One rule set for every industrial protocol.
RagerSec understands the protocols of manufacturing, energy and building automation down to the function level. Version 1 starts with Siemens S7, OPC UA and Modbus/TCP, with more protocols following step by step.
Supported protocols
| Protocol | Use | Transport | Status |
|---|---|---|---|
| Manufacturing | |||
| S7comm | Siemens S7-300/400 | TCP 102 | Version 1 |
| S7CommPlus | Siemens S7-1200/1500 | TCP 102 | Version 1 |
| OPC UA | multi-vendor | TCP 4840 | Version 1 |
| Modbus/TCP | multi-vendor | TCP 502 | Version 1 |
| EtherNet/IP (CIP) | Rockwell, Omron and others | TCP 44818 · UDP 2222 | In development |
| PROFINET | field devices | Ethernet 0x8892 | Planned |
| Energy & utilities | |||
| IEC 60870-5-104 | telecontrol | TCP 2404 | In development |
| DNP3 | telecontrol, water | TCP 20000 | In development |
| IEC 61850 MMS | substations | TCP 102 | Planned |
| IEC 61850 GOOSE | substations | Ethernet 0x88B8 | Planned |
| Buildings & IIoT | |||
| BACnet/IP | building automation | UDP 47808 | Planned |
| MQTT | IIoT, telemetry | TCP 1883 · 8883 | Planned |
What is blocked by default
For every protocol, RagerSec distinguishes between read access and functions that change the process. Critical functions stay blocked until you explicitly allow them, for example for a maintenance window.
| Protocol | Blocked by default | Allowed per rule |
|---|---|---|
| S7comm / S7CommPlus | PLC stop, block download, start and reset commands | Reading and writing variables in approved areas |
| Modbus/TCP | Write (FC 5, 6, 15, 16), diagnostics (FC 8), vendor-specific programming functions | Read (FC 1–4) in approved register ranges |
| OPC UA | Write and Call outside approved nodes, connections with SecurityMode “None” | Browse, Read, subscriptions |
| EtherNet/IP (CIP) | Tag writes, reset, program download | Tag reads |
| IEC 60870-5-104 | Commands (C_SC, C_DC, C_SE) and reset process (C_RP) from unknown stations | Monitoring (M_*), interrogation (C_IC) and clock sync (C_CS) from the control centre |
| DNP3 | Select/Operate, Direct Operate, cold/warm restart, stop application | Read, unsolicited responses |
| IEC 61850 | Control commands (Operate), file transfer, unknown GOOSE publishers | Reading data objects, known GOOSE streams |
| BACnet/IP | WriteProperty on critical objects, ReinitializeDevice, DeviceCommunicationControl | ReadProperty, Who-Is/I-Am |
| MQTT | Publish to control topics by unknown clients | Telemetry topics, subscribe |
Encrypted connections
Many protocols can be secured today, for example OPC UA with SignAndEncrypt, S7 with TLS or MQTT over TLS. For OPC UA, RagerSec can enforce a minimum security mode.
When content is encrypted, RagerSec enforces rules at the connection and endpoint level and logs every session. Inspecting individual functions is not possible in that case.
Looking for pilot sites
We are looking for operators and system integrators in manufacturing, energy and building automation to test RagerSec in our early access program.