Network requirements for the gateway

These requirements apply to the on-site network at the WAN port of the gateway. The gateway sends over the cable as soon as the cable has internet. If that fails, the backup SIM takes over. The traffic then runs over the mobile network, outside the on-site firewall.

Outbound connections only

The gateway opens the connection to the ModbusCloud broker itself, from inside to outside. You do not open any port towards the gateway. A fixed IP address and port forwarding are not needed. A stateful firewall lets the replies to that connection through automatically, also behind NAT.

Ports and protocols

The table shows which outbound traffic the gateway needs.

Where the readings go after the broker is described in Where your data is stored and who can access it.

If the firewall blocks only port 8883, the gateway stays on the cable. Ping still works, so as far as the gateway can tell, the cable has internet. The portal receives nothing and shows the gateway with the status Pending or Offline. The fix is described in Gateway does not come online.

The WAN port

Connect the WAN port to the on-site network. It gets its IP address through DHCP. If you want the gateway to always get the same address, for example for a firewall rule, make a reservation in the DHCP server. The WAN port does not accept connections from outside. How to connect the cable is described in Connect to the network via WAN and LAN.

The LAN port

The LAN port is for Modbus TCP devices that you connect directly to the gateway. The gateway does not forward traffic from the LAN port to the WAN port or the SIM, and it does not answer DNS queries from the LAN side. A Modbus TCP device or laptop on the LAN port therefore does not reach the on-site network or the internet through the gateway.

4G only

If there is no cable in the WAN port, the gateway sends everything over the backup SIM. Nothing then passes over the on-site network, and the IT department does not need to set anything up.

Over 4G, the gateway does not read out more often than the SIM interval, by default 300 seconds (5 minutes). More about the SIM is in 4G and the backup SIM. What the 4G data costs is described in 4G data and costs.

Gateway and Modbus TCP devices in their own VLAN

Modbus TCP on port 502 has no password and no encryption. Anyone on the same network can read and control a Modbus TCP device. Put the gateway and the Modbus TCP devices together in their own VLAN. The background is in the course lesson Modbus TCP on your network.

From that VLAN, the gateway only needs the outbound traffic from the table. Automatic search looks for Modbus TCP devices on port 502 in the own subnet of the gateway. If that subnet is larger than a /24, the gateway only searches the /24 around its own address.

The gateway only searches the network on the WAN side when it sends over the cable. If the Modbus TCP devices are in a different subnet, automatic search does not find them. How the search works is described in Automatic search.

Check the connection of the gateway

In the portal you can see whether the gateway sends over the cable or over 4G. An owner, admin or technician sees the pencil in the header.

1. Open the gateway list

   Open Gateways in the menu.

2. Open the gateway

   Click the gateway.

3. Open the settings

   Click the pencil on the right in the header (Gateway settings).

4. Read the connection

   In the block Uitlezen via de SIM (reading via the SIM), look at Verstuurt nu via (sending now via). It shows Kabel (cable) or SIM, with the time at which the gateway switched to that connection.

If it shows SIM while the cable is in the WAN port, the gateway sees no internet over the cable. Check whether the gateway gets an address through DHCP and whether the firewall lets ping to the internet through.