IOT as network router

Hello Frank,

To be honest it seems like an acchievable, but not very suitable task for the IOT2050 (EDIT: in case the network on the left hand side uses Safety). In this case a hardware firewall (e.g scalance) could be more suitable for complete isolation of the PROFINET network.

If you want to go this way regardless, I think the easiest option is to work with iptables. It can be integrated into a newer version of the IOT2050 image, which you can build from the master branch. Notice that the iptables compatability was added in October 2020 so the example image from SIOS does currently not support it. 

Best Regards!

Hello Frank,

So far I have come just as far as you with iptables. This rule you used:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Allows me to access the internet and devices on the other network and vice versa but until now none of the rescrictions I added worked. I added a DROP rule for a different subnet but was still able to access the internet when changing my IP to this specific subnet. Will need some more time to investigate.

If anybody on here has more experience, always highly welcome!

Best Regards!

Hello Frank,

We now had time for a closer look into your network setup and were able to configure iptables accordingly.

Firstly, I recommend installing Webmin which provides a nice UI for handling Network and Firewall configuration. When installing Webmin over APT repository, dont forget to add the correct Architechture to /etc/sources.list

nano /etc/apt/sources.list

wget https://download.webmin.com/jcameron-key.asc
apt-key add jcameron-key.asc
apt-get update
apt-get install webmin

Afterwards the UI is reachable over https://<iot-ip>:10000, use root login of IOT!

In the section Networking->Linux Firewall, enter the Dropdown Menu Showing IPtable (NAT):

You should see your POSTROUTING rule below which you have already entered (for you the interface should be eth1) -> scroll right to see entire screenshot

Now switching back to Dropdown Menu Packet filtering, we should now be looking at the FORWARD rules. Here, based on the drawing of your network we want to do two things: 

• Only accept incoming packets from the IPC127E on eth0 (other packets shall be dropped)
• Only accept incoming packets from the PC on eth1 (other packets shall be dropped)

For this we specify one accept rule for source address 192.168.0.3/32 on incoming interface eth0, one accept rule for source address 192.168.178.40/32 on incoming interface eth1, one drop rule for incoming interface eth0 and one drop rule for incoming interface eth1.

In my case the configuration looks like this:

Make sure the rules are also in this exact order. Afterwards, scroll down and select Apply Configuration and also select Activate at boot to make rules persistent:

The configuration should now be working. In my case I did not specify any input rules. Ofc there is still room for improvement as e.g. adding input rules can save CPU consumption by dropping packets before they are forwarded.

To double-check how these rules can also be entered in terminal

nano /etc/iptables.up.rules

Hope this helps!

BR