Firewall and DMZ for SCADA in SCADA systems - Step-by-Step Execution

Process Flow - Firewall and DMZ for SCADA

External Network

↓

Firewall: Block/Allow Rules

↓

DMZ Zone: Isolated Network

↓

SCADA Network: Protected Systems

↓

Internal SCADA Devices & Controllers

Data flows from outside through the firewall, which filters traffic, then enters the DMZ, an isolated zone, before reaching the protected SCADA network.

Execution Sample

SCADA systems

firewall-cmd --zone=dmz --add-source=192.168.1.0/24
firewall-cmd --zone=dmz --add-port=502/tcp
firewall-cmd --zone=dmz --add-rich-rule='rule family=ipv4 source address=10.0.0.5 accept'
firewall-cmd --zone=public --remove-source=192.168.1.0/24

Commands to configure firewall zones and rules to isolate SCADA traffic in the DMZ.

Process Table

Step	Command	Action	Result	System State
1	firewall-cmd --zone=dmz --add-source=192.168.1.0/24	Add source network to DMZ zone	Success	DMZ zone includes 192.168.1.0/24
2	firewall-cmd --zone=dmz --add-port=502/tcp	Allow Modbus TCP port in DMZ	Success	Port 502/tcp open in DMZ
3	firewall-cmd --zone=dmz --add-rich-rule='rule family=ipv4 source address=10.0.0.5 accept'	Allow specific SCADA device IP	Success	10.0.0.5 allowed in DMZ
4	firewall-cmd --zone=public --remove-source=192.168.1.0/24	Remove source from public zone	Success	192.168.1.0/24 removed from public zone
5	Traffic from 192.168.1.10 to port 502	Check firewall rules	Allowed	Traffic passes through DMZ to SCADA
6	Traffic from 10.0.0.6 to port 502	Check firewall rules	Blocked	Traffic blocked by firewall
7	Traffic from external network to SCADA	Check firewall rules	Blocked	External traffic blocked unless allowed
8	End	No more commands	N/A	Firewall and DMZ configured correctly

💡 All firewall rules applied; traffic filtered according to DMZ and SCADA protection policies.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
DMZ Sources	[]	[192.168.1.0/24]	[192.168.1.0/24]	[192.168.1.0/24]	[192.168.1.0/24]	[192.168.1.0/24]
DMZ Open Ports	[]	[]	[502/tcp]	[502/tcp]	[502/tcp]	[502/tcp]
DMZ Allowed IPs	[]	[]	[]	[10.0.0.5]	[10.0.0.5]	[10.0.0.5]
Public Sources	[192.168.1.0/24]	[192.168.1.0/24]	[192.168.1.0/24]	[192.168.1.0/24]	[]	[]

Key Moments - 3 Insights

Why do we remove the source network from the public zone after adding it to the DMZ?

Because a source network can only belong to one zone at a time. Removing it from public ensures traffic is filtered by DMZ rules, as shown in step 4 of the execution_table.

Why is traffic from 10.0.0.6 blocked even though port 502 is open in the DMZ?

Because only the IP 10.0.0.5 is explicitly allowed by the rich rule in step 3. Other IPs like 10.0.0.6 are blocked, as seen in step 6.

What is the purpose of the DMZ in SCADA network security?

The DMZ isolates SCADA systems from external networks, filtering traffic through firewall rules before it reaches sensitive devices, as shown in the concept_flow and execution_table steps.

Visual Quiz - 3 Questions

Look at the execution_table at step 3. Which IP address is allowed explicitly in the DMZ?

A 192.168.1.10

B 10.0.0.5

C 10.0.0.6

D 192.168.1.0/24

💡 Hint

Check the 'Command' and 'Result' columns at step 3 in the execution_table.

At which step does the source network 192.168.1.0/24 get removed from the public zone?

A Step 1

B Step 2

C Step 4

D Step 5

💡 Hint

Look for the command that removes the source from the public zone in the execution_table.

If we add 10.0.0.6 to the allowed IPs in the DMZ, what will happen to traffic from 10.0.0.6 at step 6?

A It will be allowed

B It will still be blocked

C It will be redirected

D It will cause an error

💡 Hint

Refer to the variable_tracker for DMZ Allowed IPs and the execution_table step 6.

Concept Snapshot

Firewall and DMZ for SCADA:
- Firewall filters traffic between external and SCADA networks.
- DMZ is an isolated zone for controlled access.
- Add source IPs and ports to DMZ zone.
- Remove sources from public zone to avoid conflicts.
- Only allowed IPs can access SCADA services through DMZ.

Full Transcript

This visual execution shows how a firewall and DMZ protect SCADA systems. Traffic from external networks first hits the firewall, which filters it based on rules. The DMZ acts as a buffer zone isolating SCADA devices. Commands add source IP ranges and ports to the DMZ zone and remove them from the public zone to avoid overlap. Specific SCADA device IPs are allowed explicitly. Traffic tests show allowed and blocked connections based on these rules. Variables track the state of sources, ports, and allowed IPs in each zone. Key moments clarify why sources must be removed from public when added to DMZ, why only allowed IPs pass, and the DMZ's role in security. Quizzes test understanding of IP allowances, zone changes, and traffic outcomes. This step-by-step trace helps beginners see how firewall and DMZ configurations protect SCADA networks.

Practice

1. What is the main purpose of a firewall in a SCADA system?

easy

A. To control and filter network traffic to protect SCADA devices

B. To store data collected from SCADA sensors

C. To provide power backup for SCADA devices

D. To physically connect SCADA devices to the internet

Solution

1. Step 1: Understand firewall function

   A firewall acts like a gatekeeper that controls which data can enter or leave a network.

2. Step 2: Apply to SCADA context

   In SCADA, it filters traffic to protect sensitive control systems from unauthorized access.

3. Final Answer:

   To control and filter network traffic to protect SCADA devices -> Option A

4. Quick Check:

   Firewall controls traffic = C [OK]

Hint: Firewalls filter traffic to protect systems [OK]

Common Mistakes:

• Confusing firewall with data storage
• Thinking firewall provides power
• Assuming firewall connects devices physically

2. Which of the following is the correct way to describe a DMZ in SCADA networks?

easy

A. A network zone that directly connects SCADA devices to the internet

B. A backup power supply for SCADA control centers

C. A secure area that isolates SCADA devices from other networks

D. A software tool for monitoring SCADA device performance

Solution

1. Step 1: Define DMZ purpose

   A DMZ (Demilitarized Zone) is a network area that separates internal systems from external networks.

2. Step 2: Apply to SCADA

   It isolates SCADA devices to reduce risk from outside attacks while allowing controlled access.

3. Final Answer:

   A secure area that isolates SCADA devices from other networks -> Option C

4. Quick Check:

   DMZ isolates SCADA = B [OK]

Hint: DMZ isolates SCADA from other networks [OK]

Common Mistakes:

• Thinking DMZ connects SCADA directly to internet
• Confusing DMZ with power backup
• Assuming DMZ is a software tool

3. Given this firewall rule snippet for a SCADA DMZ:

ALLOW TCP FROM 192.168.1.0/24 TO 10.0.0.5 PORT 502
DENY ALL FROM ANY TO 10.0.0.5 PORT 502

What will happen if a device with IP 192.168.1.10 tries to connect to 10.0.0.5 on port 502?

medium

A. Connection will be logged but not blocked

B. Connection will be denied

C. Connection will be allowed only if using UDP

D. Connection will be allowed

Solution

1. Step 1: Analyze the first rule

   The first rule allows TCP traffic from 192.168.1.0/24 subnet to 10.0.0.5 on port 502.

2. Step 2: Check the second rule

   The second rule denies all other traffic to 10.0.0.5 on port 502.

3. Step 3: Determine rule precedence

   Firewall rules are processed top-down; the first matching rule applies.

4. Final Answer:

   Connection will be allowed -> Option D

5. Quick Check:

   Allow rule matches first = A [OK]

Hint: First matching rule applies in firewall rules [OK]

Common Mistakes:

• Ignoring rule order and choosing deny
• Confusing TCP with UDP protocols
• Assuming all traffic is denied by default

4. A SCADA firewall configuration has this rule:

DENY TCP FROM ANY TO 10.0.0.10 PORT 80

But users report they can still access the web interface on 10.0.0.10. What is the most likely cause?

medium

A. The rule is placed after an ALLOW rule that permits the traffic

B. The firewall does not support TCP filtering

C. Port 80 is not the correct port for web access

D. The IP address 10.0.0.10 is incorrect

Solution

1. Step 1: Understand firewall rule order

   Firewall rules are processed in order; the first matching rule applies.

2. Step 2: Identify rule placement issue

   If a prior ALLOW rule permits traffic to 10.0.0.10 on port 80, the DENY rule after it will not block it.

3. Final Answer:

   The rule is placed after an ALLOW rule that permits the traffic -> Option A

4. Quick Check:

   Rule order affects blocking = A [OK]

Hint: Check rule order; first match wins [OK]

Common Mistakes:

• Assuming firewall ignores TCP filtering
• Thinking port 80 is wrong without checking
• Assuming IP address is incorrect without evidence

5. You want to design a SCADA network with a DMZ to isolate control devices from the corporate network. Which setup best improves security?

hard

A. Allow all traffic between corporate network and SCADA devices for easy access

B. Place SCADA devices in the DMZ and allow only specific traffic from the corporate network through a firewall

C. Place SCADA devices behind the corporate firewall without a DMZ

D. Connect SCADA devices directly to the corporate network with no firewall

Solution

1. Step 1: Understand DMZ role in SCADA

   A DMZ isolates SCADA devices from the corporate network to reduce attack risk.

2. Step 2: Apply firewall rules

   Allow only specific, necessary traffic from corporate network to SCADA devices through firewall.

3. Step 3: Evaluate options

   Place SCADA devices in the DMZ and allow only specific traffic from the corporate network through a firewall uses DMZ and firewall properly; others expose SCADA or allow unsafe access.

4. Final Answer:

   Place SCADA devices in the DMZ and allow only specific traffic from the corporate network through a firewall -> Option B

5. Quick Check:

   DMZ + filtered firewall access = D [OK]

Hint: Use DMZ plus filtered firewall rules for SCADA security [OK]

Common Mistakes:

• Connecting SCADA directly to corporate network
• Skipping DMZ and relying on firewall only
• Allowing all traffic for convenience