The safest pattern is to keep PLCs, robots and other control devices off the public internet and place a managed OT edge or industrial IoT gateway between the plant and the IIoT platform. First inventory assets and data flows, then separate control, operations, enterprise and cloud zones. Permit only documented flows, use unique identities with least privilege and encrypted transport, monitor changes and anomalies, and test outage, rollback and recovery procedures before production.
Keep real-time and safety functions local. Send only the telemetry the platform needs, and treat any command or write-back path as a separate, higher-risk design requiring explicit authorization, testing and operational ownership.
As an Amazon Associate I earn from qualifying purchases.
The secure connection pattern
A factory connection is not simply a matter of installing a cloud connector on a PLC. Industrial control systems have timing, reliability and safety constraints that ordinary IT integrations do not. NIST describes OT security as having to address “unique performance, reliability, and safety requirements” while considering topology, threats, vulnerabilities and countermeasures.
Recommended Free Tools
A defensible architecture has four logical areas:
- Control zone: PLCs, safety controllers, drives, robots and field devices that execute control logic.
- Operations zone: HMIs, SCADA or DCS servers, engineering workstations and historians.
- Enterprise zone: business applications and user services that do not need direct access to control equipment.
- Cloud or IIoT zone: the platform receiving selected, normalized data and providing analytics or applications.
An OT edge or industrial IoT gateway brokers the connection from the operations side to the platform. Firewalls or equivalent enforcement points control the permitted paths. Safety interlocks and deterministic control loops remain inside the plant; the cloud connection must never be a prerequisite for a line to remain in a safe state.
#1 Best Overall
- Multi-Protocol Support: Integrates with industrial systems and supports multiple communication protocols, including Modbus RTU/TCP, BACnet, OPC UA, OPC XML-DA, and IEC 104, enabling seamless connection with diverse industrial devices to meet different automation needs.
- Cloud Data Connectivity: Functions as an MQTT, HTTP, and Socket client, providing reliable data transmission and automatic reconnection to maintain continuous data flow for IoT applications.
- JS Script Programming Support: Offers flexibility through JavaScript scripting, allowing users to customize and extend the gateway's capabilities to meet specific application needs.
- Alarm and Event Management: Allows users to set trigger conditions, enabling event triggers and releases based on state transitions.
- Easy Configuration and Management: User-friendly graphical configuration software simplifies setup, allowing easy access to real-time and historical data through an HTTP server interface.
Why direct PLC-to-internet connections fail the safety test
Putting a PLC, HMI or other controller directly on the public internet exposes a device that was designed for controlled industrial networks to unsolicited scanning, credential attacks and protocol abuse. It also creates an unbounded route toward systems that can change process behavior. NIST’s manufacturing work notes that connecting OT to IT can improve business processes but also gives malicious actors opportunities to compromise industrial control systems and data integrity.
A direct connection usually lacks a place to enforce authentication, filter commands, buffer data during outages, or record a complete audit trail. It can also make a cloud outage, certificate error or software update visible to a control loop that was never designed to depend on a WAN. The gateway pattern limits exposure and gives the plant a component that can be patched, monitored, backed up and replaced without modifying every controller.
Step 1: inventory and classify every asset and flow
Begin with an asset register, not a platform selection. The register should be accurate enough for an OT engineer to identify a device, understand what it controls and determine what would happen if its network connection disappeared.
Record the equipment
- PLC, safety PLC, robot, CNC, drive, sensor, HMI, SCADA or DCS server, historian and existing gateway.
- Manufacturer, model, serial number, firmware version and supported protocol or interface.
- Owner, physical location, production line and maintenance contact.
- Safety dependency, criticality, permitted maintenance window and consequence of an incorrect value or command.
- Current network address, switch or segment, exposed services and remote-access method.
Include equipment that will not initially send data. An unlisted engineering laptop or legacy controller can become the path around a carefully designed gateway.
Map data requirements
For each proposed tag or measurement, document its meaning, unit, quality state, timestamp source, sampling rate, acceptable latency and retention need. Identify whether the platform needs a current value, a historical series, an event, an alarm or a calculated metric. Record where the data is stored and who is allowed to see it.
Mark every flow direction. A read-only telemetry flow is materially different from a write-back path that can acknowledge an alarm, change a setpoint or download logic. Challenge every request for a command path: if an operator can perform the action locally, remote control may not be justified. Where write-back is necessary, specify the exact commands, authorization, interlocks, operating window and independent recovery method.
Classify safety and availability
Separate safety-sensitive values from ordinary production metrics. A cloud dashboard may tolerate delayed or missing data; an emergency stop, burner-management signal or motion interlock cannot be delegated to it. Define the maximum acceptable data gap and latency for each use case, and state what the machine must do when the gateway, WAN or platform is unavailable.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 2: place an OT edge or industrial IoT gateway at the boundary
The gateway should terminate or broker the industrial protocols on the plant side and publish a controlled data stream to the IIoT platform. Place it in a segmented operations area or an industrial DMZ according to the plant’s topology and risk assessment. Do not treat its presence as a substitute for firewall policy or asset inventory.
Rank #2
- Multiple Internet access methods is offered: Global frequency LTE 4G/3G & Ethernet port & ADSL.
- Router fucntion is supported: Routing, VPN and firewall.
- Super Powerful Edge Computing Capabilities
- Support graphical programming (Node-RED) to quickly develop edge computing functions to meet unique functional requirements.
- Suitable for a variety of industrial IoT scenarios, supporting Modbus RTU/TCP protocol conversion and other popular PLC common protocols.
Keep control local
Read process values from the controller or an operations server without inserting a cloud dependency into the scan cycle. The gateway should not become a single point whose failure stops production. If it must interact with a controller, use a documented interface and verify that polling frequency, session behavior and retries do not disturb deterministic traffic.
Use one-way telemetry by default
Outbound telemetry is the default design. The gateway initiates an authenticated, encrypted session toward the platform, while inbound internet-initiated sessions to controllers remain blocked. If the platform needs commands, implement a separately governed channel with explicit command allowlists, operator authorization, rate limits, logging and a local fail-safe state. Test that a malformed, duplicated or delayed command cannot create an unsafe action.
Evaluate gateway capabilities
Before purchase or deployment, verify current manufacturer documentation for:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Drivers for the plant’s actual PLC, SCADA, DCS and sensor protocols, including the required versions and data types.
- Certificate or key management, secure credential storage, rotation and revocation.
- Encrypted transport to the platform and authenticated connections on the plant side.
- Store-and-forward buffering with defined limits and behavior after a long WAN outage.
- Local operation when the cloud is unreachable, including safe restart after power loss.
- High-availability options, backup and restore, and a documented update process.
- Industrial environmental ratings and any hazardous-location requirements.
- Audit logs, configuration export, role-based administration and integration with monitoring.
- Vendor remote-access controls, data residency and the supplier’s vulnerability response process.
Compatibility is more than a protocol name. Confirm tag addressing, quality flags, timestamps, scaling, alarm semantics and whether the driver reads through an existing historian rather than opening additional sessions to a controller.
Step 3: segment the network and enforce narrow conduits
Draw the permitted paths before creating firewall rules. For every connection, record source, destination, direction, protocol, port, purpose, owner and change-approval reference. Deny everything else.
| Zone | Typical assets | Connection principle |
|---|---|---|
| Control | PLCs, safety controllers, drives, robots and field devices | No direct internet access. Accept only the narrowly defined industrial traffic required for local control and supervised data collection. |
| Operations | SCADA/DCS servers, HMIs, engineering stations and historians | Broker plant data through controlled interfaces; restrict engineering and administrative access separately from telemetry. |
| Industrial DMZ or edge zone | Gateway, protocol broker, update relay and monitoring components | Enforce separate plant-side and enterprise/cloud-side policies. Permit only documented flows and management paths. |
| Enterprise | Business applications and user services | Consume approved data products rather than reaching into controllers. |
| Cloud or IIoT | Ingestion, storage, analytics and applications | Authenticate the gateway or service, restrict tenant access and keep command capability disabled unless specifically approved. |
Design firewall policy for operations
Use an industrial firewall or OT network security appliance when a dedicated policy-enforcement point is required. The device must be operable by personnel who understand deterministic industrial traffic; an aggressive rule change that interrupts a control network can itself create production or safety risk. Begin with observation, document legitimate flows, then enforce a deny-by-default policy during a controlled maintenance window.
Separate administrative access from data transport. Management interfaces should be reachable only from approved jump hosts or maintenance networks, with named accounts and strong authentication. Disable unused interfaces and services on the gateway, controllers and network equipment.
Step 4: establish identity, authorization and encrypted transport
Give each component a distinct identity
Use unique device, gateway, service and human identities wherever the equipment supports them. Shared administrator passwords make it impossible to attribute a change or revoke one compromised account without disrupting every user. Assign the minimum permissions needed: a telemetry collector should not have programming rights, and a dashboard user should not be able to issue commands.
Rank #3
- SATELLITE CONNECTIVITY WHERE OTHERS FAIL: Eliminate dead zones in Agriculture, Forestry, and Mining. Unlike standard LoRaWAN or Cellular networks that require nearby gateways, the Hestia A1 connects directly to the 3GPP NTN Satellite network for deep mountains or open oceans where terrestrial signals cannot reach
- MODBUS PROTOCOL COMPATIBILITY: Built as Modbus Slave Device, Hestia can be connected to most Modbus IoT Host systems to enable satellite connectivity for industrial applications
- PLUG-AND-PLAY VIA RS485/MODBUS: Simple Python script integration with Python samples for Modbus/MQTT available on GitHub. Open custom code architecture provides flexibility for developers without black box limitations
- INCLUDES 3-MONTH SATELLITE DATA PLAN (30KB): Start your remote monitoring project immediately with a free 30KB / 3-Month satellite data plan via the CeresGate platform (Email registration required). Comes with Python sample code on GitHub for easy integration with Raspberry Pi, Linux, and Modbus devices
- TWO-WAY SATELLITE COMMUNICATION & CONTROL: Supports bidirectional data transmission allowing you to receive telemetry from remote sensors and send commands back to control equipment such as opening valves or resetting devices from the cloud without needing complex LoRaWAN infrastructure
Protect keys and certificates
Store private keys in the gateway’s protected credential store or an approved key-management system rather than in scripts or configuration files. Define issuance, rotation, revocation and emergency replacement procedures before connecting the first device. Keep an inventory of certificate owners, expiration dates, issuing authority and dependent services. Synchronize clocks using a trusted, plant-approved time source; accurate time is necessary for certificate validation and for correlating security events.
Encrypt and authenticate both sides
Use an encrypted protocol supported by the equipment and platform, with mutual authentication when available. Verify the gateway validates the platform certificate and that the platform validates the gateway identity; encryption without endpoint authentication can still permit an attacker to impersonate a service. Do not disable certificate validation to make a commissioning problem disappear. Instead, correct the trust chain, clock, hostname or certificate scope and record the change.
Control credentials and emergency access
Use separate named accounts for operators, engineers, administrators and suppliers. Restrict supplier access to approved windows, require an accountable plant owner and record activity. Keep a documented break-glass procedure for certificate failure or gateway replacement, with credentials stored securely and tested during maintenance rather than discovered during an outage.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Step 5: normalize, minimize and buffer the data
Define a common data model before publishing tags. Include tag name, description, unit, scale, quality flag, source timestamp, gateway receipt time and ownership. Preserve the original quality state so a consumer can distinguish a valid zero from a stale, substituted or out-of-range value.
Send only what has a purpose
Minimize the export to the measurements, events and metadata needed for the approved use case. Unnecessary tags increase attack surface, storage cost and the chance that sensitive process information reaches an unauthorized user. Avoid exporting safety logic, credentials, engineering files or other data that the platform does not need.
Make outages safe
Use store-and-forward buffering when the WAN or platform is unavailable. Define how much local storage is available, which data is prioritized, how timestamps are preserved and what happens when the buffer is full. A platform outage should produce a visible data gap or controlled backlog, not stop a production line. After reconnection, test ordering, duplicate handling and rate limiting so a large backlog does not overload the network or platform.
Step 6: monitor activity and govern changes
Monitoring should cover the gateway, the industrial protocols around it and the platform account that receives the data. Record authentication successes and failures, configuration and policy changes, firmware updates, certificate events, new assets, protocol changes and data-flow changes. Retain enough context to identify who made a change, from where, when and what was modified.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsAlert on meaningful deviations
- A new device, address, protocol or destination appears in an OT segment.
- Authentication failures increase or a certificate is near expiry or has been revoked.
- Sampling rates, message sizes or traffic direction change unexpectedly.
- An account attempts an operation outside its role or an unauthorized write is attempted.
- The gateway stops forwarding, fills its buffer, loses time synchronization or repeatedly restarts.
Use behavioral anomaly detection where it can be tuned to the plant’s normal patterns. NIST’s manufacturing example also includes application allowlisting, file-integrity checking, change-control management, and user authentication and authorization. Apply those controls in a way that respects maintenance windows and safety validation; an allowlist that blocks a required engineering tool at the wrong time can cause its own operational problem.
Rank #4
- 【Built-in 4G LTE Module】 With a standard SIM card slot that supports the 4G LTE network. It can move into 4G LTE wireless network if the Ethernet Internet fails, in order to ensure constant data transmission in the critical facilities. (Not support Verizon Network in the US)
- 【Industrial Hardware】 Qualcomm QCA9531 chipset provides stable performance, it is commonly used within the industry, which is perfect for industrial users to avoid breakdown. The Built-in hardware watchdog ensures the stability. It’s dedicated hardware that can detect and trigger a processor reset if necessary.
- 【Open Source & Secure】 OpenWrt pre-installed. Perfect for developers or IoT integration development. It supports 30+ VPN service providers, including OpenVPN & WireGuard.
- 【Compact Design】 Its aluminum alloy shell, optional wall-mounted design, and wide range of operating temperature are designed for easy installation, storage, and operation in tough industrial environments.
- 【Easy Configuration】 Supports AT command, manual/automatic dial number, and signal strength checking in our new admin panel for better management and configuration.
Control software and configuration changes
Maintain approved baselines for gateway configuration, firewall rules, protocol drivers and controller interfaces. Review vulnerabilities and patches for the complete path, including the gateway, operating system, protocol libraries and platform connector. Test updates with representative equipment before production, and retain a rollback package and restoration instructions.
Step 7: validate the design before production
Use a lab, digital test environment or scheduled maintenance window with representative PLC, SCADA and gateway behavior. The test plan should produce evidence that the connection is safe under normal operation and failure.
- Functional data test: verify tag values, units, scaling, timestamps, quality flags, alarms and expected sampling rates from source to platform.
- Access test: confirm each role can perform only its approved action and that rejected actions are logged.
- Segmentation test: demonstrate that a controller cannot reach the internet and that unlisted ports, protocols and directions are blocked.
- Certificate test: verify trust validation, expiration handling, rotation and emergency revocation without leaving an unauthenticated fallback.
- Outage test: disconnect the WAN, platform or gateway and confirm local control, buffering, alarms and operator instructions.
- Recovery test: restore gateway configuration and data from backup, replace a failed gateway, and verify that identities and firewall rules are re-established correctly.
- Write-path test: if commands are approved, test authorization, interlocks, duplicate or delayed messages, rate limits and a safe stop.
- Rollback test: return to the previous firmware, policy or connector version and confirm the plant remains operable.
- Incident exercise: isolate the gateway, preserve logs, revoke credentials, notify the asset owner and restore service using the documented procedure.
Obtain sign-off from the asset owner, an OT engineer, the safety function and the cybersecurity owner. Record the tested versions, network paths, expected behavior and residual risks so a future change can be compared with a known baseline.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallStep 8: operate the connection through its lifecycle
Security ends only when the equipment is retired. Keep the asset register, protocol and support matrix, certificate inventory, backup set, recovery objectives and supplier contacts current. Review the design after firmware upgrades, topology changes, a new production process, a platform migration or any change from read-only telemetry to bidirectional control.
Plan for replacement and retirement
Define how a gateway is replaced without creating a temporary internet bridge. Pre-stage approved firmware, configuration, certificates and firewall rules; verify the replacement identity; and test restoration before removing the old unit. When a device or service is retired, revoke its credentials, remove firewall rules and delete unused accounts and routes.
Manage supplier and remote support risk
Evaluate connected-device security during acquisition and throughout the lifecycle, as CISA’s IoT acquisition guidance recommends. Require documentation for vulnerability handling, update support, logging, authentication, data handling and end-of-support dates. Remote support should be time-limited, attributable to a named person and disabled when the approved session ends.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to compare gateways, firewalls and platform connectors
The title does not identify a PLC vendor, protocol, geography, safety level or target platform, so a specific model recommendation would be unsafe. Use the following decision matrix with the plant’s actual requirements and current manufacturer documentation.
| Evaluation area | Questions to answer | Evidence to request |
|---|---|---|
| Protocol coverage | Does it support the exact PLC, SCADA, DCS and sensor protocols, versions and data types? | Compatibility matrix and a supervised proof with representative equipment. |
| Data semantics | Can it preserve units, quality flags, source timestamps, alarms and scaling? | Tag-mapping examples and exported test data. |
| Directionality | Is telemetry one-way by default, and can any write path be disabled or tightly allowlisted? | Configuration settings, role model and command audit behavior. |
| Identity and encryption | How are certificates or keys issued, stored, rotated and revoked? | Lifecycle procedure, trust-store controls and expiration behavior. |
| Segmentation | Can the device operate in an industrial DMZ and integrate with the required firewall policy? | Reference architecture and documented ports and flows. |
| Outage behavior | Does local control continue, and how does store-and-forward handle full buffers and reconnection? | Limits, retention rules and outage test results. |
| Monitoring | Are authentication, configuration, firmware and data-flow events exportable to plant monitoring? | Log schema, retention options and alert integrations. |
| Availability | Is redundancy needed, and can a failed unit be replaced without unsafe downtime? | Failover design, backup format and recovery procedure. |
| Maintenance | How are vulnerabilities, patches, firmware and end-of-support dates handled? | Security-advisory process and supported-version policy. |
| Environment | Does the hardware meet temperature, vibration, enclosure and hazardous-location requirements? | Certification and environmental rating documents. |
| Supplier access and data location | Who can administer the service, from where, and where is data stored? | Access model, residency statement and contractual controls. |
| Total operating cost | What are hardware, licenses, connectivity, certificates, support, testing and replacement costs? | Complete lifecycle estimate; a universal figure is not stated. |
Standards and governance to use
NIST’s Guide to Operational Technology Security, SP 800-82, is a practical baseline for understanding OT architectures, threats and controls. The earlier edition addresses SCADA, DCS and PLC configurations and emphasizes preserving performance, reliability and safety. NIST also references ISA/IEC 62443 for industrial automation and control-system security.
Best Value
- 【SMART 4G TO WI-FI CONVERTER】Come with a standard nano-SIM card slot that can transfer 4G LTE signal to Wi-Fi networking. Up to 300Mbps (2.4GHz ONLY) Wi-Fi speeds. It can move into a 4G LTE wireless network if the Ethernet Internet fails, in order to ensure constant data transmission.
- 【OPEN SOURCE & PROGRAMMABLE】OpenWrt pre-installed, unlocked, extremely extendable in functions, perfect for DIY projects. 128MB RAM, 16MB NOR + 128MB NAND Flash. Dual Ethernet ports, USB 2.0 port, Antenna SMA mount holes reserved.
- 【SECURITY & PRIVACY】OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. With our brand-new Web UI, you can set up VPN servers and clients easily. IPv6, WPA3, and Cloudfare supported. Level up your online security.
- 【Easy Configuration with Web UI and GoodCloud】GoodCloud allows you manage and monitor devices anytime, anywhere. You can view the real-time statistics, set up a VPN server and client, manage the client connection list, and remote SSH to your IoT devices. The built-in 4G modem supports AT command, manual/automatic dial number, SMS checking, and signal strength checking in Web UI for better management and configuration.
- 【PACKAGE CONTENTS】GL-XE300-AF 4G LTE Portable IoT Gateway (2-year Warranty) X1, Ethernet cable X1, 5V/2A power adapter X1, User manual X1, Quectel EC25-AF 4G module pre-installed. Please refer to the online docs for first set up.
Map the selected controls to the asset owner’s risk assessment and applicable regulation. ISA/IEC 62443 can help structure zones and conduits, system requirements, component requirements and supplier or secure-development evidence, but citing a standard does not by itself prove that a particular product, certification level or control is mandatory for every plant. The required scope depends on the process, jurisdiction, safety obligations and contractual requirements.
Common failure modes and corrective actions
The gateway can read tags but values are wrong
Check address syntax, data type, byte order, scaling, engineering units and quality flags. Compare a known source value with the gateway’s raw value and the platform’s normalized value. Verify that timestamps identify whether the value was produced by the controller, received by the gateway or ingested by the platform.
Data stops after a certificate change
Check clock synchronization, certificate chain, subject name, trust store, expiration and revocation status on both ends. Restore the last approved certificate only through the documented break-glass process, then complete rotation and remove the superseded credential.
The plant loses connectivity whenever the platform is unavailable
Inspect whether control logic, HMI functions or operator procedures depend on a cloud response. Move the dependency local, enable bounded store-and-forward and test the outage behavior during maintenance. The platform should not be part of a safety or real-time control loop.
A firewall rule change disrupts production
Return to the approved configuration if safe, use the maintenance escalation path and compare observed traffic with the documented source-destination matrix. Add only the required flow, with an owner and expiry or review date. Do not solve the incident by opening broad internet access.
An unexpected write attempt appears in the logs
Block the source, preserve authentication and gateway logs, revoke the affected identity if compromise is plausible and notify the asset owner and incident-response contacts. Determine whether the command was generated by an approved workflow, a misconfigured service or an unauthorized actor before restoring any write capability.
Go-live decision
Proceed only when the plant can identify every connected asset, explain every permitted flow, prove that control and safety remain local, authenticate both ends of the connection, recover from gateway or platform loss, and attribute changes to named identities. If any of those conditions is unproven, keep the integration in a lab or maintenance environment and close the specific evidence gap before production.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
