A hard boundary between IT and OT. Rugged, protocol-aware firewalls contain threats before they reach production systems — with OT-specific protections built in.
SKU:EDR-G9004-VPN-2MGTXSFP-T
Vendor:
SKU:EDF-G1002-BP
Vendor:An industrial firewall is a firewall built for control networks. It mounts on a DIN rail, runs on DC power, tolerates the temperatures inside a field cabinet and understands industrial protocols such as Modbus TCP, DNP3 and EtherNet/IP. Its job is to decide what may cross the line between IT and OT, or between one zone of the plant and the next.
It isn't an office firewall in a metal box. An IT firewall filters by address and port. An industrial firewall with deep packet inspection reads the command inside the packet, so it can allow a PLC to be read and block it from being written to. It also isn't a data diode, which permits traffic one way only.
The firewall on this page is also a router and a VPN gateway, so one device covers the boundary, the address translation and the tunnel back to the control room. It has been through our IT/OT lab, and its price is published.
While IT security focuses on protecting data, OT security prioritizes uptime, safety, and reliability. Firewalls secure OT environments by ensuring controlled data flow, enabling visibility, and enforcing strict access controls — and work best paired with network monitoring and a segmentation strategy.
Create strong separation between IT and OT networks, restricting access based on role, device, or protocol.
If an IT network is breached, an OT firewall prevents malware, ransomware, or unauthorized users from spreading into critical industrial systems.
Solutions like the Fortinet Rugged Firewall are built for harsh environments and include thousands of malware signatures tailored to OT-specific threats.
Enforce security policy at the protocol level — controlling industrial protocols, blocking unauthorized commands, and preventing lateral movement.
A firewall is one of three ways to enforce a boundary on an OT network. This table sets it beside the other two so you can see where each belongs. Many sites end up using more than one.
| Compare | Industrial firewall and secure routerMoxa EDR-G9004-VPN | Segmentation gatewayBlastWave BlastShield | Hardware data diodeGarland CTAP-P1GCCREG |
|---|---|---|---|
| What it does | Filters traffic between networks with a stateful firewall and deep packet inspection, and adds NAT, routing and VPN. | Builds encrypted, authenticated tunnels to each device or group, with remote access for staff and contractors. | Passes SPAN traffic one way to monitoring tools. |
| Direction of traffic | Both ways, under rules you write. It can allow reads and block writes by protocol function. | Both ways, limited to the devices each user or system is approved for. | One way only. There is no return path. |
| What it needs | DIN-rail space and a 12/24/48 VDC supply. SFP modules and the IPS license are separate. | Two gateways, which are included, and some networking know-how for setup. | SPAN ports on managed switches. |
| Best for | The IT/OT boundary, a cell that needs a hard edge, or a remote site that needs a VPN. | Device-by-device access control and vendor remote access. | Getting monitoring data out without opening a way in. |
| Starts at | $2,300.00 | From $2,180.00Includes 2 gateways, up to 50 endpoints | $1,440.00 |
| Shop | View product | View product | View product |
The Moxa EDR-G9004 also comes in standard-temperature and conformal-coated versions, and Moxa makes routers with more ports. Those are quoted on request.
The spec calls for a firewall at the control system boundary and you need a part number today. The EDR-G9004 carries certifications that come up in utility and transportation bids, including IEC 61850-3, IEEE 1613 and NEMA TS2, and it has a setup wizard for building a DMZ.
Water systems, electric co-ops and oil and gas sites often have unmanned locations that connect back over someone else's network. A secure router at each site gives you an encrypted IPsec tunnel to the control room and a firewall in front of the local PLCs, in one device rated from -40 to 75°C.
A flat plant network puts every PLC within reach of every PC. A transparent firewall in front of a line or a cell sets a boundary without re-addressing the equipment behind it, and LAN bypass on the copper ports keeps traffic moving if the unit loses power.
Firewalls at the DMZ and between ICS network zones inspect traffic with IPS signatures — virtually patching unpatched, vulnerable assets in controller and field networks.
Question not listed? Email info@otcyberdirect.com or call (508) 289-1195.
The Moxa EDR-G9004-VPN secure router on this page is $2,300, with firewall, NAT, VPN, deep packet inspection and routing included. SFP modules and the IPS license are separate purchases. Routers with more ports are quoted on request.
Hardware and protocols. An industrial firewall mounts on a DIN rail, runs on DC power and is rated for cabinet temperatures. This one is rated from -40 to 75°C. It also inspects industrial protocols, including Modbus, DNP3, IEC 61850 MMS, EtherNet/IP, OPC UA and Siemens S7.
Yes. It can run as a transparent, bridge-mode firewall or use NAT, so the devices behind it keep their addresses. Installation is inline, so plan a short window with operations.
The two copper ports have LAN bypass, so traffic keeps passing if the unit fails or loses power. The router also takes redundant DC power inputs. Decide whether passing traffic or blocking it is the right failure behavior for that boundary before you rely on bypass.
Not in the base unit. IPS is a separate license, bought per device or through Moxa's MXsecurity software. With it, the router blocks known attack patterns and provides virtual patching for equipment that can't be updated.
Not always. A plain industrial router forwards traffic between networks. A secure router such as the EDR-G9004 adds a stateful firewall, deep packet inspection and VPN, so it does both jobs. If the device will sit on a security boundary, check that it has the firewall features and not only routing.
Moxa ships from its own facility with its own tracking code. Ground shipping is free on most products, and some vendors offer overnight for orders placed before 12 PM ET. This product ships within the US only.
