The edge gateway's advanced built-in firewall completely separates its WAN network (company network) from its LAN network (machine network). It blocks all communication except for authorized and encrypted data verified by a valid identity certificate. This means that only authorized users can access the machine network via the IXON Cloud.

This article explains what is and what isn't remotely and locally accessible. If you're looking for information about our security in general, take a look here.

• How does it work?
• Remote accessibility
• Local accessibility

How does it work?

Every network packet contains a source address and a destination address. This is so networking components know where to send the packet to and so that the recipient knows where to send a reply to. This is essential in networking. Otherwise we won't be able to send an e-mail, look up something online, or any of the other tasks we've grown accustomed to.

The edge gateway uses this information to see where a packet is coming from (from LAN, WAN, VPN?) and going to (LAN, WAN, Internet?) and then determines whether this is allowed or not, based on its firewall rules. This is depicted in the image below.

Remote accessibility

This section discusses the accessibility when you have set up a VPN connection from a remote location. Please read How does it work? for clarification.

VPN to LAN

Traffic coming in via the VPN connection, going to the LAN network of the edge gateway, is allowed. In other words, remotely you can access all devices that are connected to the LAN network of the edge gateway (i.e. the machine network).

VPN to WAN

Traffic coming in via the VPN connection, going to the WAN network of the edge gateway, is blocked. In other words, remotely you can not access any device that is connected to the WAN network of the edge gateway (i.e. the company network).

VPN to WAN2

This only applies to the SecureEdge and SecureEdge Pro, as other models do not have a 2nd WAN port. Traffic coming in via the VPN connection, going to the WAN2 network of the edge gateway, is blocked. In other words, remotely you can not access any device that is connected to the WAN2 network of the edge gateway (i.e. the OT network).

Local accessibility

This section discusses the accessibility when you are on-site and your computer is connected to either the company network or the machine network (depending on the situation). Please read How does it work? for clarification.

WAN to LAN

Traffic coming in via the WAN network, going to the LAN network of the edge gateway, is blocked by default. In other words, if you are connected to the WAN network (i.e. the company network) you can not access any device that is connected to the LAN network of the edge gateway (i.e. the machine network), with the edge gateway's default settings.

If necessary, you can add 1:1 NAT or port forwarding to allow traffic through from WAN to LAN.

WAN2 to LAN

This only applies to the SecureEdge and SecureEdge Pro, as other models do not have a 2nd WAN port. Traffic coming in via the WAN2 network, going to the LAN network of the edge gateway, is blocked by default. In other words, if you are connected to the WAN2 network (i.e. the OT network) you can not access any device that is connected to the LAN network of the edge gateway (i.e. the machine network), with the edge gateway's default settings.

If necessary, you can add 1:1 NAT or port forwarding on the local web interface to allow traffic through from WAN2 to LAN.

LAN to WAN

Traffic coming in via the LAN network, going to the WAN network of the edge gateway, is blocked by default. In other words, if you are connected to the LAN network (i.e. the machine network) you can not access any device that is connected to the WAN network of the edge gateway (i.e. the company network), with the edge gateway's default settings.

If necessary, you can allow access to the company network to allow traffic through from LAN to the company network.

LAN to WAN2

This only applies to the SecureEdge and SecureEdge Pro, as other models do not have a 2nd WAN port. Traffic coming in via the LAN network, going to the WAN2 network of the edge gateway, is blocked by default. In other words, if you are connected to the LAN network (i.e. the machine network) you can not access any device that is connected to the WAN2 network of the edge gateway (i.e. the OT network), with the edge gateway's default settings.

If necessary, you  can allow access to the OT network on the local web interface to allow traffic through from LAN to the OT network.

LAN to Internet

Traffic coming in via the LAN network, going to the internet, is blocked by default. In other words, if you are connected to the LAN network (i.e. the machine network) you can not access the internet, with the edge gateway's default settings.

If necessary, you can allow access to the internet to allow traffic through from LAN to the internet.