The safest pattern is to keep PLCs, robots, CNCs and other control devices off the public internet and place a managed OT edge or industrial IoT gateway between the plant and the IIoT platform. The gateway collects only approved data, crosses a segmented boundary under firewall policy, authenticates with unique identities, encrypts the connection, buffers data during outages and provides an auditable point for monitoring and change control.
Build the connection in this order: inventory assets and data flows; define what may leave the plant and whether any write-back is truly necessary; separate control, operations, enterprise and cloud zones; enforce least privilege; test failure and recovery behavior; then operate the design as a maintained security system rather than a one-time integration.
As an Amazon Associate I earn from qualifying purchases.
What a secure factory-to-cloud architecture looks like
A secure connection has a small, explicit trust boundary. Real-time control and safety functions remain local. An edge component in an appropriately segmented operations zone reads approved tags or measurements, converts them into a defined data model and sends outbound telemetry to the IIoT platform. The platform should not need a routable path to a PLC.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Zone | Typical contents | Primary rule |
|---|---|---|
| Control | PLCs, safety controllers, drives, robots and other devices that directly affect a process | No direct internet access; permit only documented, necessary local flows. |
| Supervisory/operations | HMI, SCADA or DCS servers, historians and the OT edge or gateway | Broker and filter plant data here; keep deterministic control traffic local. |
| Industrial DMZ or equivalent boundary | Transfer services, remote-access controls, update staging and other services that must mediate between OT and IT | Use explicit source, destination, port, protocol and direction rules. |
| Enterprise | Business applications, identity services and analytics that are not part of the control loop | Consume approved data without creating an implicit route back into control. |
| Cloud or IIoT platform | Fleet management, dashboards, storage, analytics and alerting | Accept authenticated, encrypted connections from approved plant identities only. |
The gateway is a control point, not a magic security box. It cannot compensate for an unknown asset inventory, unrestricted firewall rules, shared administrator accounts or an unsafe command path. Treat every connection through it as a deliberately designed conduit.
#1 Best Overall
- Multi-Protocol Support: Integrates with industrial systems and supports multiple communication protocols, including Modbus RTU/TCP, BACnet, OPC UA, OPC XML-DA, and IEC 104, enabling seamless connection with diverse industrial devices to meet different automation needs.
- Cloud Data Connectivity: Functions as an MQTT, HTTP, and Socket client, providing reliable data transmission and automatic reconnection to maintain continuous data flow for IoT applications.
- JS Script Programming Support: Offers flexibility through JavaScript scripting, allowing users to customize and extend the gateway's capabilities to meet specific application needs.
- Alarm and Event Management: Allows users to set trigger conditions, enabling event triggers and releases based on state transitions.
- Easy Configuration and Management: User-friendly graphical configuration software simplifies setup, allowing easy access to real-time and historical data through an HTTP server interface.
Why direct PLC-to-internet connections are unsafe
Operational technology has different priorities from ordinary IT. A missed packet or delayed restart can affect production, equipment integrity or worker safety. NIST’s Guide to Operational Technology (OT) Security (2023) says security measures must account for “unique performance, reliability, and safety requirements.” A control that is routine on an office network can disrupt a deterministic process when applied without an OT engineering review.
Connecting OT to IT can improve maintenance, quality and business decisions, but it also creates opportunities for a malicious actor to compromise industrial control systems or the integrity of process data. A PLC exposed to the internet can be scanned, misconfigured, or used as a stepping stone into other systems. Even a read-only connection can affect availability if it consumes excessive resources or changes device settings.
- Do not assign a public address to a PLC, HMI or safety device.
- Do not forward a control-device management port from the internet.
- Do not assume that a vendor’s default password, shared account or unencrypted protocol is acceptable because the device is “inside” the plant.
- Do not make cloud-to-PLC write-back the default. A command path is a separate, higher-risk design.
Step 1: inventory and classify every asset and flow
Start with a current register, not a spreadsheet assembled from memory. Walk the plant with controls, maintenance, safety and cybersecurity owners. Record enough detail to identify what may be connected, who owns it and what failure would mean.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Record | Why it matters |
|---|---|
| Asset type, manufacturer, model and unique identifier | Determines driver support, update method and replacement plan. |
| Firmware or software version | Reveals security advisories, compatibility limits and unsupported versions. |
| Physical location and network segment | Allows a firewall rule and an incident responder to find the device. |
| Owner and maintenance contact | Provides approval and escalation paths for changes. |
| Safety or production dependency | Sets the acceptable outage, test window and rollback method. |
| Supported protocol and interface | Confirms whether the proposed gateway can read the device without an unsafe retrofit. |
| Data items, units, quality flags and timestamps | Prevents ambiguous analytics and identifies unnecessary exports. |
| Required sampling rate, latency and retention | Separates telemetry needs from real-time control requirements. |
| Existing inbound and outbound connections | Exposes undocumented trust paths before a new one is added. |
For each candidate data flow, document the source, destination, direction, protocol, port, expected rate, business purpose and owner. Mark whether it is read-only telemetry, a configuration action, an operator command or a safety-related function. If nobody can explain why a flow exists, do not carry it into the new design.
Step 2: define data and command boundaries
Start with the smallest useful telemetry set
List the measurements the IIoT application actually needs. Define names, units, scaling, quality states, timestamps, sampling interval and ownership before configuring a driver. Exporting every available tag increases attack surface, storage cost and the chance that sensitive process information leaves the site.
Rank #2
- Multiple Internet access methods is offered: Global frequency LTE 4G/3G & Ethernet port & ADSL.
- Router fucntion is supported: Routing, VPN and firewall.
- Super Powerful Edge Computing Capabilities
- Support graphical programming (Node-RED) to quickly develop edge computing functions to meet unique functional requirements.
- Suitable for a variety of industrial IoT scenarios, supporting Modbus RTU/TCP protocol conversion and other popular PLC common protocols.
Treat write-back as an exceptional capability
Most dashboards and condition-monitoring applications need outbound telemetry, not control. Keep safety interlocks, closed-loop control and time-critical logic local. If a business process requires a command from the platform, specify the exact command, permitted range, approval sequence, operator indication, timeout, audit record and safe state when communications fail. Test it with the asset owner and safety authority; never enable a generic “write all tags” feature.
Step 3: choose an OT edge or industrial IoT gateway
Select the gateway only after the inventory and boundary are defined. A product that speaks to the cloud but cannot preserve the plant’s timing, quality flags or maintenance model is not a secure integration.
| Capability to verify | Questions for the supplier and integrator |
|---|---|
| Equipment connectivity | Does it support the actual PLC, SCADA, DCS and sensor interfaces, firmware versions and data types in the register? |
| Data semantics | Can it retain units, timestamps, quality flags, scaling and source identity without silent conversion? |
| Identity and keys | Can each gateway and service use a unique certificate or key, with protected storage, rotation and revocation? |
| Transport security | Is encryption and mutual authentication supported for the selected platform connection? |
| Segmentation | Can it run in the intended OT segment or DMZ and integrate with the plant’s firewall policy? |
| Store-and-forward | How much data can it buffer, where is it stored, and what happens when the WAN or cloud is unavailable? |
| Local behavior | Does a platform outage leave the process operating safely without requiring cloud instructions? |
| Updates and vulnerabilities | What is the patch process, support lifetime, security-advisory process and rollback method? |
| Availability and environment | Are redundancy, industrial temperature, vibration, power-loss recovery and any hazardous-location requirements covered? |
| Auditability | Can it log authentication, configuration, firmware, policy and data-flow changes and export those logs to monitoring? |
| Access model | Can supplier support be time-limited, approved, recorded and disabled when the session ends? |
| Platform integration | Is the target IIoT platform integration documented for the required identity, data model and lifecycle operations? |
When policy enforcement and routing need a dedicated boundary, evaluate an industrial firewall or OT network-security appliance separately from the gateway. Confirm every claimed feature against current manufacturer documentation and a plant-specific test; a product label or certification does not prove that the design is safe for your process.
Step 4: segment networks and write narrow rules
Separate control, supervisory operations, enterprise and cloud connectivity. Place the gateway where an OT engineer can maintain it without disturbing deterministic traffic, commonly in an operations segment or industrial DMZ selected by the site’s architecture. Use firewalls or equivalent enforcement points at each boundary.
- Draw the intended path from each source device to the gateway and from the gateway to the platform.
- For every path, record source and destination identity, address, port, protocol, direction and business owner.
- Allow only those documented flows. Deny everything else by default.
- Prevent routing from the cloud or enterprise network directly to control devices.
- Separate management access from telemetry. Require a controlled, authenticated administrative path with approval and logging.
- Review rules with controls engineering before deployment so filtering cannot break required timing or fail-safe behavior.
- Alert on a new protocol, destination or rate rather than silently permitting it.
Do not rely on network separation alone. A compromised gateway, stolen credential or misconfigured route can defeat a diagram that is not enforced and monitored.
Rank #3
- SATELLITE CONNECTIVITY WHERE OTHERS FAIL: Eliminate dead zones in Agriculture, Forestry, and Mining. Unlike standard LoRaWAN or Cellular networks that require nearby gateways, the Hestia A1 connects directly to the 3GPP NTN Satellite network for deep mountains or open oceans where terrestrial signals cannot reach
- MODBUS PROTOCOL COMPATIBILITY: Built as Modbus Slave Device, Hestia can be connected to most Modbus IoT Host systems to enable satellite connectivity for industrial applications
- PLUG-AND-PLAY VIA RS485/MODBUS: Simple Python script integration with Python samples for Modbus/MQTT available on GitHub. Open custom code architecture provides flexibility for developers without black box limitations
- INCLUDES 3-MONTH SATELLITE DATA PLAN (30KB): Start your remote monitoring project immediately with a free 30KB / 3-Month satellite data plan via the CeresGate platform (Email registration required). Comes with Python sample code on GitHub for easy integration with Raspberry Pi, Linux, and Modbus devices
- TWO-WAY SATELLITE COMMUNICATION & CONTROL: Supports bidirectional data transmission allowing you to receive telemetry from remote sensors and send commands back to control equipment such as opening valves or resetting devices from the cloud without needing complex LoRaWAN infrastructure
Step 5: establish identity, encryption and credential control
Give gateways, services and devices unique identities wherever the equipment supports them. Prefer certificate- or key-based authentication over shared passwords. Keep private keys in protected storage, restrict who can administer them, and maintain an inventory with owner, issue date, expiration, renewal method and revocation status.
Recommended Free Tools
- Use authenticated encryption for data in transit between the gateway and platform.
- Use separate accounts and permissions for collection, administration and any command function.
- Grant the minimum read or write rights required for each data set.
- Disable unused interfaces, services, accounts and protocols.
- Replace default credentials before connecting equipment.
- Define rotation and emergency-revocation procedures and test them before certificates expire.
- Synchronize clocks using a plant-approved time source; reliable timestamps are needed for logs, event ordering and certificate validation.
- Store secrets outside source code, scripts and operator notes.
Plan for credential failure. A gateway should fail in a defined, safe way when a certificate expires or a key is revoked; operators need a documented renewal or isolation procedure that does not require bypassing the firewall.
Step 6: normalize, minimize and buffer the data
Create a tag or data model that states the source, unit, quality, timestamp and ownership of every value. Preserve the original measurement where transformations are necessary so an analyst can distinguish a sensor fault from a conversion error. Apply filtering and sampling at the edge when the platform does not need raw high-frequency data.
Configure store-and-forward for expected WAN or cloud outages. Set a retention limit, disk-protection policy and replay behavior, and verify that a backlog cannot flood the network when service returns. The process must continue safely without cloud availability; buffering is for telemetry continuity, not a substitute for local control.
Step 7: monitor, log and govern changes
NIST’s 2022 manufacturing work describes controls that complement segmentation: behavioral anomaly detection, application allowlisting, file-integrity checking, change-control management, and user authentication and authorization. Apply the controls that fit the asset’s operating constraints and document exceptions.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- 【Built-in 4G LTE Module】 With a standard SIM card slot that supports the 4G LTE network. It can move into 4G LTE wireless network if the Ethernet Internet fails, in order to ensure constant data transmission in the critical facilities. (Not support Verizon Network in the US)
- 【Industrial Hardware】 Qualcomm QCA9531 chipset provides stable performance, it is commonly used within the industry, which is perfect for industrial users to avoid breakdown. The Built-in hardware watchdog ensures the stability. It’s dedicated hardware that can detect and trigger a processor reset if necessary.
- 【Open Source & Secure】 OpenWrt pre-installed. Perfect for developers or IoT integration development. It supports 30+ VPN service providers, including OpenVPN & WireGuard.
- 【Compact Design】 Its aluminum alloy shell, optional wall-mounted design, and wide range of operating temperature are designed for easy installation, storage, and operation in tough industrial environments.
- 【Easy Configuration】 Supports AT command, manual/automatic dial number, and signal strength checking in our new admin panel for better management and configuration.
- Log successful and failed authentication, privilege changes and certificate events.
- Log gateway configuration, firmware, policy, driver and data-model changes with time and operator identity.
- Record new assets, new destinations, unexpected protocols, abnormal data rates and unauthorized write attempts.
- Use application allowlisting where the platform and device support it without disrupting operations.
- Check critical files or configurations for unauthorized change.
- Review vulnerabilities and patches against the asset’s support status, maintenance window and safety assessment.
- Send logs to a protected monitoring system, restrict access to them and define retention and review responsibilities.
Formal change control should identify the requested change, risk, approver, test evidence, maintenance window, rollback and post-change verification. Emergency changes need an equivalent retrospective review.
Step 8: validate before production
Use a lab, digital test environment or scheduled maintenance window with representative PLC, SCADA and gateway behavior. Do not prove a cloud connection by experimenting on a live safety function.
- Verify that only the approved tags leave the plant and that the platform rejects unknown identities.
- Confirm encryption, certificate validation, clock behavior and failure on an expired or revoked credential.
- Disconnect the WAN, cloud service and gateway in turn. Verify that control remains local, alarms behave correctly and buffered telemetry follows the documented policy.
- Attempt an unauthorized route, port, protocol and write operation. Confirm that each is blocked and logged.
- Restore a gateway backup and platform configuration on replacement hardware; measure the recovery time.
- Test firmware, driver and policy rollback using the same approval path as a production change.
- Exercise incident isolation: remove the gateway from service, preserve logs, notify owners and return the process to a safe operating mode.
- Have asset, operations, safety and cybersecurity owners sign the acceptance record.
Record observed latency, data loss, resource use and operator actions. A test that passes only when an engineer manually bypasses a control is not a production-ready test.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Operate the connection through its full lifecycle
Maintain the asset register, network diagram, data-flow list, gateway configuration backup, certificate inventory, supplier contacts and recovery objectives. Reassess after firmware, topology, process, gateway, platform or ownership changes. Remove identities and firewall rules when equipment is retired.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Include the connection in procurement and supplier review from the beginning. CISA’s 2020 IoT acquisition guidance recommends considering connected-device security during acquisition, vendor evaluation and the full lifecycle. Ask for supported versions, vulnerability notification, update signing, end-of-support dates, remote-access controls, data handling and evidence needed by the plant’s risk process.
Best Value
- 【SMART 4G TO WI-FI CONVERTER】Come with a standard nano-SIM card slot that can transfer 4G LTE signal to Wi-Fi networking. Up to 300Mbps (2.4GHz ONLY) Wi-Fi speeds. It can move into a 4G LTE wireless network if the Ethernet Internet fails, in order to ensure constant data transmission.
- 【OPEN SOURCE & PROGRAMMABLE】OpenWrt pre-installed, unlocked, extremely extendable in functions, perfect for DIY projects. 128MB RAM, 16MB NOR + 128MB NAND Flash. Dual Ethernet ports, USB 2.0 port, Antenna SMA mount holes reserved.
- 【SECURITY & PRIVACY】OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. With our brand-new Web UI, you can set up VPN servers and clients easily. IPv6, WPA3, and Cloudfare supported. Level up your online security.
- 【Easy Configuration with Web UI and GoodCloud】GoodCloud allows you manage and monitor devices anytime, anywhere. You can view the real-time statistics, set up a VPN server and client, manage the client connection list, and remote SSH to your IoT devices. The built-in 4G modem supports AT command, manual/automatic dial number, SMS checking, and signal strength checking in Web UI for better management and configuration.
- 【PACKAGE CONTENTS】GL-XE300-AF 4G LTE Portable IoT Gateway (2-year Warranty) X1, Ethernet cable X1, 5V/2A power adapter X1, User manual X1, Quectel EC25-AF 4G module pre-installed. Please refer to the online docs for first set up.
How to compare gateway and platform options
No single model can be recommended without the PLC types, protocols, safety level, geography, network design and target platform. Use a scored comparison based on the following decision axes:
| Decision axis | What a good answer includes |
|---|---|
| Protocol coverage | Documented support for every required device and version, including read behavior, writes and quality states. |
| One-way versus bidirectional operation | Read-only telemetry by default; explicit controls and approvals for any command path. |
| Security architecture | Unique identities, certificate lifecycle, encrypted transport, least privilege and protected secrets. |
| Boundary integration | Clear firewall placement, narrow rule requirements and support for the site’s segmentation model. |
| Outage behavior | Documented buffering, replay, disk limits and safe local operation without cloud access. |
| Performance impact | Measured effect on device CPU, network load, latency and deterministic traffic under the intended sampling rate. |
| Monitoring | Auditable authentication, configuration, firmware, policy and data-flow logs with alert integration. |
| Resilience | Backup, restoration, redundancy, power-loss recovery and a tested replacement process. |
| Lifecycle support | Patch cadence, vulnerability disclosure, support period, rollback and end-of-life commitments. |
| Physical suitability | Environmental, power, vibration and hazardous-location requirements for the installation. |
| Supplier access and data handling | Time-limited support access, approval records, data residency and clear ownership of logs and telemetry. |
| Total operating effort | Licensing, integration, certificates, monitoring, maintenance windows, training and recovery—not just purchase price. |
Standards and accountability
Use NIST SP 800-82 as an OT security baseline and map controls to the asset owner’s risk assessment and applicable regulation. NIST cites ISA/IEC 62443 as a reference for industrial automation and control-system security. Select the applicable parts for zones and conduits, system requirements, component requirements and secure development or supplier evidence.
Standards organize requirements; they do not automatically make a product, certification level or architecture mandatory for every plant. The asset owner remains responsible for accepting risk, and controls, safety and cybersecurity personnel must agree on the operating limits and test evidence.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors“This document provides guidance on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements.”
— National Institute of Standards and Technology, Guide to Operational Technology (OT) Security, 2023
Quick Recap
Bestseller No. 1Bestseller No. 2Bestseller No. 4
Troubleshooting common connection failures
| Symptom | Likely causes | Safe response |
|---|---|---|
| No telemetry reaches the platform | Blocked egress rule, wrong identity, expired certificate, clock error or unsupported driver | Check gateway and firewall logs, identity status and time synchronization; do not open broad ports as a test. |
| Values arrive with wrong units or timestamps | Scaling, tag mapping, time-zone or quality-flag conversion error | Compare the source definition with the gateway data model and correct the mapping in a controlled change. |
| PLC or SCADA performance degrades | Sampling is too frequent, polling is inefficient or traffic shares a deterministic segment | Reduce collection scope and rate, move brokering to the intended operations zone and have controls engineering verify load. |
| Backlog floods the network after an outage | Unbounded buffer or unrestricted replay rate | Apply storage and replay limits, prioritize recent data and test recovery behavior before reconnecting production. |
| Certificate renewal fails | Missing time source, unreachable enrollment service, wrong trust chain or undocumented ownership | Use the tested renewal runbook; if renewal cannot be completed, isolate the path safely rather than disabling validation. |
| An unexpected command or protocol appears | Misconfiguration, compromised credential, new software or unauthorized remote access | Block the flow, preserve logs, notify the incident owner and follow the isolation and recovery procedure. |
| Gateway replacement takes too long | No tested backup, unclear configuration ownership or unavailable supplier support | Restore a known-good backup in a test or maintenance window and update recovery objectives and contacts. |
Production readiness checklist
- Every connected asset, owner, firmware version, location and safety dependency is recorded.
- Each exported measurement has a documented purpose, unit, quality state, timestamp and retention need.
- Control, operations, enterprise and cloud zones are separated and enforced.
- Firewall rules list exact sources, destinations, ports, protocols and directions; direct internet access to control devices is blocked.
- Gateway and service identities are unique, least-privileged, encrypted and covered by rotation and revocation procedures.
- Unused interfaces and services are disabled, and secrets are protected.
- Store-and-forward limits and local fail-safe behavior have been tested.
- Authentication, configuration, firmware, policy and data-flow changes are logged and monitored.
- Backups, rollback, certificate expiry, incident isolation and restoration have been exercised.
- Asset, safety, operations and cybersecurity owners have approved the production change.
- The supplier’s patch, vulnerability, support and remote-access commitments are documented.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
