This guide will help those using Ewon for remote access to add a local conduit for security managed on-premises. The Anybus Defender be installed between the Ewon and PLC. In addition the Defender provides protection between the Machine and the customer's factory network.
The Defender operates as a transparent Layer-2 firewall between the Ewon and PLC. Bridge mode keeps both sides in the same subnet while still permitting firewall filtering and intrusion inspection.
| Device/interface | Address | Gateway |
| Ewon Flexy LAN | 10.0.0.53/24 | None |
| PLC | 10.0.0.200/24 | Blank with Plug’n Route on Ewon |
| Defender WAN | No IP | None |
| Defender LAN | No IP | None |
| WAN+LAN bridge | No IP required | None |
| Defender SOC interface | 192.168.100.1/24 | None |
| SOC log collector | 192.168.100.10/24 | Not required for local Syslog |
Do not add the SOC interface to the WAN+LAN bridge.
3. Physical connections
Connect the equipment as follows:
PIC
Use one unused Defender Ethernet port for the SOC:
PIC
4. Configure the Ewon Flexy
4.1 LAN address
Setup
→ System
→ Communication
→ General
→ Eth1 LAN
Verify:
Ewon LAN address: 10.0.0.53
Subnet mask: 255.255.255.04.2 Enable Plug’n Route
In the Ewon web interface, open:
Setup
→ System
→ Communication
→ Networking
→ Routing
Set:
NAT on LAN (Plug’n Route)
With Plug’n Route enabled, the PLC only needs to be in the same subnet as the Ewon LAN interface. It does not need the Ewon as its gateway. If Plug’n Route is disabled and NAT and TF on WAN is used instead, the PLC gateway must be 10.0.0.53.
4.3 PLC configuration
Recommended PLC configuration:
IP address: 10.0.0.200
Subnet mask: 255.255.255.0
Default gateway: BlankDo not configure the Defender as the PLC gateway. In this design, the Defender is a bridge rather than a router.
4.4 Add the PLC in eCatcher
Open:
Ewon properties
→ Configure LAN Devices & Firewall
→ Add LAN Device
Configure:
Name: PLC
IP address: 10.0.0.200
Protocol: TCP
Port: 102When the Talk2M LAN-device firewall is set to High, only declared devices are reachable, so the PLC must be present in this list.
5. Configure the WAN+LAN bridge
In the Defender web interface:
Open:
Interfaces
→ Assignments
Make sure the physical WAN and LAN interfaces are enabled.
Open:
Interfaces
→ Assignments
→ Bridges
Add a bridge with:
Member interfaces:
WAN
LAN
Give it a description such as:
EWON_PLC_BRIDGE
Return to interface assignments.
Add the newly created bridge as an available interface.
Enable it.
Recommended addressing:
WAN IPv4 configuration: None
LAN IPv4 configuration: None
BRIDGE IPv4 configuration: NoneUse the dedicated SOC interface for Defender management or set an IP for the bridge.
6. Configure the dedicated SOC interface
Connect an unused Defender port to the SOC network.
Open:
Interfaces
→ Assignments
Add the unused physical port and configure:
Enable interface: Yes
Description: SOC
IPv4 configuration type: Static IPv4
IPv4 address: 192.168.100.1
Prefix length: 24
IPv4 gateway: None
IPv6: NoneThe final interface arrangement should resemble:
WAN Member of EWON_PLC_BRIDGE
LAN Member of EWON_PLC_BRIDGE
BRIDGE WAN + LAN
SOC 192.168.100.1/24, not bridged7. Create firewall aliases
Open:
Firewall
→ Aliases
Create:
EWON
Name: EWON
Type: Host
Value: 10.0.0.53PLC
Name: PLC
Type: Host
Value: 10.0.0.200SOC_SERVER
Name: SOC_SERVER
Type: Host
Value: 192.168.100.10Using aliases makes later IP changes easier.
8. Configure the WAN firewall rules
Open:
Firewall
→ Rules
→ WAN
The recommended order is:
1. Temporary plain TCP 102 rule
2. Optional ICMP rule
3. Block everything else to the PLC
Rule 1 — Temporary plain S7 fallback
During initial testing, create this:
Action: Pass
Interface: WAN
Address family: IPv4
Protocol: TCP
Source: EWON
Destination: PLC
Destination port: 102
Logging: Enabled
Description: Temporary Ewon to PLC S7 fallback
This rule is only for testing.
Rule 2 — Optional ICMP
Add this only when remote ping is required:
Action: Pass
Interface: WAN
Address family: IPv4
Protocol: ICMP
ICMP type: Echo request
Source: EWON
Destination: PLC
Logging: Enabled
Description: Temporary Ewon ping to PLCThis rule is not required for normal S7 communication and can be removed after testing.
Rule 3 — Block other access to the PLC
Place this below all required allow rules:
Action: Block
Interface: WAN
Address family: IPv4
Protocol: Any
Source: Any
Destination: PLC
Logging: Enabled
Description: Block unauthorised access to PLCFinal production rule order
1. Pass EWON → PLC TCP 102
2. Optional diagnostic rules
3. Block Any → PLC Any
The temporary plain TCP 102 fallback should be disabled or removed.
9. LAN firewall rules
Do not add a broad reverse rule under LAN for PLC responses.
The allowed WAN connection:
Ewon → PLC TCP 102
automatically permits the associated return traffic:
PLC → Ewon
Only add rules under LAN when the PLC starts a new connection, for example:
PLC → NTP server
PLC → engineering station
PLC → another machine
PLC → an Ewon service
For this basic scenario, no LAN rules should be required.
10. Configure Defender Syslog
The SOC receiver is:
SOC server: 192.168.100.10The Defender sends the logs from:
SOC interface: 192.168.100.1Enable remote logging
Open:
Status
→ System Logs
→ Settings
Under Remote Logging Options, configure:
Enable Remote Logging
Source Address: SOC
Remote log server: 192.168.100.10:514
IP version: IPv4Select the available log categories you want under Remote Syslog Contents.
Save and apply the changes.
11. Enable logging on the rules
Syslog forwarding alone does not guarantee that every firewall connection is logged.
Verify that logging is enabled on:
Allow Ewon to PLC with S7
Block unauthorised access to PLC
Optional diagnostic rules
This allows the SOC to see both successful authorised access and blocked attempts.
12. Commissioning tests
Test in this order:
| Test | Expected result |
| eCatcher connects to the Ewon | Successful |
| PLC 10.0.0.200 is reachable through Talk2M | Successful |
| S7 TCP 102 connection is attempted | Allowed |
| Rule recognises S7 traffic | Logged/allowed |
| Connection to an unapproved PLC port | Blocked and logged |
| Connection from an unapproved source | Blocked and logged |
| PLC reply traffic | Successful without a reverse LAN rule |
| Defender login | Sent to SOC |
| Defender configuration change | Sent to SOC |
| Firewall block event | Sent to SOC |
| Temporary TCP 102 fallback disabled | Normal approved access still works |
For remote TIA Portal access, use the known PLC IP 10.0.0.200. PROFINET DCP discovery is Layer 2 and may not behave like a routed Talk2M IP access.
Here is how it looks if the traffic passes:
2026-07-29T07:16:43.667505+00:00 Backup-Defender.localdomain filterlog[10331] 36,,,1785223978,igb0,match,pass,in,4,0x0,,125,146,0,DF,6,tcp,52,10.0.0.53,10.0.0.200,62759,102,0,S,1984394409,,8192,,mss;nop;wscale;nop;nop;sackOK
Final configuration summary
Ewon Flexy:
LAN address: 10.0.0.53/24
NAT mode: NAT on LAN (Plug’n Route)
PLC:
IP address: 10.0.0.200/24
Gateway: Blank
Defender bridge:
Members: WAN + LAN
WAN IP: None
LAN IP: None
Bridge IP: None
Defender SOC interface:
IP address: 192.168.100.1/24Not part of WAN+LAN bridge
SOC server:
IP address: 192.168.100.10/24
WAN firewall rules:
1. EWON → PLC TCP 102
2. Optional ICMP
3. Block and log Any → PLC
LAN firewall rules:
None unless the PLC initiates separate connections
Remote logging:
Status → System Logs → Settings
Remote server: 192.168.100.10
Source: SOC / 192.168.100.1Firewall rule logging enabled