Network Configuration — Gateway Deployment Guide
The gateway is designed with two NICs so that the PLC network and the WAN are physically separated. This is the standard configuration for appliances and industrial PCs.
- LAN1 = PLC (eth1 / enp1s0, etc.) — a single PLC, or multiple PLCs behind a switch
- LAN2 = WAN (eth2 / enp2s0, etc.) — internet / Platform / OTA
- wlan0 / wwan0 / tun0 / usb0 — WiFi / GSM / VPN / management USB-Ethernet
NIC name mapping can be adjusted per box via edge.net.lan1.iface in /etc/kopens/app.properties
(override with the LAN1_IFACE=enp1s0 ... bash install.sh env var when running install.sh). This is used only for the
monitoring card display — IP configuration itself is the responsibility of the OS NetworkManager / netplan. install.sh can also optionally
apply nmcli static IP settings (LAN1_IP=192.168.100.10/24 LAN2_IP=192.168.0.10/24 ... bash install.sh).
1. Standard Topology
┌──────────────────────┐ ┌─────────────┐
│ 상위 플랫폼 / 클라우드 │ ◀─── HTTPS / MQTT ─── │ 게이트웨이 │
│ (PlantPulse / SCADA) │ └─────────────┘
└──────────────────────┘ enp1s0 │ enp2s0
│ │
┌───────────────┘ └────────────┐
│ │
WAN (외부) PLC 망 (내부)
│ │
│ ┌───┴────────────┐
│ │ │
PLC₁ PLC₂ PLC₃
(Modbus / S7 / OPCUA)
| NIC | Name (Fedora 38 default) | Role | Default gateway? |
|---|---|---|---|
| NIC 1 | enp1s0 | WAN — external internet / upstream Platform / NTP | ✅ Yes |
| NIC 2 | enp2s0 | PLC network — private IP, dedicated to PLC communication | ❌ No (ipv4.never-default yes) |
2. Recommended IP Design (Example)
| Segment | CIDR | Purpose |
|---|---|---|
| WAN | DHCP or corporate network / 192.168.0.0/24 | Gateway external IP — office network |
| PLC network | 192.168.100.0/24 | PLC-only private network — isolated from the WAN |
| Gateway itself | WAN: 192.168.0.50 / PLC: 192.168.100.10 | |
| PLC | 192.168.100.20–254 | Per line / per cell |
3. Configuration by Scenario
3.1 Simple Configuration — Single Corporate Network
For cases where the PLCs are attached directly to the corporate network and there is no separate PLC subnet. There is no need to put both NICs on the same network:
- Use only
enp1s0(WAN) — DHCP or STATIC enp2s0unused (or link down)
For 2026.05+ installations, omit LAN2_IFACE when running install.sh, or leave the unused NIC down in the OS NetworkManager after installation. The legacy native setup.sh may still prompt for a second NIC, so only consider disabling set-2.sh on older boxes.
3.2 Standard Separated Configuration — WAN + PLC Network (Recommended)
Exactly as in 1. Standard Topology above. From a security standpoint, this allows the PLC network to be completely isolated from the external internet — the gateway is the only bridge between the two networks. The PLCs are not visible from the internet.
3.3 Three NICs — WAN + PLC + Management
For large sites. Requires an additional step in setup.sh (set-usb-mgnt.sh is commented out — it can be enabled):
enp1s0(WAN) — externalenp2s0(PLC) — private PLC networkenp3s0or USB-Ethernet (management) — a separate channel for diagnostics / inspection (corporate IT)
The Management Port on the home card displays this NIC's IP.
3.4 Cloud / VM with a Single NIC
For VM environments with only one NIC — all traffic shares the same virtual network. NIC separation is handled on the host OS via vSwitch / VLAN.
4. Accessing the Gateway from Outside
To reach the gateway's web UI from outside (office PC, mobile) after deployment:
| Scenario | Method |
|---|---|
| Within the same corporate network | Directly via https://<gateway-wan-ip>/ui/main |
| External → corporate network | Connect via VPN, then same as above |
| External → internet (risky) | Firewall NAT forwarding + REST API authentication required + HTTPS |
The gateway v1 REST interface uses
X-API-Key/ Bearer authentication. Even so, direct exposure to the internet is not recommended. Allow external access only behind an additional protection layer such as a VPN or an mTLS/API gateway.
5. Firewall — Exposed Ports
install.sh registers the ports required for container mode with the firewall. The detailed port table for legacy native installs remains in
(legacy) Full H/W Installation, Section 5.1.
The essentials: 80 / 443 (web UI) + 1880 (Node-RED) + 12000 / 12443 (OPC-UA) + 1883 / 8883 (MQTT, if used).
In production, block any port that does not require external access at the firewall, or block it on the WAN NIC only (firewall-cmd --remove-port).
6. Network Verification
Check network reachability immediately after installation or just before adding a PLC:
# 1) WAN — 외부 ping
ping -c 3 8.8.8.8
# 2) WAN — DNS
nslookup google.com
# 3) WAN — 플랫폼 / 다운로드
curl -I https://product.kopens.io/plantpulse-edge/install.sh
# 4) PLC 망 — 인터페이스 활성
ip a show enp2s0
# 5) PLC 망 — PLC 도달
ping -c 3 192.168.100.20 # 첫 PLC IP
# 6) PLC 포트 도달 (Modbus 502 예시)
nc -vz 192.168.100.20 502
# Connection succeeded ... 면 정상
# 7) 게이트웨이 자체 시스템 헬스 (컨테이너 모드)
sudo bash /opt/kopens/install/bin/status.sh
curl -ks https://127.0.0.1/api/v1/system/health | python3 -m json.tool
7. Common Pitfalls
| Symptom | Cause / Resolution |
|---|---|
| WAN works but the PLC does not respond to ping | Check NIC 2's IP / mask and the gateway setting on the PLC side. Verify routing with ip route |
| Internet traffic appears to leak onto the PLC network | ipv4.never-default yes is missing from enp2s0. nmcli con modify enp2s0 ipv4.never-default yes |
| Gateway external IP changed (DHCP) | If an external SCADA connects by IP, the connection drops — STATIC is recommended |
| The two NICs route to each other (bridging) | Check ipv4.method and ipv6.method on NIC 2. Disable bridge mode |
| Alarm responses from the PLC side are slow | Check the keepalive / packet size on the PLC network NIC. tcpdump -i enp2s0 host <PLC-IP> |
| External OPC-UA clients are refused | Port 12000 blocked by the firewall / certificate not trusted. Check firewall-cmd --list-ports and OPC-UA Security |
8. Learn More
- NIC env vars at install time: Quick Install — Specifying Site and Network Values
- Network Go/No-Go before going into production: Production Acceptance Criteria
- legacy native NIC input: (legacy) Full H/W Installation, Sections 4.2–4.3
- Ports opened automatically in the firewall: (legacy) Full H/W Installation, Section 5.1
- Hardening for external exposure: applying REST API authentication is recommended (mandatory when exposed to an external network)