iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Connect factory equipment through a controlled OT edge or industrial IoT gateway—not directly to the public internet. First inventory assets and required data, then separate control, operations, enterprise and cloud zones. Permit only documented flows, authenticate every gateway and service, encrypt transport, keep control loops local, monitor changes and anomalies, and test outage and recovery procedures before production.
The secure connection pattern
A secure industrial IoT (IIoT) connection is a bounded data path between operational technology (OT) and the platform that stores, analyzes or visualizes factory information. The usual pattern is:
- Equipment layer: PLCs, robots, CNC machines, sensors, HMIs and safety-related devices.
- Control and operations layer: SCADA or DCS servers, historians and engineering workstations.
- OT edge or industrial IoT gateway: A broker that reads approved data, converts protocols, buffers it and enforces security policy.
- Industrial DMZ or other controlled boundary: Firewalls and routing rules that separate OT from enterprise and cloud networks.
- IIoT platform: Cloud or on-premises services that ingest, process and present the selected data.
Keep safety functions and real-time control loops inside the plant. Send the minimum telemetry required for the business use case. Treat any command sent back toward a PLC as a separate, higher-risk design rather than an automatic extension of telemetry.
NIST describes OT security as having to address “unique performance, reliability, and safety requirements.” Those constraints distinguish a plant network from an ordinary office or web application network: a security change that is harmless in IT can interrupt a deterministic control loop or create a safety hazard in OT.
#1 Best Overall
- Multi-Protocol Support: Integrates with industrial systems and supports multiple communication protocols, including Modbus RTU/TCP, BACnet, OPC UA, OPC XML-DA, and IEC 104, enabling seamless connection with diverse industrial devices to meet different automation needs.
- Cloud Data Connectivity: Functions as an MQTT, HTTP, and Socket client, providing reliable data transmission and automatic reconnection to maintain continuous data flow for IoT applications.
- JS Script Programming Support: Offers flexibility through JavaScript scripting, allowing users to customize and extend the gateway's capabilities to meet specific application needs.
- Alarm and Event Management: Allows users to set trigger conditions, enabling event triggers and releases based on state transitions.
- Easy Configuration and Management: User-friendly graphical configuration software simplifies setup, allowing easy access to real-time and historical data through an HTTP server interface.
Why a PLC should not connect directly to the internet
A PLC or other controller is designed to control a process, not to act as a hardened internet endpoint. Direct exposure can give an attacker a path to change logic, issue commands, alter set points, disrupt availability or falsify measurements. Even when a controller has no known exploitable defect, its protocol, credentials, firmware and administrative interfaces may not provide the defenses expected of an internet-facing system.
Connecting OT to IT can improve production reporting and business decisions, but the integration also creates opportunities to compromise industrial control systems and data integrity. A gateway creates a policy and translation boundary: it can read only approved tags, use an outbound connection, queue data during a WAN outage and prevent the platform from reaching the controller directly.
- Never assign a public address to a PLC, HMI, safety controller or similar control device.
- Do not allow unrestricted inbound connections from a cloud tenant, vendor network or corporate user segment.
- Do not assume that encryption alone makes an unsafe topology safe; an encrypted connection to an over-privileged controller is still dangerous.
Step 1: inventory assets, data and safety dependencies
Start with an accurate asset and data-flow register. Include equipment that is sometimes missed, such as engineering laptops, temporary maintenance devices, protocol converters, wireless bridges and unmanaged switches.
Free tools Windows power users keep installed
One-click scans. No signup required.
Record each asset
- Device type and role: PLC, robot, CNC, sensor, HMI, SCADA/DCS server, historian, gateway or network appliance.
- Manufacturer, model, firmware version and supported protocols.
- Owner, physical location, cell or line, network address and cabinet or rack.
- Process and safety dependency, including what happens if the device, gateway or network is unavailable.
- Administrative accounts, remote-access method, backup location and supplier support contact.
- Whether the device can authenticate peers, validate certificates, encrypt traffic or receive signed updates.
Define the data flow
For every proposed measurement, document its tag name, meaning, engineering unit, quality state, timestamp source, sampling rate, acceptable latency and destination. Mark whether the value is needed for a dashboard, alarm, maintenance model, regulatory record or another purpose. Record whether any write-back, recipe update or command is genuinely required; if not, make the path read-only.
Classify safety-sensitive, personal, security-sensitive and commercially confidential data separately. Data minimization reduces exposure and lowers the amount that must be retained, monitored and recovered.
Rank #2
- Multiple Internet access methods is offered: Global frequency LTE 4G/3G & Ethernet port & ADSL.
- Router fucntion is supported: Routing, VPN and firewall.
- Super Powerful Edge Computing Capabilities
- Support graphical programming (Node-RED) to quickly develop edge computing functions to meet unique functional requirements.
- Suitable for a variety of industrial IoT scenarios, supporting Modbus RTU/TCP protocol conversion and other popular PLC common protocols.
Step 2: place the boundary in the right zone
Use a gateway in an OT edge zone or industrial DMZ rather than placing it on the same unrestricted segment as controllers. A common zoning model separates:
| Zone | Typical contents | Connection rule |
|---|---|---|
| Control | PLCs, safety systems, drives and real-time control devices | Only required supervisory or engineering flows; no direct cloud or internet route |
| Operations | SCADA/DCS servers, historians and operator HMIs | Controlled exchanges with the control zone and the gateway |
| Industrial DMZ / OT edge | Gateway, protocol broker, update relay and security monitoring components | Explicitly allowlisted flows to OT and to enterprise or cloud services |
| Enterprise | Business applications, identity services and analyst tools | Consume approved data through defined interfaces; do not manage controllers by default |
| Cloud or IIoT platform | Ingestion, storage, analytics and applications | Use authenticated, encrypted sessions terminating at the gateway or approved relay |
The gateway should normally initiate an outbound session to the platform. If an inbound path is unavoidable, document the source, destination, port, protocol, duration, operator authorization and fail-safe behavior. Use firewalls or equivalent enforcement points that an OT engineer can operate without disrupting deterministic traffic.
Step 3: choose an industrial IoT gateway that fits the plant
There is no universally safe gateway model. Selection depends on equipment vendors, protocols, environmental conditions, required latency, hazardous-location rules, redundancy and the target platform. Evaluate these capabilities against the actual plant inventory:
| Evaluation area | Questions to answer |
|---|---|
| Protocol support | Can it read the plant’s PLC, SCADA, historian and sensor protocols without an untested converter? |
| Data semantics | Can it preserve tag names, units, timestamps, quality flags and source identity? |
| Directionality | Can telemetry remain one-way, and can any bidirectional feature be disabled when unnecessary? |
| Identity and keys | Does it support unique device or service identities, certificate or key authentication, secure storage, rotation and revocation? |
| Transport security | Does it provide authenticated encryption and let administrators restrict protocol versions and cipher choices? |
| Store-and-forward | Can it buffer data safely through a WAN or cloud outage, with bounded storage and clear overflow behavior? |
| Local operation | Will the production line continue safely if the platform or gateway connection fails? |
| Lifecycle support | Are firmware updates, vulnerability notices, supported versions and recovery images documented? |
| Resilience | Are high-availability, backup, failover and replacement procedures available? |
| Physical suitability | Does it meet industrial temperature, vibration, power, enclosure and hazardous-location requirements? |
| Integration | Is the target IIoT platform’s connector documented, tested and supportable by the plant team? |
Confirm every security and compatibility claim in current manufacturer documentation and in a plant test. A feature listed on a data sheet is not evidence that it is configured securely for your topology.
Step 4: enforce segmentation and least-privilege flows
Write the allowed communications before creating firewall rules. For each flow specify source, destination, direction, protocol, port, purpose, expected rate and owner. A rule such as “OT to cloud” is too broad to audit; a rule should identify the gateway, the platform endpoint and the exact service required.
Rank #3
- SATELLITE CONNECTIVITY WHERE OTHERS FAIL: Eliminate dead zones in Agriculture, Forestry, and Mining. Unlike standard LoRaWAN or Cellular networks that require nearby gateways, the Hestia A1 connects directly to the 3GPP NTN Satellite network for deep mountains or open oceans where terrestrial signals cannot reach
- MODBUS PROTOCOL COMPATIBILITY: Built as Modbus Slave Device, Hestia can be connected to most Modbus IoT Host systems to enable satellite connectivity for industrial applications
- PLUG-AND-PLAY VIA RS485/MODBUS: Simple Python script integration with Python samples for Modbus/MQTT available on GitHub. Open custom code architecture provides flexibility for developers without black box limitations
- INCLUDES 3-MONTH SATELLITE DATA PLAN (30KB): Start your remote monitoring project immediately with a free 30KB / 3-Month satellite data plan via the CeresGate platform (Email registration required). Comes with Python sample code on GitHub for easy integration with Raspberry Pi, Linux, and Modbus devices
- TWO-WAY SATELLITE COMMUNICATION & CONTROL: Supports bidirectional data transmission allowing you to receive telemetry from remote sensors and send commands back to control equipment such as opening valves or resetting devices from the cloud without needing complex LoRaWAN infrastructure
Segmentation checklist
- Block direct internet routing from PLCs, HMIs and safety devices.
- Permit controller-to-gateway traffic only for the approved protocol and tag set.
- Allow gateway-to-platform traffic only to documented endpoints and ports.
- Separate engineering and maintenance access from normal telemetry.
- Use dedicated management interfaces or a management zone for administration.
- Disable unused switch ports, wireless radios, services and protocol listeners.
- Log accepted and denied connections at the boundary, while avoiding inspection methods that can add unsafe latency to control traffic.
An industrial firewall or OT network-security appliance may be appropriate when the architecture needs a dedicated segmentation and policy-enforcement point. Select one based on throughput, deterministic-traffic behavior, redundant power and the operators’ ability to maintain it.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsStep 5: establish identity, authentication and encrypted transport
Every gateway, service and supported device should have a distinct identity. Shared administrator passwords make it impossible to attribute changes and make revocation disruptive. Use certificate- or key-based authentication where the equipment supports it; otherwise isolate legacy devices behind a gateway and compensate with strict network controls, monitored access and a documented replacement plan.
- Create separate accounts for operators, engineers, administrators and services.
- Grant read-only permissions to telemetry collectors whenever possible.
- Store private keys and credentials in protected storage, not in scripts, source code or plain-text configuration files.
- Define certificate issuance, renewal, revocation and emergency replacement procedures before deployment.
- Synchronize clocks using a trusted time source suitable for OT. Correct time is needed to correlate logs and validate certificate lifetimes.
- Use encrypted transport with peer authentication. Verify that the gateway validates the platform certificate rather than merely encrypting an unauthenticated session.
- Rotate credentials on a schedule and after personnel, supplier or incident changes.
Plan for certificate expiry as an operational event. Test renewal and replacement with a representative gateway before the production certificate reaches its final days; an expired certificate can stop telemetry even when the network itself is healthy.
Step 6: normalize data and survive outages
Define a stable tag and data model at the edge. Include the source asset, tag identifier, engineering unit, timestamp, quality flag, scaling and ownership. Preserve the original timestamp when measurements are delayed, and distinguish a stale value from a valid zero.
Use bounded store-and-forward buffering so a temporary WAN or cloud outage does not stop the line. Decide how long data is retained locally, what happens when storage fills, how duplicate records are identified after reconnection and whether old data is dropped before new data. Buffering should protect production and preserve useful telemetry; it must not become an unmonitored archive of sensitive information.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- 【Built-in 4G LTE Module】 With a standard SIM card slot that supports the 4G LTE network. It can move into 4G LTE wireless network if the Ethernet Internet fails, in order to ensure constant data transmission in the critical facilities. (Not support Verizon Network in the US)
- 【Industrial Hardware】 Qualcomm QCA9531 chipset provides stable performance, it is commonly used within the industry, which is perfect for industrial users to avoid breakdown. The Built-in hardware watchdog ensures the stability. It’s dedicated hardware that can detect and trigger a processor reset if necessary.
- 【Open Source & Secure】 OpenWrt pre-installed. Perfect for developers or IoT integration development. It supports 30+ VPN service providers, including OpenVPN & WireGuard.
- 【Compact Design】 Its aluminum alloy shell, optional wall-mounted design, and wide range of operating temperature are designed for easy installation, storage, and operation in tough industrial environments.
- 【Easy Configuration】 Supports AT command, manual/automatic dial number, and signal strength checking in our new admin panel for better management and configuration.
Keep safety and real-time loops local. Cloud analytics may recommend a maintenance action or set-point change, but an automated write-back path needs independent authorization, range checks, sequencing, interlocks and a tested fallback. In many plants the safest design is to export telemetry only and require a local operator or control application to approve any change.
Step 7: monitor, log and govern changes
Security depends on detecting what changes after commissioning. Centralize or securely forward logs from gateways, firewalls, identity services and relevant OT servers, while retaining a local copy if the central service is unavailable.
Events worth recording
- Successful and failed authentication, privilege changes and account lifecycle events.
- Configuration, firewall, certificate, firmware and policy changes.
- New assets, new source-destination pairs and unexpected protocols.
- Abnormal message rates, unusual tag access and failed write attempts.
- Gateway restarts, buffer overflow, time drift and loss of platform connectivity.
- File-integrity changes on systems that support integrity monitoring.
NIST’s manufacturing security approach includes behavioral anomaly detection, application allowlisting, file-integrity checking, change-control management and user authentication and authorization. Apply the controls that fit the plant’s risk and technical constraints; do not enable a control blindly if it can interrupt a validated control application.
Use formal change control for gateway rules, tag lists, firmware, certificates, platform connectors and network topology. Record the reason, approver, test evidence, implementation window, rollback method and post-change verification.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Step 8: test before production
Test in a lab, staging cell or planned maintenance window with representative PLC, SCADA and network behavior. Include normal operation and deliberate failures.
Best Value
- 【SMART 4G TO WI-FI CONVERTER】Come with a standard nano-SIM card slot that can transfer 4G LTE signal to Wi-Fi networking. Up to 300Mbps (2.4GHz ONLY) Wi-Fi speeds. It can move into a 4G LTE wireless network if the Ethernet Internet fails, in order to ensure constant data transmission.
- 【OPEN SOURCE & PROGRAMMABLE】OpenWrt pre-installed, unlocked, extremely extendable in functions, perfect for DIY projects. 128MB RAM, 16MB NOR + 128MB NAND Flash. Dual Ethernet ports, USB 2.0 port, Antenna SMA mount holes reserved.
- 【SECURITY & PRIVACY】OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. With our brand-new Web UI, you can set up VPN servers and clients easily. IPv6, WPA3, and Cloudfare supported. Level up your online security.
- 【Easy Configuration with Web UI and GoodCloud】GoodCloud allows you manage and monitor devices anytime, anywhere. You can view the real-time statistics, set up a VPN server and client, manage the client connection list, and remote SSH to your IoT devices. The built-in 4G modem supports AT command, manual/automatic dial number, SMS checking, and signal strength checking in Web UI for better management and configuration.
- 【PACKAGE CONTENTS】GL-XE300-AF 4G LTE Portable IoT Gateway (2-year Warranty) X1, Ethernet cable X1, 5V/2A power adapter X1, User manual X1, Quectel EC25-AF 4G module pre-installed. Please refer to the online docs for first set up.
- Verify that only the intended tags leave the OT boundary and that unauthorized protocols are blocked.
- Confirm certificate validation, credential rotation, clock synchronization and revocation behavior.
- Disconnect the WAN or platform and verify that control and safety functions continue locally.
- Restore connectivity and check that buffered records arrive once, with correct timestamps and quality states.
- Attempt an unauthorized write and confirm that it is rejected, logged and alerted.
- Expire or revoke a test certificate and execute the documented replacement procedure.
- Restore the gateway and configuration from backup on replacement hardware.
- Apply a test update, verify application behavior and execute rollback.
- Exercise incident isolation: block the gateway, preserve logs, notify the asset owner and return the line to a safe state.
- Have operations, engineering, safety and cybersecurity owners sign off on the results.
Do not treat a successful connectivity test as a security test. A connection that carries the right values can still have excessive privileges, unsafe failure behavior or inadequate recovery.
Operating the connection over its lifecycle
Maintain an asset register, protocol and firmware support matrix, certificate inventory, backup set, recovery objectives and supplier contacts. Reassess the design after any firmware update, controller replacement, new production cell, network change, platform migration or process change.
Review vulnerability notices and patch feasibility for every gateway, firewall and server. OT patching may require a maintenance window, offline testing and a rollback image; “patch immediately” is not a complete OT policy. Conversely, deferring a critical fix without compensating controls leaves an unexamined risk. Document the decision and its expiration date.
Define recovery objectives in operational terms: how much telemetry can be lost, how long the gateway may be unavailable, which local functions must continue and who can authorize isolation. Keep tested backups offline or otherwise protected from the same compromise that could affect production systems.
Standards and governance to use
NIST SP 800-82 is a practical baseline for OT security and covers SCADA, DCS and PLC environments while emphasizing performance, reliability and safety. NIST also references ISA/IEC 62443 for industrial automation and control-system security. Map the applicable 62443 concepts—such as zones and conduits, system requirements, component requirements and supplier or secure-development evidence—to the asset owner’s risk assessment.
A standard reference does not automatically make a particular product, certification level or control mandatory for every factory. Requirements can vary by process, jurisdiction, safety classification, contract and sector regulation. The asset owner should approve the target security level and document exceptions.
Connected-device security should be considered during acquisition, vendor evaluation and the full lifecycle, not added after installation. Contract language can require supported versions, vulnerability disclosure, update and end-of-support notices, evidence of secure development, access records and assistance with incident response.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Common failure modes and recovery actions
The platform stops receiving data
- Check gateway health, certificate validity, clock accuracy and outbound firewall rules.
- Inspect local buffer depth and the connector’s retry state.
- Verify that the platform endpoint or tenant has not changed.
- If production is unaffected, keep the control network isolated while restoring telemetry.
A gateway change disrupts the line
- Use the approved rollback configuration and return control to the last validated state.
- Preserve logs and the change record before making further edits.
- Have the OT owner verify deterministic traffic and safety behavior.
- Move the change to a lab or maintenance window and retest with representative traffic.
Unexpected writes or protocol traffic appear
- Isolate the gateway or offending path at the documented enforcement point.
- Do not power-cycle equipment if doing so could create a process hazard or destroy useful evidence.
- Notify the asset owner and incident-response contacts, preserve authentication and network logs, and verify controller logic and set points locally.
- Revoke affected credentials or certificates, then restore only the minimum approved flows after investigation.
A practical decision checklist
- Is every connected asset identified, owned and assigned a safety and business purpose?
- Can the design operate with telemetry only, avoiding write-back?
- Does a gateway or industrial DMZ broker the connection instead of exposing controllers?
- Are control, operations, enterprise and cloud zones separated by explicit policy?
- Are identities unique, privileges minimal and credentials or certificates recoverable?
- Are data units, quality flags, timestamps, retention and buffering defined?
- Are authentication, configuration, firmware, policy and data-flow changes logged and reviewed?
- Have outage, certificate expiry, unauthorized write, backup restoration and rollback scenarios been tested?
- Has the asset owner, safety authority and cybersecurity owner approved production operation?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
