa’s design gives each of them secure remote access, restricted to the specific sites they are authorised to reach. Multiple organisations can work on the platform without exposing unrelated customer installations.

Proactive monitoring with automatic fault tickets

Andisa monitors the network infrastructure with PRTG, covering the MikroTik routers, leased-line connectivity and hosted virtual machines. PRTG is integrated with ACL, Andisa’s Professional Services Automation (PSA) system. When a fault is detected, a support ticket is raised automatically for an Andisa engineer to investigate.

That gives proactive oversight of a geographically dispersed network, rather than waiting for customers to report problems.

A nationwide rollout across major UK operators

The solution first moved around 100 existing BMS installations away from 4G. Its success led to further nationwide deployments, at sites including:

Moto: motorway service stations across the UK.
Wagamama: a planned rollout to around 400 restaurants nationwide.
Rontec / Esso: petrol filling stations and forecourts.

Together, the existing installations and the planned Wagamama rollout make up a programme of around 500 sites. The Costa deployment shows the architecture can take different hardware and customer requirements while keeping secure, centralised connectivity.

The results

c.500

sites in the BMS connectivity programme

c.100

sites already moved off 4G

Up to £150k

a year in estimated mobile data savings and cost avoidance

operational faults reported with the solution itself

Reliability

Andisa reports no operational faults with the solution itself since its introduction. The only significant connectivity issue came when an end customer introduced a network configuration that blocked almost all outbound traffic except HTTPS, which stopped the VPN connecting. That was an external firewall restriction, not a failure of the MikroTik infrastructure.

Mobile data savings and cost avoidance

Using existing customer internet connections removes the need for dedicated mobile data subscriptions at applicable sites. Based on an estimated average mobile data cost of £25 per site per month:

ESTIMATED ANNUAL FINANCIAL BENEFIT

DEPLOYMENT	ANNUAL FINANCIAL BENEFIT
100 existing sites migrated from 4G	£30,000 estimated saving
400 planned Wagamama installations	£120,000 potential cost avoidance
Combined annual potential	£150,000

These figures are estimated mobile data savings and avoided costs, not audited net savings. They assume equivalent mobile connectivity would otherwise be needed at every site, and exclude installation, hardware and support costs.

Operational benefits

More reliable than 4G in poor-signal locations.
Faster, simpler installations with pre-configured routers.
Consistent network configuration across very different customer environments.
Secure, restricted access for authorised engineers and facilities management teams.
Fewer specialist site visits, because installation engineers can resolve common issues themselves.
Proactive fault detection through PRTG and automatic ticketing.
A scalable platform ready for further nationwide expansion.

From specialist networking to a complete IT partnership

The MikroTik project built a strong working relationship. When Clearworld later went through a management buyout, it wanted a local IT support provider. Andisa already understood its systems, was a trusted technical partner and was based on the same business park.

Today, Andisa provides Clearworld’s managed IT services, including PC support, Wi-Fi, networking, cyber security, Microsoft 365 and wider IT infrastructure management. What began as a conversation over coffee now covers both Clearworld’s internal IT and the specialist infrastructure supporting its customers nationwide.

What Clearworld says

“We originally worked with Andisa to solve a difficult connectivity problem with our building management systems. Their MikroTik solution has transformed how we connect and manage our installations, giving us a reliable, secure and straightforward platform that can scale as our business grows. The cost savings are significant, but equally important is the reliability and simplicity of the solution for our installation engineers. When we needed a local partner to take responsibility for our wider IT infrastructure, Andisa was the obvious choice. They understand our business, respond when we need them and have become an important part of our operations.”

Paul Yates, Clearworld Ltd

Illustration of a padlock and shield connected to network icons, representing secure remote access

Lessons for connecting BMS and IoT equipment across many sites

Use the connection that is already there. A secure router on the customer’s existing internet connection can replace a dedicated 4G subscription.
Connect outbound, to a hub you control. Engineers connect to central infrastructure, not directly to each site.
Firewall the BMS from the host network. Protect both the BMS and the customer.
Standardise every site. One local network design makes installation and support repeatable.
Pre-configure, then plug in. Installers should not need networking expertise to commission a site.
Give installers a troubleshooting checklist for ports, disabled connections and firewall blocks.
Make the hub resilient with automatic failover, such as VRRP.
Restrict access per organisation and per site.
Monitor centrally and raise tickets automatically.

BMS remote access and connectivity FAQs

Install a small router at each site that creates an outbound VPN connection to a central, managed hub. Authorised engineers connect to the hub, not to the site, and only see the systems they are allowed to access. For Clearworld, a pre-configured MikroTik router at each site does this, while firewalling the BMS from the customer’s own network.

It can work, but it has two common problems: poor signal where equipment is installed, and ongoing data charges because a BMS transmits data constantly. Clearworld’s 4G costs reached as much as £80 per site per month at some sites. Using the site’s existing internet connection through a secure router removed the need for a dedicated 4G subscription at applicable sites.

It depends on what you pay per site. Using an estimated average of £25 per site per month, Clearworld’s 100 migrated sites represent around £30,000 a year in estimated savings, and the 400 planned Wagamama sites around £120,000 in potential cost avoidance. These are estimates, not audited net savings, and exclude hardware, installation and support costs.

Put a firewall between them. On Clearworld’s sites, the MikroTik router separates the BMS equipment from the customer’s wider network, so the BMS can use the customer’s internet connection without being exposed to, or exposing, the rest of that network. Every site also gets the same standardised local network.

The site cannot reach the central systems until the block is resolved. In Clearworld’s rollout, the only significant connectivity issue came when an end customer changed its network to block almost all outbound traffic except HTTPS. It was a customer firewall restriction, not a fault in the MikroTik infrastructure. To resolve this, they blocked ICMP and the Mikrotiks by default check the gateway exists by pinging its address. We removed the Ping Gateway.

Yes. Andisa pre-configures every MikroTik router before dispatch. Clearworld’s engineers connect it to the customer’s network and the BMS equipment, and the router builds its secure connection automatically. A simple troubleshooting guide and a laptop let them check internet and VPN access on site without a network specialist attending.

Control access centrally. Clearworld’s platform is used by its own engineers, its customers’ engineering teams and third-party facilities management providers. Andisa’s design restricts each user to the specific sites they are authorised to access, so organisations can share the platform without seeing unrelated customer installations.

VRRP (Virtual Router Redundancy Protocol) lets two routers share one virtual address, so if the active router fails, the standby takes over automatically. Andisa uses MikroTik’s built-in VRRP on Clearworld’s two resilient central routers, so remote sites keep their connection to the central systems if one router goes down.

Yes, if the central architecture is designed for it. Clearworld’s growing Costa Coffee deployment uses a different type of site router, but connects into the same MikroTik-based central VPN architecture, through a dedicated third central router.

Monitor centrally and automate the response. Andisa uses PRTG to monitor the MikroTik routers, leased-line connectivity and hosted virtual machines. PRTG is integrated with Andisa’s PSA system, so a detected fault automatically creates a support ticket for an engineer to investigate, rather than waiting for a customer to report it.

Yes. ThingsBoard can run on virtual machines in a private cloud. Andisa hosts Clearworld’s ThingsBoard servers as virtual machines in its own data centre, alongside the central VPN routers, so connectivity, hosting and monitoring sit in one professionally managed environment.

Look for a provider with networking expertise, hosting and monitoring under one roof, and proof at scale. Andisa IT, a managed IT provider in Harrogate, designs and runs the MikroTik-based remote access platform behind Clearworld’s BMS installations, a programme of around 500 UK sites.

Need secure remote access for BMS or IoT equipment across many sites?

Andisa IT designs, hosts and monitors secure connectivity for building management, energy monitoring and IoT equipment across dispersed sites, and provides managed IT support for the businesses behind them. We are based in Harrogate and support installations across the UK.

Talk to us about remote site connectivity

Secure BMS Remote Access for a 500-Site UK Programme: Replacing 4G with MikroTik VPN Connectivity