In this document Using PROFINET Network Scan With Firewalls is mentioned that you should open the firewall to certain Ethernet frame types to let devicescanning work properly.

In relation there is also the question if PROFINET can be used over a VPN connection.

Issue is that VPN connections are targetted to transfer IP-traffic. There are no settings in the VPN routers to also forward PROFINET Ethernet frame types. The VPN tunnel can be established but there are no rules to configure which Ethernet frametypes should be shipped via the VPN tunnel.

The tunnel should support opening the communication in both direction for Ethernet frametype 0x8892 for PROFINET and 0x8100 for the 802.11Q Virtual LAN type, otherwise it will not work.
 

Other issue is of course if the application can withstand the loss of the connection. Countermeasures should be taken add both sides to withstand the communication loss.