Three Ways to Place a Firewall Between IT and OT

One wrong firewall rule and the Enterprise network talks straight to your PLC.

A firewall between IT and OT is not one box you buy. It is a placement decision, and there are three common ways to make it. Only one of them really keeps OT separate.

This article walks through all three topologies, shows the rules behind each one, and explains why the boundary only counts after you test it.

What a Firewall Does in OT

A firewall is a gate between network zones.

In OT it controls three things.

Which system may talk.

Which protocol they may use.

And in which direction.

The placement of that gate decides how much protection the rules can give you.

One Firewall

One gate between Enterprise and OT.

Simple. Good for a small lab or a simple network.

But if one rule is too open, Enterprise reaches OT directly.

• Engineering PC → EWS: allow only the required port
• Enterprise → PLC: deny
• Internet → OT: deny

The rule that breaks this model is the one that looks harmless in the config:

• Enterprise → OT: allow any

One line, and the boundary is gone.

Two Firewalls

Now traffic must pass two control points.

Good for critical OT networks.

• Enterprise → Middle Zone: only the jump host
• Middle Zone → OT: only admin or monitoring traffic
• Enterprise → OT: deny

More separation.

But also more rules to manage.

One Firewall with a DMZ

The DMZ is a buffer zone between Enterprise and OT.

It holds the systems both sides need:

• jump host
• historian mirror
• patch server
• file transfer
• remote access gateway
• log collector

The rule set stays short:

• Enterprise → DMZ: only DMZ services
• DMZ → OT: only required traffic
• Enterprise → OT: deny
• Internet → OT: deny

One Rule Under All of Them

All three topologies protect the same principle.

Enterprise should not talk directly to OT.

Traffic must pass through a controlled service in between.

For learning, I use one firewall with a DMZ. It is simple to run and still teaches the real OT boundary.

But the topology diagram is not the boundary.

A boundary is not real until you test it.

You send traffic.

You watch what the firewall stops.

You watch what it lets through.

If nobody has ever sent a denied packet at the rule, the rule is a hypothesis, not a control.

OT security must be testable. Not documented.

Try It Yourself

• Start free: github.com/zakharb/labshock — the lab runs locally with Docker, no cloud.
• Loginward is the free starter zone; the firewall and segmentation labs live in Firegate.
• Build the DMZ topology, send traffic across it, and watch which rules actually fire: labshocksecurity.com.
• Questions, or want to compare firewall designs: discord.gg/bpmaQFfW76