Machine Remote Access with Ewon Edge & Cloud, Protected by Anybus Defender

This guide helps to configure a scenario where the Anybus Defender is the Conduit between the Machine, the customer network as well as the Ewon Edge gateway. This enables local security controls, logging capabilities and add protection from the machine to the customer and vice versa. This design is in line with IEC 62443-3-3 SL2

Applicable products 

• Anybus Defender 6000 Series and up, with NAT, DPI or PRO licenses. At least 4 interface are needed for this setup.
• Ewon Edge-10  (may apply to other version also)

Versions used in this article

• Anybus Defender 2.5.2-2025111723
• Ewon Edge firmware 2.2.2

1. Interface names and physical ports

Use the following names throughout the Defender configuration.

The bridge membership is:

BRIDGE0
├── LAN       (igb1)
└── Ewon_LAN  (igb4)

This configuration enables open communication between the 2 ports, the same IP subnet is used on both networks. 

2. Purpose

This configuration provides:

• Routed Ewon cloud connectivity between Ewon_WAN and WAN.
• Outbound NAT for the Ewon WAN address.
• A transparent bridge between Ewon_LAN and LAN.
• Siemens S7 communication through the Ewon Edge & Cloud to the PLC.
• A dedicated SOC interface for receiving Defender syslog messages.
• Blocking of traffic that is not explicitly permitted.

3. Network topology

SOC connection:

SOC / igb2: 192.168.100.1/24
SOC server: 192.168.100.10/24

4. Defender Interface Configuration

5. Configure the transparent bridge

Go to Interfaces -> Assignments -> Bridges and press Add

Create one bridge named:

BRIDGE0

Add these two members:

LAN
Ewon_LAN

This corresponds to:

igb1 + igb4

Both member interfaces must remain without IP addresses.

The bridge carries traffic between:

Ewon LAN: 10.0.0.52/24
PLC:      10.0.0.200/24

The go to Interface Assignments -> Available network ports, find BRIDGE0 in the drop down menu and press Add.

Press the name of the Bridge interface, in the new window Enable the interface and in Description give it a new name.

If you want the bridge to have an IP address for management, choose Static IPv4 in IPv4 Configuration Type and give it the IP address in Static IPv4 Configuration.

6. Configure the Ewon Edge

Add the PLC to Ewon Edge Remote Access

In Ewon Cloud - Go to Remote Access, under Links press +Add Link

Here you can give it a name, IP address and choose the Protocol, Port and whether to use TCP, UDP or TCP+UDP.

Name:         Siemens PLC
IP address:   10.0.0.200
Protocol:     Custom
Port:         102
Transport layer protocol: TCP

Add the PLC to Ewon Edge Devices

In Ewon Cloud - Go to Devices and press +Add Device

Device Name: Siemens PLC
Protocol:    Siemens - ISO TCP addressing
PLC type:    S7-300
IP address:  10.0.0.200

Ewon WAN

In Ewon Cloud - Go to Gateway -> Connectivity, here you can change the WAN IP.

IP address:  192.168.200.2
Subnet mask: 255.255.255.0
Gateway:     192.168.200.1

The gateway is the Defender Ewon_WAN interface.

Ewon LAN

In Ewon Cloud - Go to Gateway -> Networks, here you can change the LAN IP.

IP address:  10.0.0.52
Subnet mask: 255.255.255.0

The Ewon LAN and PLC are in the same subnet.

7. Firewall rules

Firewall rules are processed from top to bottom.

Place every allow rule above the final block rule.

7.1 Ewon_WAN rules

These rules are configured on:

Interface:         Ewon_WAN
Physical port:     igb3
Defender address:  192.168.200.1

Traffic from the Ewon WAN interface enters the Defender through Ewon_WAN.

1. Pass UDP 192.168.200.2 → 8.8.8.8, destination port 53
2. Pass TCP 192.168.200.2 → 8.8.8.8, destination port 53
3. Pass TCP 192.168.200.2 → any, destination port 443
4. Pass UDP 192.168.200.2 → any, destination port 1194
5. Pass UDP 192.168.200.2 → any, destination port 123
6. Block and log 192.168.200.2 → any

7.2 WAN rules

These rules are configured on:

Interface: WAN

Physical port: igb0

Defender address: 10.10.10.53

The Ewon initiates its cloud connection through Ewon_WAN. The connection then exits through WAN.

Return traffic is accepted automatically through the Defender state table.

Do not create inbound port-forward rules for TCP 443 or UDP 1194.

Create the following final block rule.

7.3 Ewon_LAN rules

These rules are configured on:

Interface: Ewon_LAN

Physical port: igb4

Bridge: BRIDGE0

Traffic from the Ewon LAN toward the PLC enters BRIDGE0 through Ewon_LAN.

Rule 1: Allow Siemens S7

Rule 2: Block all other Ewon_LAN traffic

Rule order:

1. Pass or inspect Siemens S7 TCP 102

2. Block and log all other Ewon_LAN traffic

7.4 LAN rules

This rule is configured on:

Interface: LAN

Physical port: igb1

Bridge: BRIDGE0

Normal PLC replies to connections initiated by the Ewon are accepted through the Defender state table.

No additional TCP 102 allow rule is required on LAN.

Rule 1: Block all other LAN traffic

Established replies for the Siemens S7 connection are not blocked by these rules.

7.5 SOC rules

These rules are configured on:

Interface: SOC

Physical port: igb2

Defender address: 192.168.100.1

Configure the SOC server as:

IP address:  192.168.100.10
Subnet mask: 255.255.255.0
Gateway:     192.168.100.1

The Defender initiates the syslog traffic toward the SOC. Therefore, no inbound UDP 514 rule is required on the SOC interface.

Create the following block rule.

This permits the SOC server to receive Defender-generated syslog messages while preventing the SOC from initiating routed connections through the Defender.

8. Configure syslog

Configure the Defender to send the log files to a remote syslog server, the settings are as follows:

Destination:      192.168.100.2
Protocol:         UDP
Destination port: 514
Source interface: SOC
Source address:   192.168.100.1

The SOC system must listen on:

UDP port 514

The SOC receives Defender-generated logs. It does not automatically receive a complete copy of the traffic passing through BRIDGE0.

© HMS Networks AB 2026