If your factory has several—or even dozens of—serial to Ethernet converter, there is an important network-design question that is easy to overlook:

Should these devices be connected directly to the main industrial LAN, or should they be placed on a separate VLAN?

There is no single answer for every installation. However, when serial servers are connected to PLCs, meters, controllers, access-control equipment, energy devices, or other industrial equipment,placing them on a dedicated VLAN is often a practical way to improve network segmentation and access control.

The reason is straightforward: a device that originally communicated only through RS232 or RS485 becomes an IP-based network device once it is connected through Ethernet.

Why Should Serial Servers Be Considered Separately?

Traditional RS232/RS485 devices are normally not directly exposed to an IP network.

After installing aserial to Ethernet converter, the communication path may look like this:

PLC / Meter → RS485 → Serial Server → Ethernet → Industrial Switch → Factory Network

The device that previously could only be accessed through a serial connection now has a network connection.

Recent security research concerning serial-to-Ethernet devices has identified vulnerabilities in some related products, including issues such as authentication bypass and denial-of-service vulnerabilities. The research also highlights that these devices can be deployed in industrial and other critical environments.

This does not mean that every serial server has the same vulnerabilities.

The more practical question is:

If one serial server is compromised, how many other devices can it reach from its network segment?

This is where VLAN segmentation becomes useful.

What Does a VLAN Actually Solve?

A VLAN does not "fix" a device vulnerability.

It addresses a different problem:

limiting the network access available to a compromised device.

For example, an industrial network could be divided into:

• VLAN 10: Office computers
• VLAN 20: PLCs and control systems
• VLAN 30: Serial servers
• VLAN 40: Surveillance equipment
• VLAN 50: Engineering and maintenance devices

The serial servers are placed in VLAN 30.

However, simply creating VLAN 30 does not automatically make the devices secure.

The important part is to use switches, routers, or firewalls to control:

Which devices can access VLAN 30?
Which devices can VLAN 30 access?
Which ports and protocols are allowed?

For example:

This is very different from putting everything into one unrestricted network:

In the second design, if one device is compromised, there may be more opportunities for lateral network access.

When Should You Consider a Dedicated VLAN?

1. You Have Multiple Serial Servers

If there is only one device in a very small and simple network, a dedicated VLAN may not always be necessary.

But if a production area has 10, 20, or more serial servers, network segmentation becomes much more practical.

For example:

VLAN 30 = Serial Device Network

When another serial server is added later, it can simply be connected to the appropriate switch port and assigned to the same network segment.

2. Serial Servers Connect to Critical Industrial Devices

If aserial to Ethernet converterconnects to PLCs, drives, energy meters, industrial controllers, or other important equipment, it is generally better not to place it in a completely open Layer 2 network together with ordinary office devices.

A VLAN can serve as the first layer of network segmentation.

3. Remote Access to Serial Devices Is Required

Many serial to Ethernet converters are designed to allow remote computers to access RS232/RS485 devices over TCP/IP.

For example, the USR-TCP232-410s supports RS232 and RS485 interfaces and TCP/UDP network communication. It can also be used in applications involving Modbus RTU and Modbus TCP conversion.

In this type of deployment, the important question is not simply:

"Can the device connect to the network?"

It is:

"Who should be allowed to access the serial server?"

A VLAN combined with firewall rules can be used to allow access only from designated SCADA servers, engineering workstations, or data acquisition systems.

A Practical Deployment Method

If you are designing a new industrial network, you can approach the setup step by step.

Step 1: Assign a Dedicated IP Range

For example:

This keeps the serial servers separate from office computers and other general-purpose IT devices.

Step 2: Allow Only the Required Communication

Suppose the SCADA server uses:

The network could be designed like this:

Ordinary office PCs can be denied access to this VLAN by default.

Step 3: Separate Management Access From Application Traffic

Do not give the entire office network access to the serial servers simply because engineers need to configure them.

A more controlled approach is:

Maintenance PC → Allowed to access device management

SCADA → Allowed to access required application ports

Ordinary office PCs → Access denied by default

This reduces the possibility that a compromised office computer can directly reach the serial device network.

More VLANs Are Not Always Better

Suppose a small installation contains only:

Creating multiple VLANs for just these three devices could add unnecessary management complexity.

A more practical decision should consider:

device criticality + network size + remote-access requirements + network management capabilities

Rather than simply assuming that every serial server must have its own VLAN.

You Still Need to Secure the Device Itself

Network segmentation does not replace device-level security.

When evaluating aserial to Ethernet converter, you should also consider:

• Whether access control is supported
• Whether remote management can be secured
• Whether firmware can be updated
• Whether unnecessary services can be disabled
• Whether secure communication is supported when required
• Whether access can be restricted to authorized network nodes

For example, the USR-TCP232-410s provides RS232 and RS485 interfaces, TCP/UDP network communication, and security-related communication capabilities. Its product specifications also cover industrial operating conditions and network isolation features.

In practice, the approach can be summarized as:

Device security reduces the chance of compromise. Network segmentation limits the potential impact if a problem occurs.

For industrial networks with multiple serial servers, both should be considered together.

So, Should You Use a Separate VLAN?

A simple way to evaluate the requirement is:

So the real question is not:

"Must a serial to Ethernet converter be placed on a separate VLAN?"

A better question is:

"If this device were compromised, which networks and devices should it still be able to access?"

If the answer is "only a few specific industrial devices," then using VLAN segmentation together with access-control rules is a practical starting point for designing the network.