Router

What is a router?

A router is a network device that forwards data packets between different networks based on the destination IP address, using a routing table that specifies the best next step for each destination. Where a switch connects devices within one network, a router connects networks to each other: a production cell to the office network, a pumping station to the central control room, or a plant to the internet. In OT environments the router therefore sits exactly on the boundary between zones, making it one of the most important places to restrict, translate and monitor traffic.

Routers provide traffic steering, separation of subnets and security in both IT and OT networks.

🧠 How does a router work?

A router operates at layer 3 of the OSI model, the network layer. For every incoming IP packet it goes through the same steps:

1. Read the destination address - the router looks at the destination IP address in the header, not at the MAC address as a switch does.
2. Consult the routing table - it selects the route with the longest matching prefix (longest prefix match). A route to 10.20.30.0/24 therefore wins over a route to 10.20.0.0/16.
3. Determine the next hop - the chosen route gives the outgoing interface and the next router (next hop). If there is no specific route, the packet goes to the default route (0.0.0.0/0).
4. Forward - the router decrements the TTL value by one, builds a new layer 2 frame and sends the packet on. When the TTL reaches zero the packet is dropped, so routing loops cannot continue forever.

Every subnet has a default gateway: the address of the router interface through which devices leave their own subnet. A PLC with a wrong or missing gateway can talk to its neighbours perfectly well, yet cannot reach the SCADA server in another subnet. This is one of the most common faults during commissioning.

Besides routing, modern routers often offer additional functions:

• NAT (Network Address Translation) - translates internal addresses into other addresses, for example to connect identical machine networks
• VPN - encrypted tunnels for site-to-site links or remote access
• Firewall functions - from simple ACLs to full stateful inspection
• Routing protocols - such as OSPF and BGP, for exchanging routes automatically

🔀 What types of routing exist?

A router fills its table in three ways: from directly connected networks, from manually configured static routes and from dynamic routing protocols. When several sources offer a route to the same destination, the router chooses based on the administrative distance: the lower the value, the more trusted the source. The values in the table are Cisco’s defaults; other vendors use comparable priorities.

Industrial networks mainly use static routes or simple dynamic protocols. Static routes are predictable, easy to audit and cannot be altered by an attacker through a forged routing update. OSPF (version 2, RFC 2328) appears on larger sites with multiple paths, so that the network automatically picks an alternative route after a cable break. If you use a dynamic protocol, enable authentication of routing messages and only accept neighbours on known interfaces.

For the availability of the default gateway itself there is the Virtual Router Redundancy Protocol (VRRP): two routers share one virtual gateway address, and if the active one fails the backup takes over within seconds. VRRP version 3 has been defined since April 2024 in RFC 9568, the successor to RFC 5798. It fits well into a redundant design alongside ring protocols on the switches.

🏭 Where are routers used in industrial networks?

• Separating OT from IT - a router or firewall connects the OT network to the IT network or office environment, usually through a DMZ
• Routing between VLANs - between different VLANs on a layer 3 switch or an external router (router-on-a-stick)
• Machine integration with NAT - ten identical machines with the same internal address range each get a unique external subnet through 1:1 NAT
• Remote sites - pumping stations, wind turbines, substations and charging points connected to the control centre through cellular routers (4G or 5G)
• Remote servicing - suppliers logging in through a VPN tunnel to a router in the machine cabinet for remote maintenance
• Access control - integration with a Firewall and ACLs so that only the required connections are allowed
• Segmentation - as part of network segmentation according to the Purdue Model and the zones and conduits model

An industrial router differs from an office router mainly in its housing: DIN rail mounting, an (often redundant) 24 V DC supply, no fan and, in wide-temperature versions, operation from about −40 to +75 °C. Many models combine router, firewall and VPN in a single box, such as the secure routers from Moxa, Phoenix Contact (mGuard), Hirschmann and Siemens (SCALANCE).

🔍 What is the difference between a router, a switch and a firewall?

The key difference is in the last row. A standard ACL on a router checks each packet in isolation, without knowing whether it belongs to an existing connection. A firewall tracks connection state and, in the case of an industrial firewall, can even inspect Modbus or S7 commands. For a zone boundary in the sense of IEC 62443, a router with ACLs alone is therefore usually too coarse; use it together with, or as part of, a firewall.

🔐 How do you secure a router in an OT environment?

Routers and other edge devices are a popular target. The state-sponsored group Volt Typhoon hid its attacks behind a botnet of compromised, outdated small-office and home routers from vendors including Cisco and Netgear; the FBI dismantled that network around the turn of 2023–2024. At the end of 2023, Forescout researchers found 21 vulnerabilities in cellular OT/IoT routers from Sierra Wireless, of which more than 86,000 were reachable from the internet. In their 2024 report they name network equipment such as routers and access points as the riskiest IT device category.

Practical measures:

• Strong authentication - change default passwords, manage only via SSH or HTTPS, and disable Telnet and HTTP
• Restrict management - only allow management from a management subnet or jump server using ACLs, and grant user rights per role with RBAC
• No management from the internet - the management interface should never be directly reachable from the WAN or the cellular network
• Hardening - disable unused services, ports and protocols, such as UPnP and unused routing protocols
• Keep firmware up to date - follow the vendor’s advisories and replace routers that no longer receive updates
• Encryption and separation - encrypt traffic between sites via VPN and keep networks apart with VLANs and subnets
• Monitoring - send logs to a SIEM via Syslog, monitor status with SNMPv3 and synchronise the clock with NTP so that logs can be correlated
• Configuration management - keep a backup of every configuration and record changes through change management

A poorly secured router is a critical entry point in an OT Network.

📜 Which standards and laws apply?

When buying an industrial router, it is wise to ask for an IEC 62443-4-2 certificate, the support period for firmware updates and CRA conformity.

🛠️ How do you set up routing in an OT network?

A practical approach for an existing plant:

1. Take inventory - map all routers, cellular modems and VPN boxes, including those installed by machine builders. There often turn out to be more access paths than anyone knew.
2. Design zones - give each zone or production cell its own subnet and document which connections are needed.
3. Choose the boundary equipment - use a firewall for the boundary between IT and OT, optionally with a DMZ. Within OT, a layer 3 switch with ACLs can be sufficient between cells with a similar risk level.
4. Keep routing simple - choose static routes where possible and document them. Avoid a default route from OT to the internet.
5. Resolve address conflicts - use 1:1 NAT for machines with identical address ranges, so the machine builder does not need to change anything.
6. Secure and monitor - apply the measures from the previous section and include routers in network monitoring.

❓ Frequently asked questions

Does an OT network need a router?

An OT network needs a router as soon as there is more than one subnet, for example for separate production cells or a link to the IT network. Without a router or layer 3 device, devices can only communicate within their own subnet. A completely flat network without a router is simple, but offers no place at all to filter traffic.

Is a router the same as a firewall?

A router and a firewall are not the same, although many devices combine both functions. A router forwards packets based on the IP address, whereas a firewall assesses traffic against rules and connection state. For the boundary between IT and OT, an (industrial) firewall is the appropriate choice.

What is the difference between a router and a layer 3 switch?

A layer 3 switch routes between VLANs and subnets within a site, at high speed in hardware. A router usually has more functions for WAN links, such as NAT, VPN, cellular connections and extensive routing protocols. In OT networks a layer 3 switch is often used inside the site and a router or firewall at the edge.

Why do industrial networks often use static routes?

Industrial networks often use static routes because they are predictable, easy to audit and hard to manipulate. The network rarely changes, so the benefit of dynamic routing is limited. Only larger sites with redundant paths typically deploy a protocol such as OSPF.

Is an industrial router covered by the Cyber Resilience Act?

An industrial router is covered by the Cyber Resilience Act as an important product class I, because routers, internet modems and switches are listed in Annex III. The manufacturer may only self-assess conformity if it fully applies harmonised standards or a European certification scheme. Full application of the CRA starts on 11 December 2027.

How do you recognise an insecure router in your installation?

You recognise an insecure router by default passwords, a management interface reachable from the internet, Telnet or HTTP management, and firmware that has not been updated for years. Routers for which the vendor no longer provides updates are a well-known target, as the Volt Typhoon botnet showed. A periodic inventory and a scan of your own internet exposure bring such routers to light.

📌 In summary

A router connects networks based on IP addresses and routing tables, and in an OT environment it sits exactly on the boundaries between zones. Static routes, NAT for machine networks and VPN for sites and suppliers are its most widely used functions. Because routers are an attractive target, they require hardening, current firmware, management via a restricted path and monitoring, and they fall under the Cyber Resilience Act.

A router connects and protects network zones by forwarding traffic in a controlled way, and is essential in a secure, segmented OT architecture; combined with VLANs, a firewall and ACLs, it provides a reliable network structure and access control.