How to isolate industrial VLANs and protect PLCs from attacks

Why industrial networks have become prime targets for attacks

Modern factories rely heavily on computers and interconnected systems to manage entire production lines. However, this technological evolution brought a major security challenge: operational technology networks, commonly known as OT, which control physical machinery, are now directly linked to corporate systems and the internet. In practice, this means that a single security flaw in an office computer can open dangerous gaps to the factory floor, exposing critical equipment to destructive attacks.

In the past, industrial machines operated completely isolated from the outside world through proprietary cables and closed software. With the advent of Industry 4.0, these systems adopted standard corporate networking protocols, making data collection easier but also granting unauthorized access to potential attackers. Before configuring advanced defenses, it is vital to ensure that the physical layer is flawless, preventing data loss and electrical noise similar to the care taken when crimping and testing CAT6A cables without corrupting critical packets.

The hidden danger of port scans on industrial controllers

When an attacker or malicious software infiltrates the corporate network, the first step is usually a port scan, which involves sending probe signals to discover active devices and running services. On standard computers, this scan merely triggers a slight spike in CPU usage. However, on PLCs—programmable logic controllers responsible for actuating motors, valves, and conveyor belts—this barrage of connections can overwhelm limited memory and processing resources.

Many of these industrial controllers run legacy operating systems built in an era when cybersecurity was not a priority. In practice, receiving hundreds of unknown network packets per second causes these devices to freeze, crash, or simply stop responding to emergency commands. Maintaining the integrity of electrical infrastructure and network components is just as critical as software, requiring constant hardware checks like those needed when testing switch voltage on the bench to prevent sudden power failures.

Segmenting the OT network with VLANs and strict rules

To prevent port scans from reaching sensitive equipment, the best strategy is to divide the network into smaller segments called VLANs, or virtual local networks. This division acts as if we were creating virtual firewalls and doors within the same set of cables and switches, preventing devices in one area from talking freely to another without explicit authorization.

However, simply separating VLANs is not enough, because standard routers allow all traffic to flow freely between them once the connection is established. This is where strict firewall rules come into play, configured to block any communication attempt that is not strictly necessary for factory operations. Below is a practical example of a firewall rule applied on an industrial router to block scans directed at sensitive PLC ports:

iptables -A FORWARD -p tcp --dport 502 -m state --state NEW -j ACCEPT
iptables -A FORWARD -p tcp --dport 102 -m state --state NEW -j ACCEPT
iptables -A FORWARD -m state --state NEW -j DROP

This simple set of commands allows only traffic destined for standard industrial protocols, such as Modbus on port 502 and Siemens S7 on port 102, blocking any other scanning attempt or unknown connection coming from untrusted zones.

Best practices to shield the factory floor against intruders

Implementing a secure architecture requires planning and rigorous testing to avoid production downtime during changes. The first step involves mapping all assets connected to the network, identifying who communicates with whom and which communication ports are actually used in daily operations.

Once the mapping is complete, the administrator must apply the principle of least privilege, which dictates that each machine can only access what is strictly necessary to perform its function. If an HMI panel does not need internet access, its access must be categorically blocked at the firewall, drastically reducing the attack surface available to potential intruders.

Final considerations on security in industrial environments

Protecting industrial networks against port scans and unwanted access is no longer a luxury but an operational necessity. By combining smart VLAN segmentation with strict firewall rules, companies can keep their controllers safe from failures caused by malicious or accidental traffic.

The secret to a robust infrastructure lies in continuous vigilance, planned firmware updates, and strict separation between the corporate world and the factory floor. Investing time in properly configuring these defenses ensures that production continues to operate with stability, security, and total predictability.