Firewall

What is a firewall?

A firewall is a security mechanism that inspects network traffic between two or more networks and allows or blocks it based on predefined rules. Its purpose is to stop unwanted or malicious communication and let through only the traffic the business actually needs. In both IT and OT environments, including industrial control systems, the firewall is the main tool for dividing a network into zones and controlling the connections between them. A firewall is one layer within Defense in Depth, not complete protection on its own.

🧠 How does a firewall work?

A firewall examines each packet or connection and compares it against an ordered list of rules (the rulebase or policy). The first matching rule decides the action: allow, reject or drop, optionally with logging. Attributes it filters on include:

• Source and destination IP address - which systems may talk to each other
• Port number - for example HTTP on port 80, Modbus TCP on port 502 or S7comm on port 102
• Protocol - TCP, UDP or ICMP
• Connection state - does a packet belong to an existing session that the firewall has already permitted?
• Application content - which command or function is being called (only with DPI)

The last rule in the rulebase always rejects all remaining traffic. This principle is called default deny, or “deny by default, allow by exception”: anything not explicitly permitted is forbidden.

🔧 What types of firewalls are there?

Firewalls have evolved in generations since the late 1980s. Engineers at Digital Equipment Corporation published the first work on packet filters in 1987, AT&T Bell Labs worked on connection-oriented filtering in 1989–1990, and in 1994 Check Point released FireWall-1, the first commercial stateful firewall. Gartner defined the next-generation firewall in 2009.

Firewalls come as physical appliances, virtual machines and software on a host (host-based firewall). The type describes the depth of inspection; the form factor describes where the firewall runs.

🏭 How does an industrial firewall protect OT protocols?

Classic industrial protocols such as Modbus, S7comm and DNP3 have little or no built-in authentication. Anyone who can reach the network can write registers or stop a PLC. A port rule (“TCP 502 allowed”) therefore lets through both read traffic and dangerous write commands. An industrial firewall with DPI looks deeper:

• Function code filtering - for example allowing only Modbus TCP read functions from the historian, and writes only from the engineering workstation
• Register range restriction - only an agreed address range can be written
• Protocol conformance - malformed packets are rejected
• OPC UA - restricting to known endpoints and security modes (Sign or SignAndEncrypt) on port 4840

ProfiNET RT and IRT run directly on Ethernet without IP. An ordinary IP firewall cannot filter that traffic, so a PROFINET cell should stay within a single zone, with at most layer-2 filtering.

🧱 Where do you place firewalls in an IT/OT architecture?

In the Purdue Model and according to NIST SP 800-82, an IDMZ, often called level 3.5, sits between the enterprise network (levels 4–5) and the production network (level 3 and below). No traffic should pass directly from IT to OT: every connection terminates in the IDMZ, for example on a replicated historian, a patch server or a jump server for remote access.

• IT/IDMZ boundary - often an NGFW, managed by the IT team
• IDMZ/OT boundary - preferably a second firewall from a different vendor or of a different type, so that a single vulnerability does not open both layers
• Between OT zones - industrial firewalls between, for example, the supervisory network with the SCADA and HMI servers, the control network and a safety zone
• Cell level - small transparent firewalls directly in front of a machine or PLC, especially for legacy systems that cannot be patched

IEC 62443-3-3 covers the firewall in requirement SR 5.2, zone boundary protection: the boundary of each zone is monitored and controlled. From security level 2, “deny by default, allow by exception” applies; from security level 3 the boundary must block all traffic on a hardware or power failure (fail close), and it must be possible to cut off all communication across the boundary so the zone keeps running in isolation (island mode). Every permitted flow between zones forms a conduit in the zones and conduits model.

🔄 What is the difference between a firewall, IDS/IPS and a data diode?

A firewall decides based on rules that you manage yourself, so it can be misconfigured. A data diode makes return traffic physically impossible, but does not support bidirectional protocols without a proxy. In OT, an IPS is often run in detection-only mode, because a false-positive block can bring a production process to a halt. An IDS or security monitoring platform complements the firewall: the firewall blocks, monitoring sees what still gets through.

🔐 What are common firewall mistakes in OT?

• Any-any rules - temporary rules for a vendor or a breakdown that never get removed
• Flat networks - one firewall between IT and OT, but a single large segment behind it; in 2023 the NSA and CISA listed lack of network segmentation among the ten most common misconfigurations
• Wide port ranges - whole ranges opened because the application uses dynamic ports (a classic with OPC Classic over DCOM)
• Bypass connections - vendor 4G routers or VPN boxes that circumvent the firewall
• No logging or review - rules without an owner, date or justification
• Unpatched firewall itself - the CISA advisory on Volt Typhoon (February 2024) described attackers gaining access through vulnerabilities in firewalls and VPN appliances

📋 How do you approach firewall management in practice?

1. Take inventory - start with an asset inventory and record which systems communicate with each other
2. Define zones and conduits - based on a risk assessment according to IEC 62443-3-2
3. Document communication flows - for each flow: source, destination, protocol, port, owner and justification
4. Start in monitoring mode - let the firewall log first, test the rules against actual traffic, and switch to blocking only during a maintenance shutdown
5. Write specific rules - fixed IP addresses and ports, no “any” in source, destination or service
6. Control changes - every rule change goes through change management, with testing and a fallback plan
7. Monitor and review - send logs to a SIEM and review the rulebase periodically, for example every six months; see Firewall Rule Management
8. Harden and patch - management interface reachable only from a management zone, MFA, and timely firmware updates

For Dutch organisations covered by the Cyberbeveiligingswet (Cbw), the Dutch implementation of NIS2 in force since 15 August 2026, segmentation and demonstrable firewall management are part of the duty of care to manage risks to network and information systems.

❓ Frequently asked questions

Is a firewall enough to secure an OT network?

No, a firewall is one layer within defence in depth. A firewall blocks unwanted traffic between zones, but it does not see what happens inside a zone and does not help against an infected USB stick or a compromised account with permitted access. Combine the firewall with segmentation, monitoring, hardening, patch management and access control.

What is the difference between an IT firewall and an industrial firewall?

An IT firewall is designed for office and internet traffic and usually runs in a data centre or server room. An industrial firewall understands industrial protocols such as Modbus, S7comm and OPC UA down to the command level, suits DIN-rail mounting, wide temperature ranges and 24 V power, and can often be inserted transparently into an existing network.

Which port does Modbus TCP use, and should it be open in the firewall?

Modbus TCP uses TCP port 502 by default. That port should only be open between the specific systems that need Modbus, never from the office network or the internet to a PLC. An industrial firewall with deep packet inspection can also block write commands and allow only read traffic.

What does default deny mean for a firewall?

Default deny means that a firewall rejects all traffic that is not explicitly permitted. IEC 62443-3-3 requires this principle (“deny by default, allow by exception”) for zone boundaries from security level 2, and NIST SP 800-82 recommends it for the boundary between the corporate network and OT. Every permitted flow then becomes a deliberate, documented decision.

Should I use two firewalls from different vendors around the IDMZ?

This is a common recommendation but not a hard requirement. Two firewalls from a different vendor or of a different type around the IDMZ ensure that a single vulnerability or configuration error does not immediately open both layers. The trade-off is extra management effort; a well-managed firewall with three interfaces (IT, IDMZ, OT) is a common alternative.

How often should firewall rules be reviewed?

The required frequency differs per framework, but a periodic review, for example every six months, is common practice. Also review the rulebase after every major change to the plant or the network. Rules without an owner, justification or recent traffic are candidates for removal.

📌 In summary

A firewall uses rules to decide which traffic is allowed between networks and, in OT, is the main tool for enforcing zones and conduits.

From simple packet filters to next-generation and industrial firewalls with deep packet inspection, the value lies not in the device but in a tight, documented rulebase based on default deny. Place firewalls around an IDMZ and between OT zones, avoid any-any rules and bypass connections, and manage rules, logging and firmware in a structured way. That makes the firewall a strong layer within Defense in Depth and within the zones and conduits model of IEC 62443.