← lab guides · 2026-07-15 · 150m
OT Segmentation: Purdue Levels on a Budget
VLAN + firewall rules to isolate a fake PLC/HMI from corp LAB.
topic: ics-ot, security · tool: pfsense, eve-ng · difficulty: intermediate
TOPOLOGYFig. — lab diagram
[ LAB TOPOLOGY — add topology.svg to this bundle ]
[ PC1 ]──[ SW1: vlan10 ]──[ R1 ]──[ FW ]── Internet
└─ vlan99 MGMT vlan20 OT (PLC/HMI)On this page
Objective
You model Purdue levels 1 through 3 with VLANs. You place the PLC and HMI on VLAN 20, the historian on VLAN 30, and you build the Level 3.5 DMZ with pfSense. The historian alone can poll the PLC on Modbus TCP 502.
Steps
- On pfSense, create VLAN interfaces for VLAN 20 (OT), VLAN 30 (HIST), and VLAN 10 (LAB).
- Add firewall rules: allow HIST to OT on port 502, deny LAB to OT, and allow OT to HIST for syslog alone.
- From each segment, test with
nc -zv 192.168.20.10 502. - Mirror the OT switch port to Wireshark and filter
tcp.port==502.
Gotcha
In pfSense you work top to bottom. A floating rule can override an interface rule with no warning. I left a permissive floating
allow all from setup and isolation failed until I tracked it down.Takeaways
- Use Purdue as a mental model for separation
- Write explicit allow rules. Broad denies hide mistakes.
- Check logs at
Status > System Logs > Firewall