What's actually in the box labeled firewall? Enterprise, DIN rail, open source, and a switch with an ACL. ANY ANY ANY ALLOW: that's not a firewall, that's a $20,000 router.

Every OT network diagram I've ever seen has a box labeled "firewall."

Almost none of them say what's actually in that box.

Here's what I find when I go look.

The big names

FortiGate, Cisco, Palo Alto, Check Point. More capable, more complex. Deep inspection, central management, threat feeds, the works. Some are rugged models built for the plant. A lot are IT boxes somebody dropped into a substation because corporate already had the license. These usually belong to the IT team, or a dedicated OT security team if the site is lucky.

DIN rail

Phoenix Contact mGuard, Hirschmann EAGLE, Moxa, Siemens SCALANCE S, Westermo. Built for the cabinet. They handle the heat, run on 24VDC, and come with a simple web GUI. These usually belong to the controls team. The engineers and integrators who built the line can stand up a rule without opening a ticket. They tend to get configured once and never touched again.

So two very different worlds. One team has the tools but doesn't know the process. The other team knows the process but doesn't live in firewall rules.

Sometimes I see both. Big vendor at the IT/OT boundary, DIN rail down at the cell. That's a good day.

And sometimes I see neither.

The old ones, the open source ones, and the ones that aren't firewalls

Tofino boxes from 2012 still in a panel with firmware nobody has looked at since install day.

pfSense. OPNsense. On a mini PC sitting on top of the cabinet. I've seen it more than people want to admit. Sometimes it's the best-managed firewall on the site because one engineer actually cares about it. Sometimes it's a single point of failure that only one person knows how to log into.

And the most common one of all. A managed switch with an ACL that someone calls a firewall.

Here's the part nobody wants to hear

You can buy the most expensive, most capable firewall on this list and it won't do a thing for you if it's configured badly.

That's not a firewall. That's a $20,000 router.

Brand only matters once the basics are equal. Get to a real least privilege policy first. Every rule has a reason, every zone is restricted, management is locked down, and someone reviews it. Then we can argue FortiGate vs Palo vs mGuard. Until then, the brand on the box is the least important thing about it.

And know what happens when it fails. Fail open or fail closed? Most sites can't tell me.

Watch the short version

I recorded the 90 second version of this: That's Not a Firewall.

Now I want to hear from you

What's really sitting between your IT and OT? Who owns it: IT, OT, or controls? Who's running pfSense or OPNsense in production, and how's that going? Big vendor at the boundary, DIN rail down at the cell, or both? And what's the worst rule set you've ever found? ANY/ANY counts.

Find me on LinkedIn and tell me. I read every one.