A batch of machines running older systems has to stay online. They need to reach other machines on the local network and one specific license server, and nothing else on the internet. Consumer routers generally provide only parental controls built for home use, which cannot produce a per-device IP whitelist, so this requirement usually ends up in the firewall rule table of an industrial cellular Wi-Fi router. The idea fits in one sentence: the device is not cut off from the network, only the traffic it needs is allowed, everything else is rejected.
Before opening the configuration, three sets of information are needed: the external addresses the device must reach on its own (license server, time synchronization, upgrade source) together with the matching ports and protocols; the internal machines it must reach; and whoever needs to reach it in return. The third group can go over a VPN tunnel and does not belong in the whitelist.
The list has three sources: the port description in the device manual, the port list provided by the license server vendor, and the outbound records in the router log. The first two describe what the device should reach, the third shows what it actually reaches. Compare the two and most gaps close.
The flow below comes from the official configuration example for the USR-G806w. Menu names follow the actual firmware.
The official example provides a pair for comparison: the device on the whitelist (a phone at 192.168.1.128 in the example) browses normally, while a device left off the list (a computer on the same network) cannot open any external page. Before going live, test one device from each side: the listed device reaches the internet, the unlisted device does not, and the listed device can still reach other machines on the local network. All three checks passing means the rule set is correct.
With four devices there are four allow rules, and still a single catch-all reject at the bottom. No per-device reject rule is needed. When several devices reach the same license server, the destination is identical and only the source differs, so the first rule can be copied and renamed. Rule count grows with device count: twenty devices means twenty allow rules plus one reject, which is why rule names should make the matching device obvious. Troubleshooting later goes much faster that way.
Order. Rules are matched in sequence and stop at the first hit, so allow rules must come before the reject rule. Reversed, the devices on the whitelist get cut off along with everything else.
Matching field. Source IP and source MAC are mutually exclusive. When matching by MAC, leave the source IP empty; filling in both will not match.
Destination zone. Some firmware splits WAN into wired and cellular entries. Selecting only one leaves the whitelist uncovered after a link switchover, so the option that covers all forwarding zones is the simpler route.
If the license server is reached by domain name, or its address changes, the access restriction feature in the firewall can be used instead: set the mode to whitelist, add the permitted domains one by one, then apply. One default is worth noting. Selecting whitelist without adding any rule leaves the list empty, which blocks every domain, so it should not be enabled before the entries are in place.
Whether a router can carry per-device whitelists depends first on how far the firewall rule fields are broken down, meaning source MAC, source IP, destination address, port and protocol, and second on whether rule order can be changed. If the fields are incomplete or the order is fixed, this kind of policy cannot be built.
Port count follows device count. Four devices plus one uplink needs five Ethernet ports, and the speed should be gigabit. The USR-G809s provides 2×WAN/LAN + 6×LAN + 2×SFP, with the RJ45 ports auto-negotiating at 10/100/1000 Mbps and SFP as gigabit optical; an aluminum housing rated IP40, mounted on a DIN rail or placed flat; a DC9-60V supply with reverse-polarity protection on the industrial terminal block; an operating range of -25 to 75°C, a built-in watchdog, and EMC meeting Grade 3B of the national standard. It also carries Wi-Fi 6 (2.4 GHz and 5.8 GHz, up to 256 clients), which can be turned off where wireless is not needed.
For 4G uplink only, with the devices all in one small cabinet, the USR-G806w is more compact: a Qualcomm platform, three Ethernet ports (one WAN plus two LAN, reconfigurable as three LAN), a -20 to 70°C operating range, redundant power from both the terminal block and the DC jack, software and hardware watchdogs, and DIN rail or wall mounting. On certification, several PUSR models have passed the EU EN 18031 cybersecurity standard, so it is worth confirming whether the target model is on that list.
Remote management also belongs in the decision. A whitelist gets adjusted after it goes live, and if parameters, reboots and firmware upgrades can all be handled from the management platform, a rule change no longer means a site visit.
Building a per-device IP whitelist is really converting "can reach the internet" into "can reach only these addresses". Three things are required: list the addresses and ports each device must reach, create one allow rule for it, and add a catch-all reject at the end; then save, reboot, and test one device from each side. For older equipment that cannot be upgraded and cannot run security software, the only place left to act is the network egress, and that is where an industrial cellular Wi-Fi router delivers its most concrete security value.
