43. IoT and OT Security – Cameras, Smart Devices, Plant Networks

43.5 Network Segregation – IT / OT Zones, Jump Hosts, firewalld

By Ravindra Bagale · Last updated: 27 September 2026

Flat LAN = camera compromise → billing DB. Blue pattern (Purdue-model idea, simplified for SME):

1. IoT VLAN – cameras, MQTT sensors only
2. OT VLAN – packing PLC / HMI (if you have a real plant lab later – still isolated)
3. IT VLAN – office PCs, Raja's ERP
4. Firewall between zones – default deny; allow only listed flows
5. Jump host (bastion) for admins – MFA, logging, no direct RDP from internet to HMI

# Amazon Linux lab edge – example allow-list thinking (host-only demo IPs)
sudo yum install firewalld
sudo systemctl enable firewalld
sudo service firewalld start
sudo firewall-cmd --permanent --new-zone=iotlab
sudo firewall-cmd --permanent --zone=iotlab --add-source=192.168.56.50/32
# IoT VM may reach MQTT broker on .40:1883 only (lab); no forward to Metasploitable DB ideas
sudo firewall-cmd --permanent --zone=iotlab --add-rich-rule='rule family="ipv4" destination address="192.168.56.40" port port="1883" protocol="tcp" accept'
sudo firewall-cmd --reload
sudo firewall-cmd --list-all-zones

Ubuntu note: sudo apt install firewalld or use ufw with equal care – sudo service ufw status. Don't invent a second brain with both ufw and firewalld fighting.