Home / server / Questions / 1058799
Accepted
alexlev2004
Asked: 2021-03-31 01:16:12 +0800 CST

Connecting industrial devices to OPC server while keeping segregation

  • 772

We have two industrial machines (let's call them Holding and Media) with configured network addresses 192.169.0.122 and 192.169.0.123 respectively. Currently they are isolated physically although logically in same subnet. There is no option to change any config in the machines (it's very old controllers so it's near impossible without lot's of overhead). We need to connect these machines to another machine running windows 10 with OPC server and with 4 NICs. We would like to keep single machine and single OPC server if possible for lower complexity and costs (OPC server with the required drivers is costly) AND keep the machines segregated as before connection - (ZERO traffic leak between machines) - to avoid unexpected behaviors and as well for better cyber protection. The diagram is below:

Connections Diagram

What we have tried is naively configuring 2 NICs to have same subnet intending latter to add 192.169.0.123/32 route for Media and 192.169.0.122/32 for Holding to find out the way out the Windows. Using Windows Settings and NetSetMan. Seems that windows does not complain, but inspecting ipconfig and "route print" shows that only one NIC is actually properly configured.

Please suggest our alternatives, what would you do ? Thanks. Alex

windows subnet

1 Answers

  1. Best Answer

    By the way, 192.169.0.122/.123 are no private IP addresses. You should never use public addresses that you're not authorized to. Check out RFC 1918.

    There are two basic approaches:

    1. You configure a separate network (p2p, switch, VLAN) for each machine and connect one server NIC to each network (but both within the 192.169.0.120/21 subnet or larger - which subnet mask to the machines use?). Then you use explicit entries in the server's routing table with low metrics to control which destination goes out of which interface. Note that host configurations are explicitly off-topic here.
    2. You create a shared network (VLAN) but use a switch with a private VLAN aka port isolation option to inhibit traffic between the machines' ports, just permitting traffic between the server and each machine.

    I'd prefer #2 as a neater solution.

    • 1