Incoming Firewall

Avatar

rudiemm
2017-08-15 10:22

The minimum ports that must be open or forwarded are 22 (ssh); 80 (http) and 443 (https).
Depending on the connections to meters that you need to configure, there might be a large number of
other ports that need to be opened.
If you keep to Generic APN Modems and/or Passive Etherpads, you are fine with just opening 22, 80 and
443.
If you are going to use the KoCoS Elster modem, you need to open port 56267.
If you are going to use the TruTeq modem, you need to open port 7627.
If you are going to use a Siemens/Cinterion TC65 based modem and running our Java program on the
modem, you need to open port 8265.
If you are going to use one of our J2ME applications to interact with the server, for instance for the
technician to call in his meters on his cell phone from site, or to take manual readings on his cell phone,
you need to open port 65530.
If you are going to monitor the performance of your server remotely with the Java Manager classes
(typically using jconsole); you need to open port 65525.
There may be various other ports you need to open depending on the devices you need to interact with:
each Generic Active GPRS modem and Active Etherpad connects on a different port that you set during
configuration on the system. The CAT handheld reader needs to do FTP, and as such needs dynamically
allocated open ports from 65000 and up.
The Plug and Play ScadaTM Server runs Linux and its own firewall, and is considered very secure. You
should be able to open all ports with no adverse effect

Avatar

sdg.marinusvz
2012-11-15 08:01

An additional port that is needed now is port 21 (ftp); if you want to use any kind of meter that does FTP uploads, e.g. the Sensus Scount water metering system.
Other ports that may be needed are 2223 for the Hexing concentrators, and 7259 for SYM2 meters.
Please also make it possible to do NTP from the server. This is incoming and outgoing UDP port 123.

Avatar

sdg.marinusvz
2012-11-15 08:04

You do NOT need to open port 25!! (SMTP)
If you configure SNMP on PNPSCADA, you would need to open UDP ports 161 and 162.

Avatar

sdg.matiaan
2017-05-29 17:00

Also ports 13000-13999 and 23000-23999 are used for Generic Modem and Etherpads respectively.

Port 10001 is used for the TCP Bridge (programming meters over the internet)

Avatar

sdg.matiaan
2017-10-27 10:18

Avatar

sdg.matiaan
2019-09-11 13:49

Incoming Firewal

here are the incoming TCP ports that are used:
22 // ssh
80 // http
8080 // http webservices
443 // https
441 // https webservices
445 // https webservices
65000+ // FTP
1883 // MQTT
8883 // MQTT SSL
7259  // SYM2/IPT
2223  // hexing port    (HXET-100 Actom)
2224  // SIEMENS mvz20140525
2225  // Holley mvz20140527
2226  // INHE old PLC concentrator
2227  // CLOU
2228  // Wasion (Concentrator) Netvendor
2229  // Hexing - DLMS (Empire and otherwise)
2230  // Wasion GPRS modem
2231  // placeholder
2232  // easypay prepaid
2233  // hexing2 (HXET-200 Empire Hexing)
2234  // LINYANG / Ruvick (concentrator?)
2236  // LINYANG / Ruvick GPRS modem
2235  // Sanxing modem
2237  // REALLOG (Real Telematics rts) Shane/Macrocomm
2238  // Orange Pi -> Telbit concentrator
2239  // Holley GPRS
2240  // ISO8583
2241  // INHEDLMS (internal GPRS modem)
2242  // Inhe new PLC Concentrator (DLMS/HDLC)
2243  // Inhe Collector (that GPRS Collector talking RS485 to stuff and that periodically sends e.g. type:4ID:99455256GPS:Ver:2.10   note its physical serial is 37199455256)
2244  // Burb Catcher OPiLite
2245  // Linyang GPRS modem LINYANGDLMS
2246  // Linyang Concentrator (DLMS)
2247  // reserved
2248  // reserved
2249  // reserved
2250  // reserved
2251  // reserved
2252  // reserved
3306   //mysql
7627   //SMARTEE_PORT
8080   //alternative HTTP port
8265   //TC65_PORT
12345  //SERVERTCPLISTENER_PORT
56267  //KOCOS_PORT
65525  // jconsole
65530  // J2ME
10201-10299     //acquisition: rtus
13000-22999     //dynamically allocated maestros
23000-32999     //dynamically allocated active etherpads

outgoing TCP:
196.22.139.148 12345  // licensing
[your other server IPs] 12345 // replication backups
also remember any of your APN IP and ports

Avatar

sdg.matiaan
2024-04-29 10:29
Last Edited 2024-04-29 15:02

Incoming Firewal

4 ways to set up an APN
1) Internet Breakout
You can set up your APN with your service providers to have internet breakout.
This allows your modems to connect out on the internet.
You can then use the server's public internet IP to connect to the server
*does not allow passive mode
*easy to set up
2) Gateway
If you already have an APN set up at your office and your PNPSCADA server is also at your office, you can just map a subnet to your APN gateway
*This typically works for places like municipalities that already has a lot of IT infrastructure set up at their office
3) IPSec / VPN
You can arrange for your PNPSCADA to have a direct connection into the service provider (such as MTN / Vodacom / Flick Switch) onto the APN. PNPSCADA can install software (such as openvpn or strongSwan) to enable the connection.
*Difficult to set up initially as it needs participation between 4 parties (MTN and PNPSCADA and IT and the technician with the modem)
*Typically gives best performance
4) Server Modem or Router
Connect a modem to your server, or a modem in the same network as the server, with one of your APN SIMs in
*You pay twice for the data, once at the server side and once at the modem side.

Please log in to post a comment