Stay informed with the latest IT tips
Cybersecurity advice and exclusive resources from the Andisa team, straight to your inbox.
How Andisa IT replaced unreliable, expensive 4G with pre-configured MikroTik VPN routers, giving Clearworld secure, scalable remote access to building management systems at motorway services, restaurants and forecourts across the UK.
Written by Andy Morrison, Managing Director, Andisa IT. Technically reviewed by Andy Morrison, Managing Director. Published [date]. Last updated [date].
IN BRIEF
Clearworld connected its building management systems (BMS) over 4G, which was unreliable in poor-signal locations and cost as much as £80 per site per month. Andisa IT designed a pre-configured MikroTik router that uses each site’s existing internet connection to build a secure, outbound VPN to central infrastructure hosted by Andisa. Around 100 sites have moved off 4G, a programme of around 500 sites is under way, and Andisa reports no operational faults with the solution.
PROJECT AT A GLANCE
| DETAIL | SUMMARY |
| Client | Clearworld Ltd, Harrogate |
| Client sector | Building management, energy monitoring and smart building technology |
| Platforms | VisionIQ and ThingsBoard |
| Site types | Motorway service stations, restaurants, petrol filling stations and forecourts |
| Scale | Around 100 sites migrated from 4G. Programme of around 500 sites including a planned 400-restaurant rollout |
| Site equipment | Pre-configured MikroTik router per site: outbound VPN, firewall isolation, standard local network |
| Central infrastructure | Three central MikroTik routers hosted by Andisa, two in a VRRP resilient pair |
| Hosting | Clearworld’s ThingsBoard servers run as virtual machines in Andisa’s data centre |
| Monitoring | PRTG, integrated with Andisa’s PSA for automatic fault tickets |
| Reliability | No operational faults reported with the solution itself |
| Potential saving | Up to £150,000 a year in estimated mobile data savings and cost avoidance (see notes) |
| Working together since | 2022 |
The challenge: connecting building management systems without relying on 4G
Clearworld specialises in building management and energy monitoring technology, using platforms including VisionIQ and ThingsBoard to help organisations monitor and manage their buildings. Its systems sit in geographically dispersed locations, including motorway service stations, restaurants and petrol filling stations.
Engineers and facilities management teams need to reach these systems remotely and securely, without visiting each site. Historically, Clearworld connected each BMS to its central infrastructure over 4G mobile data. That created two problems:
- Unreliable signal. Equipment is often installed where mobile signal is poor, so connections dropped.
- High data costs. A BMS collects and transmits operational data continuously. Mobile data charges were substantial, reaching as much as £80 per site per month.
With the number of installations growing, Clearworld needed a more reliable, secure and cost-effective way to connect its sites.
The idea: use the internet connection that is already on site
In 2022, Andisa IT and Clearworld were neighbours at 1 Cardale Park in Harrogate. Over coffee, Andisa heard about the connectivity problem and saw a better approach.
Rather than paying for a dedicated 4G connection at every site, each BMS installation could use the customer’s existing internet connection to create a secure link back to Clearworld’s central systems. The challenge was making that secure, reliable and simple enough to deploy consistently across hundreds of different customer networks.
How the plug-and-play MikroTik BMS router works
Andisa designed one standardised solution: a pre-configured MikroTik router at every site. Each router does three jobs.
- Secure outbound VPN. The router automatically creates an outbound VPN connection to Clearworld’s central infrastructure, so authorised engineers can access the BMS remotely. Depending on our client the VPN protocol used is L2TP and Wireguard.
- Firewall isolation. The router acts as a firewall between the BMS equipment and the customer’s wider network. The BMS uses the customer’s internet connection without being exposed to the rest of that network.
- A standard local network. Every installation gets the same local network environment, whatever the customer’s own network looks like. That makes installation, troubleshooting and maintenance consistent.
Simple installation without a network specialist on site
The design only scales if any installation engineer can commission a site. So Andisa built the process around them:
- Andisa pre-configures each MikroTik router before dispatch, so it arrives ready to install.
- The engineer connects the router to the customer’s network and to the BMS equipment.
- The router connects itself, creating its secure VPN connection automatically.
- The engineer checks the connection with a laptop, confirming internet connectivity and VPN access.
- Common problems are fixed on the spot using Andisa’s troubleshooting guide: incorrect network ports, disabled connections, or a customer firewall blocking VPN traffic.
Clearworld’s engineers do not need MikroTik expertise, and a specialist rarely has to attend. The result is a repeatable deployment process that works across hundreds of locations.
Resilient central VPN infrastructure, hosted by Andisa
The site routers are only half of the solution. Andisa hosts and manages the central infrastructure in its own data centre in CCS Leeds:
- Three central MikroTik routers provide the VPN infrastructure. Two give resilient, multi-tenant connectivity. The third is dedicated to the growing Costa Coffee deployment.
- Automatic failover with VRRP. MikroTik’s built-in VRRP redundancy switches traffic between the two resilient routers automatically if one fails.
- ThingsBoard hosting. Clearworld’s ThingsBoard servers run as virtual machines on Andisa’s data centre infrastructure.
Connectivity, hosting and management systems sit together in one professionally maintained environment.
Secure, restricted access for multiple organisations
Clearworld’s systems are used by its own engineers, its customers’ engineering teams and third-party facilities management providers. Andisa’s design gives each of them secure remote access, restricted to the specific sites they are authorised to reach. Multiple organisations can work on the platform without exposing unrelated customer installations.
Proactive monitoring with automatic fault tickets
Andisa monitors the network infrastructure with PRTG, covering the MikroTik routers, leased-line connectivity and hosted virtual machines. PRTG is integrated with ACL, Andisa’s Professional Services Automation (PSA) system. When a fault is detected, a support ticket is raised automatically for an Andisa engineer to investigate.
That gives proactive oversight of a geographically dispersed network, rather than waiting for customers to report problems.
A nationwide rollout across major UK operators
The solution first moved around 100 existing BMS installations away from 4G. Its success led to further nationwide deployments, at sites including:
- Moto: motorway service stations across the UK.
- Wagamama: a planned rollout to around 400 restaurants nationwide.
- Rontec / Esso: petrol filling stations and forecourts.
Together, the existing installations and the planned Wagamama rollout make up a programme of around 500 sites. The Costa deployment shows the architecture can take different hardware and customer requirements while keeping secure, centralised connectivity.
The results
c.500
sites in the BMS connectivity programme
c.100
sites already moved off 4G
Up to £150k
a year in estimated mobile data savings and cost avoidance
0
operational faults reported with the solution itself
Reliability
Andisa reports no operational faults with the solution itself since its introduction. The only significant connectivity issue came when an end customer introduced a network configuration that blocked almost all outbound traffic except HTTPS, which stopped the VPN connecting. That was an external firewall restriction, not a failure of the MikroTik infrastructure.
Mobile data savings and cost avoidance
Using existing customer internet connections removes the need for dedicated mobile data subscriptions at applicable sites. Based on an estimated average mobile data cost of £25 per site per month:
ESTIMATED ANNUAL FINANCIAL BENEFIT
| DEPLOYMENT | ANNUAL FINANCIAL BENEFIT |
| 100 existing sites migrated from 4G | £30,000 estimated saving |
| 400 planned Wagamama installations | £120,000 potential cost avoidance |
| Combined annual potential | £150,000 |
These figures are estimated mobile data savings and avoided costs, not audited net savings. They assume equivalent mobile connectivity would otherwise be needed at every site, and exclude installation, hardware and support costs.
Operational benefits
- More reliable than 4G in poor-signal locations.
- Faster, simpler installations with pre-configured routers.
- Consistent network configuration across very different customer environments.
- Secure, restricted access for authorised engineers and facilities management teams.
- Fewer specialist site visits, because installation engineers can resolve common issues themselves.
- Proactive fault detection through PRTG and automatic ticketing.
- A scalable platform ready for further nationwide expansion.
From specialist networking to a complete IT partnership
The MikroTik project built a strong working relationship. When Clearworld later went through a management buyout, it wanted a local IT support provider. Andisa already understood its systems, was a trusted technical partner and was based on the same business park.
Today, Andisa provides Clearworld’s managed IT services, including PC support, Wi-Fi, networking, cyber security, Microsoft 365 and wider IT infrastructure management. What began as a conversation over coffee now covers both Clearworld’s internal IT and the specialist infrastructure supporting its customers nationwide.
What Clearworld says
“We originally worked with Andisa to solve a difficult connectivity problem with our building management systems. Their MikroTik solution has transformed how we connect and manage our installations, giving us a reliable, secure and straightforward platform that can scale as our business grows. The cost savings are significant, but equally important is the reliability and simplicity of the solution for our installation engineers. When we needed a local partner to take responsibility for our wider IT infrastructure, Andisa was the obvious choice. They understand our business, respond when we need them and have become an important part of our operations.”
Paul Yates, Clearworld Ltd
Lessons for connecting BMS and IoT equipment across many sites
- Use the connection that is already there. A secure router on the customer’s existing internet connection can replace a dedicated 4G subscription.
- Connect outbound, to a hub you control. Engineers connect to central infrastructure, not directly to each site.
- Firewall the BMS from the host network. Protect both the BMS and the customer.
- Standardise every site. One local network design makes installation and support repeatable.
- Pre-configure, then plug in. Installers should not need networking expertise to commission a site.
- Give installers a troubleshooting checklist for ports, disabled connections and firewall blocks.
- Make the hub resilient with automatic failover, such as VRRP.
- Restrict access per organisation and per site.
- Monitor centrally and raise tickets automatically.
BMS remote access and connectivity FAQs
Install a small router at each site that creates an outbound VPN connection to a central, managed hub. Authorised engineers connect to the hub, not to the site, and only see the systems they are allowed to access. For Clearworld, a pre-configured MikroTik router at each site does this, while firewalling the BMS from the customer’s own network.
It can work, but it has two common problems: poor signal where equipment is installed, and ongoing data charges because a BMS transmits data constantly. Clearworld’s 4G costs reached as much as £80 per site per month at some sites. Using the site’s existing internet connection through a secure router removed the need for a dedicated 4G subscription at applicable sites.
It depends on what you pay per site. Using an estimated average of £25 per site per month, Clearworld’s 100 migrated sites represent around £30,000 a year in estimated savings, and the 400 planned Wagamama sites around £120,000 in potential cost avoidance. These are estimates, not audited net savings, and exclude hardware, installation and support costs.
Put a firewall between them. On Clearworld’s sites, the MikroTik router separates the BMS equipment from the customer’s wider network, so the BMS can use the customer’s internet connection without being exposed to, or exposing, the rest of that network. Every site also gets the same standardised local network.
The site cannot reach the central systems until the block is resolved. In Clearworld’s rollout, the only significant connectivity issue came when an end customer changed its network to block almost all outbound traffic except HTTPS. It was a customer firewall restriction, not a fault in the MikroTik infrastructure. To resolve this, they blocked ICMP and the Mikrotiks by default check the gateway exists by pinging its address. We removed the Ping Gateway.
Yes. Andisa pre-configures every MikroTik router before dispatch. Clearworld’s engineers connect it to the customer’s network and the BMS equipment, and the router builds its secure connection automatically. A simple troubleshooting guide and a laptop let them check internet and VPN access on site without a network specialist attending.
Control access centrally. Clearworld’s platform is used by its own engineers, its customers’ engineering teams and third-party facilities management providers. Andisa’s design restricts each user to the specific sites they are authorised to access, so organisations can share the platform without seeing unrelated customer installations.
VRRP (Virtual Router Redundancy Protocol) lets two routers share one virtual address, so if the active router fails, the standby takes over automatically. Andisa uses MikroTik’s built-in VRRP on Clearworld’s two resilient central routers, so remote sites keep their connection to the central systems if one router goes down.
Yes, if the central architecture is designed for it. Clearworld’s growing Costa Coffee deployment uses a different type of site router, but connects into the same MikroTik-based central VPN architecture, through a dedicated third central router.
Monitor centrally and automate the response. Andisa uses PRTG to monitor the MikroTik routers, leased-line connectivity and hosted virtual machines. PRTG is integrated with Andisa’s PSA system, so a detected fault automatically creates a support ticket for an engineer to investigate, rather than waiting for a customer to report it.
Yes. ThingsBoard can run on virtual machines in a private cloud. Andisa hosts Clearworld’s ThingsBoard servers as virtual machines in its own data centre, alongside the central VPN routers, so connectivity, hosting and monitoring sit in one professionally managed environment.
Look for a provider with networking expertise, hosting and monitoring under one roof, and proof at scale. Andisa IT, a managed IT provider in Harrogate, designs and runs the MikroTik-based remote access platform behind Clearworld’s BMS installations, a programme of around 500 UK sites.
Need secure remote access for BMS or IoT equipment across many sites?
Andisa IT designs, hosts and monitors secure connectivity for building management, energy monitoring and IoT equipment across dispersed sites, and provides managed IT support for the businesses behind them. We are based in Harrogate and support installations across the UK.
More Ways We’ve Made a Difference
3CX Cloud Migration Without Downtime: Moving Cryonorm from On-Premise to Hosted 3CX
Read More3CX Cloud Migration Without Downtime: Moving Cryonorm from On-Premise to Hosted 3CX
Flexible communication enables us to stay open
Read MoreFlexible communication enables us to stay open
Automatic Leased Line Failover for a 600-Mile MikroTik Wireless ISP Network
Read MoreAutomatic Leased Line Failover for a 600-Mile MikroTik Wireless ISP Network
Andisa IT - Leading Managed Service Provider in Yorkshire, serving Harrogate, Leeds, York, and surrounding areas.
