Network Configuration
The gateway is designed with 2 NICs to physically separate the PLC network from the WAN. This is the standard configuration for appliances and industrial PCs.
- LAN1 = PLC (eth1 / enp1s0, etc.) — Single PLC or multiple PLCs behind a switch
- LAN2 = WAN (eth2 / enp2s0, etc.) — Internet / Platform / OTA
- wlan0 / wwan0 / tun0 / usb0 — WiFi / GSM / VPN / Management USB-Ethernet
NIC name mapping can be adjusted per box via edge.net.lan1.iface in /etc/kopens/app.properties and can be overridden by environment variables during installation. These are for display on the screen monitoring card only; the actual IP configuration is handled by the OS NetworkManager / netplan. install.sh also provides an option for nmcli static IP configuration.
🔴 The names in the configuration file and the installation environment variables are different. The configuration file uses lan1, while the installation env uses NET1. If provided as LAN1_IFACE, no action will be taken, and the default values will be applied.
app.properties Key | Installation Env | Default Value |
|---|---|---|
edge.net.lan1.iface | NET1_IFACE | enp1s0 |
edge.net.lan2.iface | NET2_IFACE | enp2s0 |
edge.net.wifi.iface | WIFI_IFACE | wlan0 |
edge.net.gsm.iface | GSM_IFACE | wwan0 |
edge.net.vpn.iface | VPN_IFACE | tun0 |
NET1_IFACE=enp1s0 NET2_IFACE=enp2s0 \
NET1_IP=192.168.100.1/24 NET2_IP=192.168.0.10/24 \
bash install.sh
Since NET1_IP is the PLC network, it does not set a default route. If NET2_IP is left blank, it will use DHCP.
1. Standard Topology
┌──────────────────────┐ ┌─────────────┐
│ 상위 플랫폼 / 클라우드 │ ◀─── HTTPS / MQTT ─── │ 게이트웨이 │
│ (PlantPulse / SCADA) │ └─────────────┘
└──────────────────────┘ enp1s0 │ enp2s0
│ │
┌───────────────┘ └────────────┐
│ │
WAN (외부) PLC 망 (내부)
│ │
│ ┌───┴────────────┐
│ │ │
PLC₁ PLC₂ PLC₃
(Modbus / S7 / OPCUA)
| NIC | Name (Fedora Default) | Role | Default Gateway? |
|---|---|---|---|
| NIC 1 | enp1s0 | WAN — External Internet / Upper Platform / NTP | ✅ Yes |
| NIC 2 | enp2s0 | PLC Network — Private IP, Dedicated Communication with PLC | ❌ No (ipv4.never-default yes) |
2. Recommended IP Design (Example)
| Zone | CIDR | Usage |
|---|---|---|
| WAN | DHCP or Company Network / 192.168.0.0/24 | Gateway External IP — Office Network |
| PLC Network | 192.168.100.0/24 | Dedicated Private PLC Network — Isolated from WAN |
| Gateway Itself | WAN: 192.168.0.50 / PLC: 192.168.100.10 | |
| PLC | 192.168.100.20–254 | Per line / Per cell |
3. Configuration by Scenario
3.1 Simple Configuration — Single Company Network
If the PLC is directly connected to the company network and there is no separate PLC subnet, there is no need to place both NICs on the same network:
- Use
enp1s0(WAN) only — DHCP or STATIC enp2s0unused (or link down)
When running install.sh, omit NET2_IFACE, or set the unused NIC to a down state in the OS NetworkManager after installation.
3.2 Standard Isolated Configuration — WAN + PLC Network (Recommended)
Follows 1. Standard Topology above. For security, the PLC network can be completely isolated from the external internet, with the gateway serving as the sole bridge between the two networks. The PLC remains invisible to the internet.
3.3 3 NIC — WAN + PLC + Management
For large sites.
install.sh only accepts NET1_* (PLC Network) and NET2_* (WAN) — there is no NET3.
Configure the third NIC (management channel) manually after installation.
sudo nmcli con add type ethernet ifname enp3s0 con-name mgnt \
ipv4.method manual ipv4.addresses 10.10.0.50/24
sudo nmcli con up mgnt
enp1s0(WAN) — Externalenp2s0(PLC) — Private PLC Networkenp3s0or USB-Ethernet (Management) — Separate diagnostic / inspection channel (Company IT)
The management port on the home card displays the IP of this NIC.
3.4 Cloud / VM 1 NIC
In VM environments with only one NIC, all communication occurs on the same virtual network. NIC separation is handled by the host OS via vSwitch / VLAN.
4. Accessing the Gateway from Outside
To access the gateway's web UI from an external device (office PC, mobile) after deployment:
| Scenario | Method |
|---|---|
| Within the same company network | Directly via https://<gateway-wan-ip>/ui/main |
| Outside → Company Network | Connect via VPN, then follow the above |
| Outside → Internet (Risky) | Firewall NAT forwarding + Mandatory REST API Authentication + HTTPS |
Gateway v1 REST uses
X-API-Key/ Bearer authentication. However, direct exposure to the internet is not recommended. For external access, allow connection only after implementing additional protection layers such as a VPN or mTLS/API gateway.
5. Firewall — Exposed Ports
install.sh registers the open ports in the firewall. Since containers run in host network mode, the host firewall serves as the access control.
| Port | Service | Reason to Open Externally |
|---|---|---|
| 80 · 443 | Web UI · REST API | Yes — Entry point for operators |
| 1880 | Node-RED (Flow Edit) | Only when needed. Editing is also possible within the Web UI |
| 12000 · 12443 | Edge-provided OPC-UA Server | Only when connecting external SCADA |
| 1883 · 8883 | MQTT Plaintext · TLS | Only when using MQTT publishing |
| 3000 | Grafana | ⚠ Review — Opened for external access on 2026-07-02 |
| 7800 · 7801 | Time Series Engine HTTP · HTTPS (Time Series Query) | ⚠ Review — Opened for external access on 2026-07-02 |
| 9042 | Cassandra | 🔴 Review Required — Database port |
install.sh opens the ports listed above regardless of the interface. In particular, there is usually no reason for 9042 (Cassandra), 3000 (Grafana), or 7800/7801 (Time Series Engine) to be accessible from the outside.
Close unused ports or block them specifically on the WAN NIC.
firewall-cmd --list-ports # 지금 열린 것
firewall-cmd --permanent --remove-port=9042/tcp
firewall-cmd --permanent --remove-port=3000/tcp
firewall-cmd --reload
To avoid modifying the firewall during installation, install using SKIP_FIREWALL=1 and open ports manually.
The firewall list contains eleven ports, but the actual listeners verified by bin/health.sh are nine:
80 · 443 · 1883 · 1884 · 6379 · 9042 · 1880 · 12000 · 12443.
This discrepancy is normal. The firewall represents «permission», while listeners represent «what is actually running». Depending on the configuration (e.g., MQTT not in use), a port may be open in the firewall but have no listener. Conversely, 6379 (Redis) and 1884 are listening but are not in the firewall list, making them inaccessible from the outside.
JMX lacks authentication and listens only on 127.0.0.1. Starting from the 2026.11 release, the firewall stage in install.sh does not open 7799 and closes it if it is already open (firewall-cmd --remove-port=7799/tcp). If using other firewalls (iptables · ufw · nftables), manually block 7799.
In production environments, block ports that do not require external access via the firewall or block them on the WAN NIC only (firewall-cmd --remove-port).
6. Network Verification
Verify network reachability immediately after installation or before adding a PLC:
# 1) WAN — 외부 ping
ping -c 3 8.8.8.8
# 2) WAN — DNS
nslookup google.com
# 3) WAN — 플랫폼 / 다운로드
curl -I https://product.kopens.io/plantpulse-edge/install.sh
# 4) PLC 망 — 인터페이스 활성
ip a show enp2s0
# 5) PLC 망 — PLC 도달
ping -c 3 192.168.100.20 # 첫 PLC IP
# 6) PLC 포트 도달 (Modbus 502 예시)
nc -vz 192.168.100.20 502
# Connection succeeded ... 면 정상
# 7) 게이트웨이 자체 시스템 헬스 (컨테이너 모드)
sudo bash /opt/kopens/install/bin/status.sh
curl -ks https://127.0.0.1/api/v1/system/health | python3 -m json.tool
7. Common Pitfalls
| Symptom | Cause / Solution |
|---|---|
| WAN works, but PLC cannot be pinged | NIC 2 IP / Mask / PLC-side gateway settings. Check routing via ip route |
| Internet leakage from PLC network | Missing ipv4.never-default yes in enp2s0. See nmcli con modify enp2s0 ipv4.never-default yes |
| Gateway external IP changed (DHCP) | Connection lost if external SCADA accesses via IP — STATIC recommended |
| Two NICs routing to each other (Bridged) | Check ipv4.method and ipv6.method of NIC 2. Disable bridge mode |
| Slow alarm response from PLC | Check keepalive / packet size of PLC network NIC. See tcpdump -i enp2s0 host <PLC-IP> |
| OPC-UA external client connection refused | Firewall port 12000 blocked / Certificate not trusted. Check firewall-cmd --list-ports and OPC-UA Security |
8. Further Reading
- NIC env during installation: Quick Install — Specifying Site / Network Values
- Network Go/No-Go before production: Production Readiness Criteria
- Automatically opened firewall ports: Installation Guide
- Security hardening for external exposure: Recommended application of REST API authentication (Mandatory if exposed to external networks)