Anybus Defender – Configuring Layer 3 Static Routing

APPLICABLE PRODUCTS 

Anybus Defender Series 4000 and up

VERSIONS USED IN THIS ARTICLE

• Anybus Defender 2.5.2-2025111723

Anybus Defender – Configuring Layer 3 Static Routing

This guide explains how to configure Layer 3 routing on the Anybus Defender. It covers the difference between directly connected networks and remote networks, how to create gateways and static routes, why return routes are required, and how firewall rules control which routed traffic is allowed between networks.

Instructions

Anybus Defender – L3 Routing: How to Configure Static Routes

Introduction

Layer 3 routing allows the Anybus Defender to forward IP traffic between different IP networks.

There are two important cases:

Directly connected networks do not normally need static routes. If the Defender has:

the Defender already knows where all three networks are because it has an interface in each network.

You only need a static route when the destination network is behind another router.

Example Network

Suppose you have this topology:

The Defender already knows:

10.10.10.0/24       -> WAN

192.168.200.0/24    -> LAN

192.168.100.0/24    -> LAN2

But it does not automatically know that:

172.16.50.0/24

is reachable through:

192.168.100.254

That is where a static route is required.

Step 1 – Configure the Defender Interfaces

Configure the interfaces first.

For example:

Devices directly connected to these networks should normally use the corresponding Defender IP as their gateway when they need to communicate through the Defender.

For example:

192.168.200.20

IP:      192.168.200.20
Mask:    255.255.255.0
Gateway: 192.168.200.1

Step 2 – Create a Gateway for the Next-Hop Router

Go to:

System → Routing → Gateways

Click Add.

For our example configure:

Save and apply.

The important concept is:

Gateway = the next device the Defender sends the packet to

It is not the final destination.

Step 3 – Create the Static Route

Go to:

System → Routing → Static Routes

Click Add.

Configure:

Save.

Then Apply Changes.

This tells the Defender:

Destination: 172.16.50.0/24
        |
        v
Next hop: 192.168.100.254
        |
        v
Interface: LAN2

Step 4 – Configure the Return Route

This part is very important.

Routing must work both ways.

The remote router at:

192.168.100.254

also needs to know how to get back to:

192.168.200.0/24

So, on that router you would configure:

Destination: 192.168.200.0/24

Gateway:     192.168.100.1

Where:

192.168.100.1

is the Defender LAN2 address.

The path then becomes:

192.168.200.20
      |
      | Gateway 192.168.200.1
      v
Anybus Defender
      |
      | Static Route
      | 172.16.50.0/24 via 192.168.100.254
      v
192.168.100.254
      |
      v
172.16.50.20

And the reply follows the reverse route.

Step 5 – Add Firewall Rules

A route only tells the Defender where traffic should go.

It does not automatically mean the firewall will allow it.

For traffic initiated from:

192.168.200.20

toward:

172.16.50.20

you would normally put the firewall rule on LAN, because that is where the connection enters the Defender.

For example:

This would permit:

192.168.200.20:any

        ↓

172.16.50.20:502

The source port is normally Any because the device starting the connection typically chooses a temporary/ephemeral source port automatically.

Simple rule to remember

Destination directly attached to Defender?

             |
       +-----+-----+
       |           |
      YES          NO
       |           |
 No static      Is there another
 route needed   router to reach it?
                   |
                  YES
                   |
             Create Gateway
                   +
             Static Route

So, for an Anybus Defender with WAN + LAN + LAN2, routing between those three directly connected subnets is already handled at Layer 3. Static routes are for networks located beyond another router.

© HMS Networks AB 2026