Industrial Firewall

What is an Industrial Firewall?

An industrial firewall is a firewall specifically designed for operational technology (OT) and industrial networks: it filters traffic between zones based on rules, understands industrial protocols such as Modbus, S7, OPC UA and DNP3, and is built for the conditions and availability requirements of a factory, power plant or water treatment works. Unlike an ordinary IT firewall in a server room, an industrial firewall is often mounted on a DIN rail inside a control cabinet, typically operates at temperatures from -40 to +70 °C and can be inserted invisibly between existing devices. It protects critical systems such as PLCs, SCADA, drives, HMIs and historians against cyberattacks, unauthorised access and human error across the OT network.

🧠 How does an industrial firewall work?

An industrial firewall combines the same basic techniques as any firewall with knowledge of OT protocols. In increasing depth:

1. Packet filtering at layers 3 and 4 — rules based on IP address, network, port and protocol (TCP/UDP). Well-known OT ports are 502 for Modbus TCP, 102 for S7comm, 20000 for DNP3, 44818 and 2222 for IP, 4840 for OPC UA and 2404 for IEC 60870-5-104.
2. Stateful inspection — the firewall tracks connections, so only replies to permitted requests are let back in.
3. DPI (Deep Packet Inspection) at layer 7 — the firewall reads the content of the industrial protocol. For Modbus, it can allow read requests (function codes 1 to 4) while blocking write requests (5, 6, 15 and 16); for S7, it can permit downloads of new logic to a PLC only from the engineering station.
4. Zone protection — segmentation in line with the zones and conduits model or the Purdue Model, separating the control network, engineering network and DMZ.
5. Logging and auditing — events are sent via syslog to a SIEM or security monitoring platform, so that anomalies stand out.

The key difference from a classic packet filter is therefore step 3: an ordinary firewall only sees “port 502 open”, whereas an industrial firewall sees which Modbus command is passing through.

🔄 How does it differ from an IT firewall?

An industrial firewall does not make the network more deterministic; it actually adds a small amount of latency. The aim is to keep that latency low and predictable so that real-time communication between controllers is not disrupted. Modern next-generation firewalls from the IT world now also recognise industrial protocols; the difference then lies mainly in form factor, ruggedness, failure behaviour and the depth of OT inspection.

🔧 Which deployment modes and failure behaviours exist?

• Router mode — the firewall connects two IP subnets and can apply NAT. Suitable for new builds or at the boundary between IT and OT.
• Transparent mode (bridge/stealth) — the firewall operates at layer 2 and is invisible to the connected devices. Phoenix Contact calls this stealth mode on the mGuard; Hirschmann offers router, stealth and transparent modes on the EAGLE40. Ideal for retrofitting protection in front of an existing PLC without changing IP addresses.
• Monitor mode — log first, block later. This lets you discover which traffic is genuinely needed before a rule can stop production.

When the firewall itself fails, there are two philosophies:

Some vendors therefore offer a hardware bypass, such as the bypass relay on the copper ports of the Cisco ISA3000 or the fail-to-wire port pair on the FortiGate Rugged 70G. The right choice follows from the risk assessment: a firewall in front of a SIS or a safety-critical function should not silently fail open, whereas a monitoring link may. On critical networks, always combine this with redundancy and high availability, for example two firewalls in an active/passive pair.

🏭 Where do you place industrial firewalls in an OT network?

Under IEC 62443, you divide the installation into zones with a comparable security level, connected via conduits. The industrial firewall is the enforcement point on that conduit. Typical positions:

• IT/OT boundary — between the office network and production, preferably via an IDMZ hosting historian replicas, patch servers and jump hosts. Where data only needs to flow outwards, a data diode is a stronger alternative: it physically allows only one direction and is therefore not a firewall.
• Between production cells or lines — so that an infection on line 1 does not spread to line 2.
• In front of vulnerable or legacy devices — a cell or zone firewall directly in front of a PLC that can no longer be patched.
• For external access — terminating VPN connections and vendor remote access, ideally with time-limited access.

Industrial firewalls are found in the process industry, food and pharmaceuticals, energy, water and infrastructure such as tunnels, bridges and locks.

A sensible order is: first the IT/OT boundary, then the highest-risk zones, then the rest. See also network segmentation for the broader approach.

📋 How do you design good firewall rules?

An industrial firewall is only as strong as its rules; see Firewall Rule Management for designing and periodically reviewing rule sets per conduit. A practical step-by-step plan:

1. Inventory — use asset inventory and passive network analysis to map which systems talk to each other.
2. Document the conduits — record source, destination, protocol, direction and purpose for each conduit.
3. Deny by default — allow only explicitly required traffic (least privilege); this is SR 5.2 RE 1 in IEC 62443-3-3.
4. Refine with DPI — restrict write commands, firmware downloads and programming functions to the engineering station.
5. Test in monitor mode — run through one or more production cycles, including start-up, shutdown and batch changeovers.
6. Control changes — handle every rule change through change management, with documentation and a periodic review.

Tie administration to access control with RADIUS for authentication, and send logs to a SIEM with anomaly detection for audit and compliance. A misconfigured firewall is dangerous because it creates a false sense of security: a single “any-any” rule renders the entire zoning worthless.

🔐 Which vendors and certifications are there?

For the security of the product itself, IEC 62443-4-2 (2019) is the benchmark. The standard defines requirements for four component types; firewalls, routers and switches fall under the network device requirements (NDR) and are certified to a capability security level (SL-C 1 to 4). In September 2023, Moxa became, by its own account, the first to obtain an IEC 62443-4-2 SL2 certificate for industrial secure routers, issued by Bureau Veritas. At Phoenix Contact, the mGuard 2000 and 4000 families are certified, and the development process follows IEC 62443-4-1. When purchasing, always ask for the certificate, the SL-C and whether it covers the firmware version you run.

In Europe, the Cyber Resilience Act adds a further layer: firewalls and intrusion detection systems are listed as important products class II in Annex III and require a third-party conformity assessment. The full obligations apply from 11 December 2027. For essential and important entities in the Netherlands, the Cybersecurity Act (Cyberbeveiligingswet), the Dutch implementation of NIS2, has applied since 15 August 2026. It requires appropriate measures to manage risks to network and information systems; in OT environments, network segmentation and logging are almost always part of that.

❓ Frequently asked questions

Do I need an industrial firewall if I already have an IT firewall?

Yes, in most cases you do. An IT firewall protects the boundary with the internet but leaves traffic inside the OT network untouched. An industrial firewall separates zones within production and can inspect industrial commands such as writes to a PLC.

What is the difference between an industrial firewall and a data diode?

An industrial firewall allows traffic in both directions according to rules and can therefore be misconfigured. A data diode physically allows only one direction, usually from OT to IT. Data diodes suit the strictest separations, while industrial firewalls suit communication that genuinely needs to flow both ways.

Does an industrial firewall slow down my control system?

An industrial firewall always adds a small delay, but with properly sized equipment that delay is low and predictable. For time-critical fieldbus traffic such as PROFINET IRT or motion control, you therefore place the firewall at the boundary of a cell, not in the middle of the cyclic communication between controller and I/O.

What does IEC 62443-4-2 certification mean for an industrial firewall?

IEC 62443-4-2 certification means that an independent body has confirmed that the firewall meets the technical security requirements for network components at a given level, such as SL2. The certificate says something about the product, not about the correctness of your rules or your network design.

What is the transparent or stealth mode of an industrial firewall?

In transparent or stealth mode, an industrial firewall acts as an invisible layer 2 bridge without its own IP addresses in the data path. This allows you to place it between an existing PLC and the network without changing the IP addresses or configuration of any device.

Should an industrial firewall fail open or closed?

That follows from your risk assessment. Fail-close protects the zone but can stop production, while a bypass keeps production running but lets unfiltered traffic through. IEC 62443-3-3 requires fail-close from Security Level 3; a redundant firewall pair keeps this dilemma from arising often.

📌 In summary

An industrial firewall is the enforcement point on the conduits between OT zones: ruggedly built, deployable transparently and with deep knowledge of industrial protocols. Real protection comes from well-designed rules based on deny by default, a deliberate choice of failure behaviour and equipment certified to IEC 62443-4-2.