APPLICABLE PRODUCTS
Anybus Defender Series 4000 and up
VERSIONS USED IN THIS ARTICLE
- Anybus Defender 2.5.2-2025111723
Anybus Defender – Local Segmentation with WAN, LAN, and LAN2
This guide explains how to configure local network segmentation on the Anybus Defender using three separate subnets across the WAN, LAN, and LAN2 interfaces. It shows where to assign IP addresses, configure device gateways, and create firewall rules based on source IP, destination IP, protocol, and port. The guide also explains which interface each firewall rule should be placed on, how stateful return traffic works, and how to allow only the communication required between the different network segments.
Instructions
This example creates three separate IP subnets on an Anybus Defender and then uses firewall rules to control exactly which devices can communicate between them.
Two important rules to remember:
Apply firewall rules to the interface where traffic enters the Defender.
When using NAT, specify the translated (actual) destination IP address in your firewall rules, not the virtual NAT IP address.
So:
- LAN → LAN2 traffic = rule on LAN
- LAN2 → LAN traffic = rule on LAN2
- WAN → LAN/LAN2 traffic = rule on WAN
The Defender firewall is stateful, so if LAN starts an allowed connection to LAN2, the return packets are automatically allowed. You normally do not need a second reverse rule just for replies.
1. Example network
We will use this simple topology:
WAN Network
For example:
| Interface | Defender IP | Subnet | Example device |
| WAN | 10.10.10.81/24 | 10.10.10.0/24 | PC 10.10.10.20 |
| LAN | 192.168.200.1/24 | 192.168.200.0/24 | HMI 192.168.200.30 |
| LAN2 | 192.168.100.1/24 | 192.168.100.0/24 | PLC 192.168.100.104 |
Each interface must use a different, non-overlapping subnet.
2. Configure the Defender interfaces
Go to:
Interfaces → WAN
Configure:
Enable: Yes
IPv4 Type: Static IPv4
IPv4 Address: 10.10.10.81/24
Gateway: 10.10.10.254Then:
Interfaces → LAN
Configure:
IPv4 Address: 192.168.200.1/24
Then configure the second LAN interface, OPT1:
Description: LAN2
IPv4 Address: 192.168.100.1/24
The Defender then has directly connected routes for all three networks.
3. Configure the devices
The devices also need the Defender as their gateway if they need to communicate outside their own subnet.
WAN PC
IP: 10.10.10.20
Mask: 255.255.255.0
Gateway: 10.10.10.81HMI on LAN
IP: 192.168.200.30
Mask: 255.255.255.0
Gateway: 192.168.200.1PLC on LAN2
IP: 192.168.100.104
Mask: 255.255.255.0
Gateway: 192.168.100.1That gateway setting is especially important. Without it, a device may receive traffic from another subnet but send its reply somewhere else.
4. Decide what communication should be allowed
We want:
| From | To | Protocol | Port | Purpose |
| HMI 192.168.200.30 | PLC 192.168.100.104 | TCP | 502 | Modbus TCP |
| HMI 192.168.200.30 | PLC 192.168.100.104 | ICMP | — | Ping/testing |
| PLC 192.168.100.104 | HMI 192.168.200.30 | UDP | 1234 | PLC-initiated data |
| WAN PC 10.10.10.20 | HMI 192.168.200.30 | TCP | 443 | HTTPS management |
Everything else can remain blocked.
This is the basic principle of segmentation: allow only the communication that is required.
5. LAN → LAN2 rule
We want:
HMI
192.168.200.30
|
| TCP 502
v
PLC
192.168.100.104Because the traffic starts on LAN, go to:
Firewall → Rules → LAN
Click Add.
Configure:
| Setting | Value |
| Action | Pass |
| Interface | LAN |
| Address Family | IPv4 |
| Protocol | TCP |
| Source | Single host 192.168.200.30 |
| Source Port | Any |
| Destination | Single host 192.168.100.104 |
| Destination Port Range | 502 (Select 502 on both From and To) |
| Description | Allow HMI to PLC Modbus TCP |
Save and Apply Changes.
Why is Source Port "Any"?
This often causes confusion.
For Modbus TCP:
HMI: 49152 → PLC:502
The HMI normally chooses a temporary source port automatically, and it can change in different sessions.
Therefore, your rule should normally be:
Source port: Any
Destination port: 502not:
Source port: 502
Destination port: 5026. Allow ping from LAN to LAN2
For initial troubleshooting, I would also temporarily allow ping.
Still under:
Firewall → Rules → LAN
Add:
| Setting | Value |
| Action | Pass |
| Interface | LAN |
| Address Family | IPv4 |
| Protocol | ICMP |
| Source | 192.168.200.30 |
| Destination | 192.168.100.104 |
| Description | Allow HMI to ping PLC |
You should then be able to run from the HMI/PC:
ping 192.168.100.104
7. Do you need a LAN2 → LAN rule?
For the Modbus TCP connection above:
No.
The HMI initiates:
192.168.200.30 → 192.168.100.104:502
The Defender tracks that connection.
The PLC's response:
192.168.100.104:502 → 192.168.200.30
is automatically recognized as return traffic and allowed by the stateful firewall.
You only need a rule on LAN2 if the PLC starts a new connection itself.
8. LAN2 → LAN rule
Suppose the PLC independently sends UDP data to the HMI on port 1234.
Traffic:
PLC
192.168.100.104
|
| UDP 1234
v
HMI
192.168.200.30Because the traffic starts on LAN2, go to:
Firewall → Rules → LAN2
Add:
| Setting | Value |
| Action | Pass |
| Interface | LAN2 |
| Address Family | IPv4 |
| Protocol | UDP |
| Source | 192.168.100.104 |
| Source Port | Any |
| Destination | 192.168.200.30 |
| Destination Port | 1234 |
| Description | Allow PLC UDP data to HMI |
9. WAN → LAN rule
Now suppose an engineering PC on WAN needs HTTPS access to the HMI.
Engineering PC
10.10.10.20
|
| TCP 443
v
HMI
192.168.200.30Traffic enters the Defender on WAN, so go to:
Firewall → Rules → WAN
Add:
| Setting | Value |
| Action | Pass |
| Interface | WAN |
| Address Family | IPv4 |
| Protocol | TCP |
| Source | 10.10.10.20 |
| Source Port | Any |
| Destination | 192.168.200.30 |
| Destination Port | HTTPS 443 |
| Description | Allow WAN engineering PC to HMI HTTPS |
10. WAN → LAN2 rule
If the WAN engineering PC also needs Siemens S7 communication with the PLC, for example:
10.10.10.20 → 192.168.100.104 TCP 102
add another rule under:
Firewall → Rules → WAN
| Setting | Value |
| Action | Pass |
| Interface | WAN |
| Address Family | IPv4 |
| Protocol | TCP |
| Source | 10.10.10.20 |
| Source Port | Any |
| Destination | 192.168.100.104 |
| Destination Port | 102 |
| Description | Allow engineering PC to PLC S7 |
11. Resulting firewall configuration
You would now have something like:
WAN
PASS TCP
10.10.10.20
→
192.168.200.30
Port 443
PASS TCP
10.10.10.20
→
192.168.100.104
Port 102LAN
PASS TCP
192.168.200.30
→
192.168.100.104
Port 502
PASS ICMP
192.168.200.30
→
192.168.100.104LAN2
PASS UDP
192.168.100.104
→
192.168.200.30
Port 123412. Rule order
Rules are evaluated in order, so specific allow rules should be above a general block rule.
For example:
LAN RULES
1. PASS HMI → PLC TCP 502
2. PASS HMI → PLC ICMP
3. BLOCK Any → Any
LAN2 RULES
1. PASS PLC → HMI UDP 1234
2. BLOCK Any → Any
WAN RULES
1. PASS Engineering PC → HMI TCP 443
2. PASS Engineering PC → PLC TCP 102
3. BLOCK Any → AnyEnable logging on the block rules while testing. That makes troubleshooting much easier.
13. The easiest way to remember the rule location
Think:
Where does the packet first enter the Defender?
WAN device
|
v
[ WAN RULES ]
|
Defender
|
v
LAN / LAN2LAN device
|
v
[ LAN RULES ]
|
Defender
|
v
WAN / LAN2LAN2 device
|
v
[ LAN2 RULES ]
|
Defender
|
v
WAN / LANSo, you don't make a rule based on where the packet is going. You make it on the interface where it is coming from.
Final example
WAN
10.10.10.0/24
|
PC 10.10.10.20
|
10.10.10.81
|
+------------------+
| Anybus Defender |
| |
| WAN 10.10.10.81 |
| |
| LAN LAN2 |
+---+---------+----+
| |
192.168.200.1 192.168.100.1
| |
| |
HMI PLC
192.168.200.30 192.168.100.104
| |
+--502--->|
|<--reply-|
| |
|<-1234---+This gives you three routed security zones/subnets, with communication allowed only by the IP addresses, protocols, and destination ports you specify.
© HMS Networks AB 2026