Method for establishing secured communications connections to an industrial automation system, in which - communications connections are set up from first communications devices (101 - 103) outside of the industrial automation system to second communications devices (201 - 202) assigned to the industrial automation system via a connection management device, - the communications connections established via the connection management device between first communications devices (101 - 103) and second communications devices (201 - 202) are Virtual Private Network connections, - the connection management device is formed by a server instance running on a firewall system, - data packets (113, 212) transmitted via an encrypted communications connection between the first communications device of the requesting user and the selected second communications device are decrypted for a verification by the firewall system based on defined security rules, - in the event of a request to set up a connection to a selected second communications device by a requesting user of a first communications device, the connection management device performs an authorization verification for the requesting user based on an access control list, - the authorization verification comprises an authentication of the requesting user against the connection management device, - in the event of a positive authorization verification outcome, the connection management device provides access control information (112, 211) for establishing an encrypted communications connection between the first communications device of the requesting user and the selected second communications device for these communications devices, - the connection management device provides access control information to the requesting user regarding the use of a Virtual Private Network connection between the first communications device of the requesting user and the selected second communications device only after an authentication of the requesting user, wherein the access control information items comprise passwords for VPN sessions or temporarily valid passwords, - the firewall system forwards data packets successfully verified on the basis of the defined security rules in encrypted form to the first communications device of the requesting user and/or to the selected second communications device, - the verification by the firewall system based on the defined security rules comprises a verification of the correctness of passwords for VPN sessions or temporarily valid passwords, - the firewall system rejects data packets, for the transmission of which incorrect passwords have been specified. - communications connections are set up from first communications devices (101 - 103) outside of the industrial automation system to second communications devices (201 - 202) assigned to the industrial automation system via a connection management device, - the communications connections established via the connection management device between first communications devices (101 - 103) and second communications devices (201 - 202) are Virtual Private Network connections, - the connection management device is formed by a server instance running on a firewall system, - data packets (113, 212) transmitted via an encrypted communications connection between the first communications device of the requesting user and the selected second communications device are decrypted for a verification by the firewall system based on defined security rules, - in the event of a request to set up a connection to a selected second communications device by a requesting user of a first communications device, the connection management device performs an authorization verification for the requesting user based on an access control list, - the authorization verification comprises an authentication of the requesting user against the connection management device, - in the event of a positive authorization verification outcome, the connection management device provides access control information (112, 211) for establishing an encrypted communications connection between the first communications device of the requesting user and the selected second communications device for these communications devices, - the connection management device provides access control information to the requesting user regarding the use of a Virtual Private Network connection between the first communications device of the requesting user and the selected second communications device only after an authentication of the requesting user, wherein the access control information items comprise passwords for VPN sessions or temporarily valid passwords, - the firewall system forwards data packets successfully verified on the basis of the defined security rules in encrypted form to the first communications device of the requesting user and/or to the selected second communications device, - the verification by the firewall system based on the defined security rules comprises a verification of the correctness of passwords for VPN sessions or temporarily valid passwords, - the firewall system rejects data packets, for the transmission of which incorrect passwords have been specified.