A recent roundup of new industrial devices in a technical community showed industrial-grade routers and switches taking up a fair share — equipment once seen mainly in power and transportation projects is now finding its way into ordinary plants and production lines. Among manufacturers planning to deploy industrial cellular routers in volume, one assumption circulates widely: the PLC sits on the internal network, so it does not matter if the router gets compromised. That assumption deserves a closer look.
The idea of a "secure internal network" rests on a clear line between inside and outside — and the industrial cellular router is precisely that line. One side connects to a cellular or broadband public network; the other connects to the LAN where PLCs, cameras, and serial devices live. Once the router falls, an attacker gains more than a router: they gain a position at the internal network's front door, from which internal addresses, traffic, and open ports are all visible. A PLC that is not directly exposed to the public internet is not far from it either — the only thing in between is a compromised router.
The typical attack path has three steps: scan the public network for devices with open management interfaces; log in with weak credentials or a firmware exploit; use the router as a pivot into the internal network. Defense in depth means setting up a barrier at each step, so no single failure is fatal. Devices managed through a cloud platform add one more entry point to the inventory, and that channel deserves the same treatment as the router itself.
In practical configuration terms: disable unused remote management entries and keep the management interface off the public-facing side; allow only the ports and addresses the business requires and deny everything else by default; turn off DMZ hosting unless it is needed — DMZ maps every port of one internal device onto the public network, and leaving it on by mistake costs more than opening no port at all.
A quick self-check takes one phone: connect from the cellular network and try to reach the router's management page. If the login screen loads without a tunnel in between, the entry point is open to anyone scanning the same network.
All remote O&M traffic goes into an encrypted tunnel, so management channels exist only inside the tunnel and no login entry is visible from the public network. This also addresses eavesdropping on data in transit over cellular networks. Two things matter at selection time: whether the protocol set is complete (IPSec, OpenVPN, L2TP, GRE, and others), and whether certificate-based authentication is supported — certificates replace static passwords and block both credential-stuffing and weak-password attacks in one move.
Put the PLC control network, the video surveillance network, and the office network into separate VLANs. If a camera on the surveillance segment is compromised, its traffic still cannot reach the control segment. Cameras deserve particular attention here: they are among the most frequently exploited endpoints on industrial sites, and they have no business talking to a PLC under any normal operating condition. Where cross-segment communication is required, permit only specific host pairs and ports, with the router performing controlled forwarding.
Configure source/destination IP, port, and protocol-level filter rules on the router: the SCADA server may reach the PLC; every other segment is denied by default. MAC binding stops unauthorized devices from being plugged in. The criterion is a single one — deny everything, then allow the minimum set the business needs, rule by rule. A side benefit shows up during audits: with all inter-segment rules living in one router config, the entire access policy can be reviewed in one place instead of being scattered across individual devices.
The value of defense in depth lies not in any single layer but in redundancy: if a firewall rule is missed, the management interface still hides inside the VPN tunnel; if a device in one VLAN falls, the ACL still blocks its path to the PLC. A single mistake no longer means total exposure — which is far more dependable than betting everything on one strong firewall. None of the four layers requires exotic equipment; what they require is being configured, in order, on the router that is already sitting at the boundary.
Measured against this framework: the industrial USR-G816 5G cellular router supports the full VPN suite — IPSec, OpenVPN, PPTP, L2TP, and GRE. Its OpenVPN implementation can act as a client to three servers simultaneously while also serving as a server itself, which makes it easy to bring distributed sites into a single tunnel at headquarters. With a wide operating range of -35°C to 75°C, a hardware watchdog, and automatic WAN failover, it fits high-bandwidth, geographically scattered production sites.
The USR-G809s gigabit edge router supports the same five VPN protocols, with firewall, NAT, and DMZ management built in, plus Ethernet-plus-cellular dual-link backup — a good fit as the aggregation gateway on the plant side. For 4G deployments, the Qualcomm-based USR-G806w is another option, with one-click import of .ovpn config files and PKCS#12 certificates for OpenVPN, putting certificate authentication to work out of the box.
"The PLC is on the internal network" describes network topology, not a security measure. Configure the industrial cellular router as the boundary device it is — firewall to shrink the entry points, a tunnel to carry management traffic, VLANs to contain lateral movement, and ACLs to enforce least privilege. With all four layers in place, a fallen router no longer means a fallen production line.
