Description

The WAN (corporate network) and LAN (machine network) side of the edge gateway are separated by its internal firewall. However, when you are on-site you may, for example, need internet access to look up user manuals or to have the machine send e-mails. You may also need access to the corporate network, for example, when a PLC needs to store data on a local FTP server.

You can then choose to:

Allow ALL access to corporate network
Allow ALL access to internet
Allow LIMITED access to corporate network and internet

Allow all access to corporate network or internet

Allow all devices, on the LAN of the edge gateway, full access to either the corporate network or the internet. Select one of the configuration methods below.

IXON Cloud
Local web interface

IXON Cloud

The next steps show you how to allow access via the IXON Cloud.

Go to Fleet Manager > Devices and click on your device name.
Go to Network > Firewall.

Under LANWAN, at Full access, toggle the desired option (details below).

Option	Description
Allow access to corporate network	All incoming LAN traffic with the corporate network as destination (i.e. any private IP address other than the edge gateway's LAN) will be allowed through the firewall. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access to the internet, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR.
Allow access to internet	All incoming LAN traffic with the internet as destination (i.e. any public IP address) will be allowed through the firewall. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access to the internet, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR. You do not need to turn on "access to corporate network" for internet access to work.

Option

Description

Allow access to corporate network

All incoming LAN traffic with the corporate network as destination (i.e. any private IP address other than the edge gateway's LAN) will be allowed through the firewall. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access to the internet, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR.

Allow access to internet

All incoming LAN traffic with the internet as destination (i.e. any public IP address) will be allowed through the firewall. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access to the internet, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR.

You do not need to turn on "access to corporate network" for internet access to work.

If you need to access local domains instead of local IP addresses, you need to also add a Forward DNS or disable DNS rebind protection.

You have now made the changes in the IXON Cloud, but these are not yet active in your device. You will need to push your changes to your device for them to take effect.

Temporary disconnect

After this next step, the config push, the device may temporarily disconnect and LAN communication may be temporarily interrupted while it's applying the new settings. This only takes a moment.

Click on Push config to device in the top right corner.

The edge gateway is now properly configured, but your LAN devices' network settings may also need to be changed. If these are not properly configured, they still cannot access the corporate network or internet.

Make sure the network settings on each individual LAN device is set correctly.
- If it's set to automatic / DHCP: All network settings are handled automatically.
- If it's set to manual / static: In addition to the IP address and subnet mask that you likely already configured, make sure that the edge gateway's LAN IP address is entered as both the default gateway and the DNS server.

Tip: Wi-Fi hotspot

If your edge gateway supports Wi-Fi, you can set up a Wi-Fi hotspot so you can wirelessly access the internet from you mobile phone or laptop.

Local web interface

Supported hardware

SecureEdge and SecureEdge Pro, firmware 5.9 and up (upgrade)
IXrouter3, firmware 3.19 and up (upgrade)

To allow access via the local web interface, select your edge gateway model:

SecureEdge and SecureEdge Pro

Connect your computer to one of the LAN ports.
- The local web interface is not accessible from the WAN side (Cloud port and also OT/LAN port when it's configured as WAN2).
Open a new browser tab, go to the edge gateway's LAN IP address, and log in.
- The default LAN IP address is 192.168.140.1.
- Make sure that your laptop has an IP address in the same range. You may need to configure this manually. There are many online guides on this if you need a step by step guide.
- The default username is admin.
- The default password (PW) is printed on the side of the edge gateway.
- The number of login attempts is limited per time window, in compliance with cybersecurity standard IEC 62443-4-2. By default, the number of login attempts is limited to 5 per 1 minute, replenishing a login attempt every 1 minute. We recommend you configure this to align with your corporate security policy. Do so by logging in and going to Administration > Authentication.
- You can change the password by logging in and going to Administration > Change password.
Go to Network > Firewall.
Access can be allowed per WAN port, depending on how you have your edge gateway connected. Select to port to which you'd like to allow access from the LAN side.

WAN port (Cloud port)

Go to WAN firewall > LANWAN.

At Full access, toggle the desired option (details below).

Option	Description
Allow access to private network	All incoming LAN traffic with any private IP address other than the edge gateway's LAN as destination will be allowed through the firewall. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR.
Allow access to public network	All incoming LAN traffic with any public IP address will be allowed through the firewall. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR.

Option

Description

Allow access to private network

All incoming LAN traffic with any private IP address other than the edge gateway's LAN as destination will be allowed through the firewall. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR.

Allow access to public network

All incoming LAN traffic with any public IP address will be allowed through the firewall. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR.

OT/LAN port (when it's configured as WAN2)

Go to WAN2 firewall > LANWAN2.

At Full access, toggle the desired option (details below).

Option	Description
Allow access to private network	All incoming LAN traffic with the WAN2 IP range as destination will be allowed through the firewall, if WAN2 is a private IP range. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR. Select this option if the WAN2 network is a private IP range.
Allow access to public network	All incoming LAN traffic with the WAN2 IP range as destination will be allowed through the firewall, if WAN2 is a public IP range. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR. Select this option if the WAN2 network is a public IP range. Note that the internet is NOT accessible via WAN2. The OT/LAN port in WAN2 mode is designed to be connected to an OT network that does not have internet access, enabling communication between the OT network and the machine. It is not designed and cannot be used as a secondary internet connection.

Option

Description

Allow access to private network

All incoming LAN traffic with the WAN2 IP range as destination will be allowed through the firewall, if WAN2 is a private IP range. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR.

Select this option if the WAN2 network is a private IP range.

Allow access to public network

All incoming LAN traffic with the WAN2 IP range as destination will be allowed through the firewall, if WAN2 is a public IP range. This applies to all devices in all LAN networks, which includes the default LAN network and any additional LAN networks. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access, instead create a limited access rule with that LAN network's IP range in CIDR notation as the Source IP address / CIDR.

Select this option if the WAN2 network is a public IP range.

Note that the internet is NOT accessible via WAN2. The OT/LAN port in WAN2 mode is designed to be connected to an OT network that does not have internet access, enabling communication between the OT network and the machine. It is not designed and cannot be used as a secondary internet connection.

If you need to access local domains instead of local IP addresses, you need to also add a Forward DNS or disable DNS rebind protection.
Click on Submit changes.

You have now made the changes in the edge gateway, but these are not yet present in the IXON Cloud. You will need to import these changes to the IXON Cloud to avoid unwanted configuration changes later on.

Wait a moment for the edge gateway to report its new configuration to the IXON Cloud. This usually takes less than a minute.
Go to Fleet Manager > Devices and click on your device name.
Open the sync optionsand select Import config from device.

IXrouter3

Connect your computer to one of the LAN ports.
- The local web interface is not accessible from the WAN side (Internet port).
Open a new browser tab and go to the edge gateway's LAN IP address.
- The default LAN IP address is 192.168.27.1.
- Make sure that your laptop has an IP address in the same range. You may need to configure this manually. There are many online guides on this if you need a step by step guide.
Go to Configuration and log in.
- The default password (PW) is printed on the side of the edge gateway.
- If there is no password printed on the side, this edge gateway was manufactured before the local web interface was created. That means it does not have a password and you cannot proceed using this method. Instead, use the IXON Cloud method. Additionally, once the edge gateway is online and has a VPN connection, we can configure a password for you. Please then contact us by granting us support access at Fleet Manager > Tools and tell us the serial number of the edge gateway.
- If you enter an incorrect password multiple times in a row, you'll need to wait roughly 5 minutes before you can try again. The number of attempts is limited to 5 attempts per 5 minutes.
- You can change the password by logging in and going to Account in the bottom left corner.
Go to Firewall > LAN ⇒ WAN.

Toggle the desired option (details below).

Option	Description
Allow access from all LAN devices to corporate network	All incoming LAN traffic with the corporate network as destination (i.e. any private IP address other than the edge gateway's LAN) will be allowed through the firewall.
Allow access from all LAN devices to internet	All incoming LAN traffic with the internet as destination (i.e. any public IP address) will be allowed through the firewall. You do not need to turn on "access to corporate network" for internet access to work.

If you need to access local domains instead of local IP addresses, you need to also add a Forward DNS or disable DNS rebind protection.
If you haven't already, Apply your settings.

Wait a moment for the edge gateway to report its new configuration to the IXON Cloud. This usually takes less than a minute.
Go to Fleet Manager > Devices and click on your device name.
Open the sync optionsand select Import config from device.

Allow limited access to corporate network and internet

Supported hardware

SecureEdge and SecureEdge Pro, firmware 2026.06 and up (upgrade)
IXrouter3, firmware 3.22 and up (upgrade)

To ensure a safe and protected network within the machine, you may not want to give full internet access to all devices on the LAN of the edge gateway, but rather only give internet access to devices that actually need it.

Limited access gives access to both the corporate network and the internet. This scope can be limited by defining a destination.

The full access settings Allow access to corporate network and Allow access to internet overrule any limited access rules. Meaning those should be disabled, otherwise all devices in all LAN networks will have access to either the corporate network or internet, depending on which setting is enabled.

Select one of the configuration methods below.

IXON Cloud
Local web interface

IXON Cloud

The next steps show you how to allow access via the IXON Cloud.

Go to Fleet Manager > Devices and click on your device name.
Go to Network > Firewall.
Under LANWAN, at Limited access, add limited access.

Enter the requested information (details below) and click on Add.

Field

Description

Source IP address / CIDR^*

Supported hardware

Source IP address	Source IP range (CIDR notation)
SecureEdge and SecureEdge Pro, firmware 2026.06 and up (upgrade) IXrouter3, firmware 3.22 and up (upgrade)	SecureEdge and SecureEdge Pro, firmware 2026.06 and up (upgrade) ~~IXrouter3~~ (unsupported)

Enter the source device's IP address or IP range (CIDR notation) or leave empty to allow traffic from all sources. If multiple LAN networks are configured and you only wish to allow certain LAN network(s) access to the internet, enter that LAN network's IP range in CIDR notation. To allow multiple LAN networks, add a rule for each LAN network.

CIDR notation example: Network 192.168.140.0 with subnet mask 255.255.255.0 in CIDR notation is 192.168.140.0/24.

Source MAC address^*

The source device's MAC address.

Protocol

Supported hardware

All, TCP, UDP	ICMP
SecureEdge and SecureEdge Pro, firmware 2026.06 and up (upgrade) IXrouter3, firmware 3.22 and up (upgrade)	~~SecureEdge and SecureEdge Pro~~ (unsupported) IXrouter3, firmware 3.22 and up (upgrade)

Select a protocol to allow or select all to allow all protocols.

Destination IP address / CIDR^*

Supported hardware

SecureEdge and SecureEdge Pro, firmware 2026.06 and up (upgrade)
IXrouter3, firmware 3.28 and up (upgrade)

The destination IP address or IP range (CIDR notation) or leave empty to allow traffic to all destinations. Hostnames are not supported.

Destination port

This field is only available if a protocol is selected. Enter the allowed port. Multiple ports or port ranges are not supported. To allow multiple ports, add a rule for each port.

Description

Enter a description for this rule.

* A source IP address / CIDR, source MAC address, or destination IP address / CIDR is required.

Repeat the previous steps for every device, protocol, or port you want to grant access.
If you need to access local domains instead of local IP addresses, you need to also add a Forward DNS or disable DNS rebind protection.

You have now made the changes in the IXON Cloud, but these are not yet active in your device. You will need to push your changes to your device for them to take effect.

Temporary disconnect

After this next step, the config push, the device may temporarily disconnect and LAN communication may be temporarily interrupted while it's applying the new settings. This only takes a moment.

Click on Push config to device in the top right corner.

Make sure the network settings on each individual LAN device is set correctly.
- If it's set to automatic / DHCP: All network settings are handled automatically.
- If it's set to manual / static: In addition to the IP address and subnet mask that you likely already configured, make sure that the edge gateway's LAN IP address is entered as both the default gateway and the DNS server.

Local web interface

Supported hardware

SecureEdge and SecureEdge Pro, firmware 2026.06 and up (upgrade)
IXrouter3, firmware 3.22 and up (upgrade)

To allow access via the local web interface, select your edge gateway model:

SecureEdge and SecureEdge Pro

Connect your computer to one of the LAN ports.
- The local web interface is not accessible from the WAN side (Cloud port and also OT/LAN port when it's configured as WAN2).
Open a new browser tab, go to the edge gateway's LAN IP address, and log in.
- The default LAN IP address is 192.168.140.1.
- Make sure that your laptop has an IP address in the same range. You may need to configure this manually. There are many online guides on this if you need a step by step guide.
- The default username is admin.
- The default password (PW) is printed on the side of the edge gateway.
- The number of login attempts is limited per time window, in compliance with cybersecurity standard IEC 62443-4-2. By default, the number of login attempts is limited to 5 per 1 minute, replenishing a login attempt every 1 minute. We recommend you configure this to align with your corporate security policy. Do so by logging in and going to Administration > Authentication.
- You can change the password by logging in and going to Administration > Change password.
Go to Network > Firewall.
Access can be allowed per WAN port, depending on how you have your edge gateway connected. For the regular WAN port, the Cloud port, go to WAN firewall > LANWAN. For the OT/LAN port, when it's configured as WAN2, go to WAN2 firewall > LANWAN2.
At Limited access, add limited access.

Enter the requested information (details below) and click on Add.

Field

Description

Source IP / CIDR^*

CIDR notation example: Network 192.168.140.0 with subnet mask 255.255.255.0 in CIDR notation is 192.168.140.0/24.

Source MAC address^*

The source device's MAC address.

Protocol

Supported hardware

All, TCP, UDP	ICMP
SecureEdge and SecureEdge Pro, firmware 2026.06 and up (upgrade)	~~SecureEdge and SecureEdge Pro~~ (unsupported)

Select a protocol to allow or select all to allow all protocols.

Destination IP / CIDR^*

The destination IP address or IP range (CIDR notation) or leave empty to allow traffic to all destinations. Hostnames are not supported.

Destination port

This setting is only applicable if a protocol is selected. Enter the allowed port. Multiple ports or port ranges are not supported. To allow multiple ports, add a rule for each port.

* A source IP address / CIDR, source MAC address, or destination IP address / CIDR is required.

Repeat the previous steps for every device, protocol, or port you want to grant access.
If you need to access local domains instead of local IP addresses, you need to also add a Forward DNS or disable DNS rebind protection.
Click on Submit changes.

Wait a moment for the edge gateway to report its new configuration to the IXON Cloud. This usually takes less than a minute.
Go to Fleet Manager > Devices and click on your device name.
Open the sync optionsand select Import config from device.

IXrouter3

Connect your computer to one of the LAN ports.
- The local web interface is not accessible from the WAN side (Internet port).
Open a new browser tab and go to the edge gateway's LAN IP address.
- The default LAN IP address is 192.168.27.1.
- Make sure that your laptop has an IP address in the same range. You may need to configure this manually. There are many online guides on this if you need a step by step guide.
Go to Configuration and log in.
- The default password (PW) is printed on the side of the edge gateway.
- If there is no password printed on the side, this edge gateway was manufactured before the local web interface was created. That means it does not have a password and you cannot proceed using this method. Instead, use the IXON Cloud method. Additionally, once the edge gateway is online and has a VPN connection, we can configure a password for you. Please then contact us by granting us support access at Fleet Manager > Tools and tell us the serial number of the edge gateway.
- If you enter an incorrect password multiple times in a row, you'll need to wait roughly 5 minutes before you can try again. The number of attempts is limited to 5 attempts per 5 minutes.
- You can change the password by logging in and going to Account in the bottom left corner.
Go to Firewall > WAN ⇒ LAN.
At LAN to WAN allow list, add limited access.

Enter the requested information (details below) and click on Add.

Field	Description
Source IP^*	Enter the source device's IP address or leave empty to allow traffic from all sources.
Source MAC^*	The source device's MAC address.
Protocol	Select a protocol to allow or select all to allow all protocols.
Destination IP address / CIDR^*	Supported hardware IXrouter3, firmware 3.28 and up (upgrade) The destination IP address or IP range (CIDR notation) or leave empty to allow traffic to all destinations. Hostnames are not supported.
Destination port	This field is only available if a protocol is selected. Enter the allowed port. Multiple ports or port ranges are not supported. To allow multiple ports, add a rule for each port.

* A source IP address, source MAC address, or destination IP address / CIDR is required.

Repeat the previous steps for every device you need to access.
If you haven't already, Apply your settings.

Wait a moment for the edge gateway to report its new configuration to the IXON Cloud. This usually takes less than a minute.
Go to Fleet Manager > Devices and click on your device name.
Open the sync optionsand select Import config from device.

Title

Allow access from LAN to corporate network or internet

URL Name

Allow-access-from-LAN-to-corporate-network-or-internet

Allow access from LAN to corporate network or internet

Allow all access to corporate network or internet

IXON Cloud

Local web interface

Allow limited access to corporate network and internet

IXON Cloud

Local web interface

Introduction

Remote Access

Fleet Management

User Management

Customer Portal

Machine Data

Notifications

Hardware

Open Innovation

Security and Availablility

Release Notes

Knowledge

Allow access from LAN to corporate network or internet

Article Details

Allow all access to corporate network or internet

IXON Cloud

Local web interface

Allow limited access to corporate network and internet

IXON Cloud

Local web interface

Properties

Introduction

Getting Started

Remote Access

VPN connection

VPN Client

Web Access

Connect to your machine

Connection details

M2M Cloud Cluster

Fleet Management

Edge gateway registration

IXagent registration

WAN Settings

LAN Settings

Edge gateway firewall

General device settings

User Management

Setup

Invite and manage users

My account

External Identity And Access Management

Customer Portal

Custom login page and homepages

White labeling

Machine Data

Live Data

Historical Data

Data Source protocols

Pages, cards, and reports

Components

AI assistant

Notifications

Alarms & Notifications

Hardware

Edge gateways and accessories

Open Innovation

Custom development

Marketplace

Security and Availablility

Security

Availability

Release Notes

IXON Cloud

Knowledge

Highlighted Articles

Tips

Related Articles