A machine leaves the factory fully commissioned and then stalls at one gate: the customer's IT acceptance review. The HMI or data portal that rides along with the machine was built by a third party years ago, the source code is not available, login is a username and a password and nothing more, and it cannot join the identity system the customer just rolled out. This comes up often in the field: a customer with fewer than 500 users across four sites, warehouse, shipping, receiving, and packaging staff sharing terminals, everyone signing in to old portals supplied by their business customers, single sign-on ruled out, and browsers holding on to the passwords so that the next person at the desk clicks straight through.
A system that cannot be changed does not have to be left exposed.
Modern authentication answers the question of who is accessing a system. A legacy system cannot answer it. Every access, however, has to cross the network first. Move that check onto a cellular gateway placed in front of the legacy system, and the question turns into who is allowed to reach it at all — the test shifts from an account to a source address, a port, and a tunnel.
The legacy system stays untouched, and control comes back to the machine builder.
Shrink the set of machines that can reach it.Build allow rules on the gateway by source IP or source MAC so that only registered terminals reach the legacy system, and deny everything else by default. Source IP and source MAC are either-or: fill in one and leave the other blank, because filling both stops the rule from matching. Order matters — allow rules first, a catch-all deny rule last — and changes take effect only after a restart. Acceptance testing is simple: devices on the list connect, devices off the list do not.
Put remote access behind a tunnel first.When remote maintenance is needed, have the maintenance side dial into the gateway over VPN and then reach the legacy system on its internal address. The legacy system only ever sees connections arriving from the inside, and no port is exposed on the public side. This covers the part of the risk that weak accounts leave open: anyone coming through is checked once at the tunnel entrance. Customer IT departments usually agree to their own tunnel and nothing else, so having the gateway join as a client tends to clear acceptance faster than asking them to stand up a new one.
Control what the legacy system calls out to.A legacy system that only needs to push data to one order system or one database should have that destination address or domain pinned on the gateway, with all other outbound traffic denied. Where the destination is not a fixed IP, a domain allowlist is the alternative, and there is a default worth knowing: enable the allowlist and add no rules, and no domain gets through at all, so verify immediately after applying the change. An old portal being used as a staging point to scan outward is the path most often overlooked here, especially when the browser is still holding its password.
Keep a record of access and data anomalies.Let the gateway log connections and value changes, and raise an alarm the moment a threshold is crossed rather than waiting for the platform to poll. Who connected at what time, and when a value jumped, stays available after the fact. Logs and alarms can then go up to the existing platform over standard MQTT or TCP, with no second system to build.
For a machine builder, none of these four belongs at the customer's site.
Take inventory.What does the legacy system actually talk to — how many destination IPs, which ports, which protocols, whether any fixed domain names are involved. That list is the basis for every rule that follows.
Write the rules.Build the allow rules and the catch-all deny rule from that list, and set up the outbound allowlist at the same time. When one model ships to several customers, keep the rule set as a template and change only the destination address and port; that removes a good deal of rework on site.
Pre-stage the tunnel.VPN parameters, how accounts get issued, how often certificates rotate — settle all of it before shipping and put it in the delivery documentation.
Leave a way back.When parameters get scrambled, there needs to be a reference point. Many gateways have a Reload button that restores factory settings when held down, but a backup copy of the rules written into that particular machine belongs in the documentation.
USR-M300fits machines that still need acquisition and control. Dual-core processor up to 1.2 GHz, Linux; one RS232/485 port plus one RS485 port, one WAN/LAN Ethernet port plus one LAN port, 2 DI, 2 DO, and 2 AI (current); serial, Ethernet, and I/O acquisition run in parallel with up to 2,000 data points, and I/O extends further with DI, DO, AI, and AO modules; Modbus RTU/TCP conversion plus common PLC protocols; Internet access over LTE 4G/3G, Ethernet, or ADSL, so a site with cabling runs on Ethernet and a site without it runs on cellular, with the two links backing each other up; routing, VPN, and firewall built in; Node-RED graphical programming, with reporting conditions, reporting channels, and alarm thresholds configurable, and connections to PUSR Cloud, Alibaba Cloud, AWS, ThingsBoard, and Azure; -25 to 75°C, DIN-rail or wall mounting, and a Reload button for restoring factory settings.
USR-G816fits sites with no usable cabling, where the machine has to reach the network over cellular on its own. One RS232/485 terminal block with baud rates from 1200 to 460800; one WAN port, configurable as LAN, plus three gigabit LAN ports; dual SIM, one of which can be a built-in eSIM; DC 9-36V wide input with reverse polarity protection; metal housing rated IP30, DIN-rail or wall mounting; VPN support for IPSec, OpenVPN, PPTP, L2TP, and GRE; built-in watchdog; ESD, EFT, and surge immunity all at level 3.
The part of authentication that cannot be fixed gets covered at the network layer: leave the legacy system alone wherever it can be left alone, and work on the door in front of it. Choosing a cellular gateway for this job comes down to two questions — whether tunnels, rules, and alarms can all be handled on one device, and whether that device will keep running under the power, temperature, and mounting conditions at the site.
