Firegate Is Live: A 6 kV Substation You Can Operate

Firegate is live.

A new zone inside World of Labshock, built around a 6 kV substation, running two of the protocols used to control power, water and infrastructure.

• DNP3
• IEC 60870-5-104

Now you can see how they work inside one system.

Not in slides.

Not in packet diagrams only.

Inside a running substation.

One Control Chain

This is the part a diagram cannot give you.

One command, followed through every layer.

Each arrow is a place where OT security actually lives.

A packet that is technically valid can still be an operation nobody authorized.

A breaker that changes state is a physical event with a physical consequence.

Telemetry returning is how the operator learns it happened.

And whether the IDS saw any of it is a separate question from whether it worked.

What You Can Do In The Zone

• capture live protocol sessions
• read protocol fields
• map addresses and points
• operate approved commands
• test what happens when communication changes
• validate whether detection fires

That last item is why the zone exists in this shape.

You can only validate detection if the activity you are detecting is real activity.

Replaying a capture tells you the signature matches a capture.

Operating a breaker and checking the IDS tells you the rule works.

What Is In The Substation

• RTUs
• SCADA
• feeders
• breakers
• disconnectors
• industrial routing
• DNP3 and IEC 104 communication

Everything is connected.

Everything can be observed.

Everything can be tested.

Why This Was One Of The Biggest Builds

OT security cannot stop at knowing a protocol.

Knowing that DNP3 uses SELECT then OPERATE is a fact.

Watching a SELECT get validated, sending the OPERATE, and seeing a breaker move is knowledge.

The two are not close to the same thing.

To get there you must see the command, follow the signal, understand the process result, and prove whether the security control works.

That requires the whole chain to exist at once: SCADA, RTUs, the network between them, the field devices at the end, and detection watching.

Building the pieces is one job.

Building them so that everything is connected, observable and testable is what took the time.

OT security must be testable.

Not documented.

Try It Yourself

• Start free: github.com/zakharb/labshock — the lab runs locally with Docker, no cloud.
• Loginward is the free starter zone; the substation lives in Firegate at labshocksecurity.com.
• Open a live DNP3 or IEC 104 session, map the points, send one approved command, and check what the IDS reported.
• Work with substations? The interesting question is whether your production detection would have caught it: discord.gg/bpmaQFfW76