Microwall Bridge, průmyslový Firewall and Ethernet Bridge

A Microwall Bridge is a network element that is inserted into an Ethernet network to separate (isolate) devices on the network or to restrict Ethernet communication to those devices. It is used, for example, to separate older computers on a network that might be a security threat on the network because they still have an older and poorly secured operating system. Another reason may be the need to define and clearly configure Ethernet communication to PLC systems, e.g. enabling the port only for OPC UA communication, for reading data into the production system, etc.  

The Microwall Bridge is placed in the network to separate devices in the same network range. If two different networks need to be connected (i.e. different IP address ranges), a Microwall VPN device must be used. 

Whitelist

The Microwall Bridge works on the whitelist principle, i.e. after placing it in the network it isolates all communication from port 1 to port 2. The principle of whitelisting is that everything is initially forbidden and we allow what we need. The devices that are to be isolated from the rest of the network are connected to port 2. Using rules, we gradually enable the necessary communication. Within the rules we define the IP address, ports, type of communication (TCP/UDP/FTP) and the direction in which they should communicate.

Example of using the Microwall Bridge

We have a production machine with PLC S7-1500 control system. This PLC runs a web interface and an OPC UA server to read data from the PLC. We only want to read data from the company network via OPC UA, the rest of the communication is undesirable for security reasons.

Rule Settings
By adding rules, we gradually enable the necessary communication on port 2. In our case it is sufficient to enable TCP port 4840.

All set communication rules can be seen in the Firewall rules overview