Anybus Defender Compact 1004 - NAT/FW

Anybus Defender Compact 1004 is a compact industrial firewall for isolating and securing machines, production lines, and other parts of the OT network. It helps restrict unwanted communication, resolve IP address conflicts, and securely connect machines to higher-level systems.

Why choose Anybus Defender Compact 1004?

• Reduces the risk of production downtime – by isolating machines and production lines, it helps prevent problems and cyber threats from spreading to other parts of the network.
• Saves time and costs when connecting identical machines – using NAT (Network Address Translation), multiple machines with identical internal IP addresses can be connected to the same higher-level network.
• Allows only the communication you need – access to machines can be restricted based on IP and MAC addresses, ports, and protocols.
• Speeds up firewall configuration – the learning mode records actual network communication and helps you create rules based on the detected traffic.
• Can be added to an existing network without changing IP addresses – in a bridge configuration, it filters communication between different parts of the network.
• Makes configuration easier for automation engineers – setup is performed using Windows software with an environment similar to PLC programming software.
• Designed for installation directly in an industrial control cabinet – it features a metal housing, DIN rail mounting, and a wide operating temperature range.

Anybus Defender Compact 1004 feature set

Anybus Defender Compact 1004 is available only in the NAT/FW variant. It is designed for network segmentation, controlling permitted communication, and resolving IP address conflicts using NAT.

If you also need deep inspection of industrial protocols, IPS, VPN, or advanced networking features, these capabilities are available in higher-end Anybus Defender models.

Not sure which Defender to choose?

Tell us about your network and what you need to secure. We will recommend the right model and variant.

Consult your Defender selection

Network connection and communication filtering

Anybus Defender Compact 1004 is installed between the machine network and the higher-level production or enterprise network. All communication between the two parts of the network passes through the firewall, which allows or blocks it according to the configured rules.

Rules can be configured based on IP and MAC addresses, communication ports, and protocols. By default, communication between WAN and LAN is blocked until you explicitly allow it using firewall rules. In practice, you can, for example, allow access to a PLC only from a designated service computer, permit communication with a SCADA system, and block all other connections.

Two ways to connect it to the network

Bridge – without changing IP addresses

In a bridge configuration, the firewall can be inserted into an existing network without changing the IP addresses of PLCs, HMIs, and other devices. The Defender operates transparently in the network and filters communication between the machine network and the higher-level network.

This configuration is particularly suitable for adding security to an existing machine or production line.

Gateway – network separation and NAT

In a gateway configuration, the Defender operates as a router between the machine network and the higher-level network. Both sides can use different IP address ranges, while communication between them is controlled using static routing, NAT, and filtering rules.

NAT (Network Address Translation) allows you to keep the original IP addresses inside the machine while communicating with the devices from the higher-level network using translated addresses. This is useful, for example, when connecting multiple identical machines with the same internal IP addressing, because you do not need to change the IP addresses of PLCs, HMIs, or other devices.

The Defender supports several types of Network Address Translation. In practice, the most useful are:

• SimpleNAT – allows a specific device in the machine network to be accessed using a dedicated IP address from the higher-level network.
• Network NAT – translates an entire network and is useful, for example, when connecting multiple machines with identical internal IP addressing.
• SNAT – changes the source IP address of the communication and can be used, for example, when the destination device does not have the correct default gateway configured.
• Port forwarding (DNAT) – makes only a specific service or communication port of a device inside the machine accessible from the higher-level network.

Learning mode – faster configuration based on actual traffic

Learning mode makes the initial firewall configuration significantly easier. The Defender records ongoing network communication and displays actively communicating devices and detected connections in the configuration software.

This means you do not have to identify all communication between PLCs, HMIs, SCADA systems, and other devices manually in advance. You can then decide which detected connections should remain permitted and create filtering rules based on them. All other communication can be blocked.

Graphical interface for firewall configuration

Anybus Defender Compact 1004 is configured using Anybus Defender Compact Manager for Windows. The graphical interface is designed in a similar way to PLC programming software and includes wizards for basic firewall configuration.

The software allows you to configure bridge or gateway operation, NAT, routing, and filtering rules. The device does not have a built-in web interface, which reduces the number of potential attack vectors. A command-line interface via SSH is also available for configuration and advanced management.