Documentation
DocsOT Protocols & Networks

Purdue Model Firewall Policies

Estimated reading time: 3 min

The Purdue model, briefly

The Purdue Enterprise Reference Architecture (PERA) segments the industrial network into levels (0 to 5) so that an incident in IT (level 4-5, offices/ERP) can never reach physical control directly (level 0-2, sensors and PLCs). iGromi OS is deployed respecting that segmentation rather than ignoring it.

The levels that matter for your firewall

  • Level 0-1: Sensors, actuators, PLCs. Isolated field network, no direct internet access.
  • Level 2: Local SCADA/HMI for the line.
  • Level 3 (industrial DMZ): This is where the iGromi Bridge lives. It is the only boundary authorized to cross between OT (0-2) and IT (4-5).
  • Level 4-5: ERP, corporate cloud, internet.

Golden rule: outbound-only

The iGromi Bridge is designed to accept no inbound connections from the cloud. Every connection is initiated by the Bridge itself, outbound (WSS/MQTT over TLS 443). In practice, on your plant firewall:

  1. Do not open inbound ports from the internet into the OT segment. Ever.
  2. Allow outbound only from the Bridge's IP towards the iGromi Cloud endpoints, port 443/8883.
  3. Explicitly block any traffic from the office segment (level 4) straight into the field segment (level 0-1) — the Bridge is the only permitted crossing, and only in the OT→Cloud direction.

Verification

Under this policy, a port scan (Nmap/Shodan) run from the internet against your plant's public IP should find no open port associated with the Bridge — it is undetectable because it never listens, it only initiates connections.

Was this documentation helpful?