OT perimeter firewall rules: industrial ports named in CISA advisories

Review your perimeter and zone firewalls for rules that allow industrial protocol ports across IT, OT or the internet. CISA advisories name TCP 102 for S7comm, TCP 502 for Modbus TCP, TCP 20256 for Unitronics remote access and UDP 1502 for TriStation. Deny them by default and allow only named hosts.

Ports named in agency material

• TCP 102, Siemens S7comm, AA26-231A advises blocking it at perimeter firewalls
• TCP 502, Modbus TCP, AA22-103A describes a tool using normal management protocols and Modbus TCP 502
• TCP 20256, Unitronics Vision remote communication default, AA23-335A
• UDP 27127, PLC scanning by a Schneider targeting tool, AA22-103A
• UDP 1740, CODESYS password brute forcing, AA22-103A
• UDP 1502, TriStation, MITRE ATT&CK entry for Triton

Treat the table as a starting list of what to look for, not a complete one. Your own inventory lists the protocols you actually run.

The rule behind the ports

The Volt Typhoon advisory says to deny all connections into OT networks by default and allow only explicitly approved IP and port combinations, with required traffic routed through a monitored intermediary. The ransomware advisory says to prohibit ICS protocols from traversing the IT network.

Review procedure

1. Export all firewall rules at the IT to OT boundary and at the internet edge.
2. Filter for the ports above plus those from your inventory.
3. For each rule, find an owner, a purpose, the allowed source and destination, and a review date.
4. Remove rules with no owner. Narrow broad ones from subnets to named hosts.
5. Check for any rule that allows these ports from the internet. Remove them unless there is a documented, protected need.
6. Check hit counts or logs to see whether rules are used.
7. Test from the IT side that a controller does not answer on its protocol port.

Zone to zone rules

Inside OT, restrict controller protocols to the engineering and supervisory hosts that need them. For safety controllers, allow almost nothing. Use the zones and conduits you defined in your inventory.

Keep the rules honest

Document the intended flows in a conduit register and compare it with the actual rule base each quarter. Alert on rule changes at these boundaries. Use change tickets for every exception.

Limits

A port rule alone does not secure a protocol, and attackers can use other paths. Pair it with authentication on devices, logging, and monitoring of the permitted traffic.

Quick check

Sources

• CISA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A
• CISA, APT Cyber Tools Targeting ICS/SCADA Devices, AA22-103A
• CISA, IRGC-Affiliated Cyber Actors Exploit PLCs, AA23-335A
• MITRE ATT&CK, Triton (S1009)
• CISA, Volt Typhoon advisory AA24-038A
• CISA, DarkSide Ransomware advisory AA21-131A

Last reviewed: 19 October 2026.