🛠 Configuring an Industrial Router with EdgeComp MS-U320

Objectives

This tutorial aims to transform the BIOSTAR EdgeComp MS-U320 into a robust industrial router or network gateway. Leveraging its two Intel I226-V and I226-LM Ethernet controllers, we will configure network segregation between an operational technology (OT) segment and an IT segment. The goal is to secure Programmable Logic Controller (PLC) data while enabling data upload to the cloud or a central server. We will use Ubuntu 24.04 LTS for its stability and native network tools.

Required Hardware

• BIOSTAR EdgeComp MS-U320 Mini PC (Core 5 320 version recommended for routing)
• Stable 12V-24V DC Power Supply
• Two Cat6 Ethernet cables
• Monitor and keyboard for initial setup
• Bootable USB drive with Ubuntu Server 24.04

Steps

1. System Installation : Insert the USB drive and boot the MS-U320. Enter BIOS (Del key) to set USB boot priority. Install Ubuntu Server on the NVMe M.2 drive. During partitioning, create an LVM partition to facilitate future log management.
2. Interface Identification : Once logged in, identify network interfaces. Ethernet ports are managed by Intel drivers. Use ip link show to list interfaces. Note their names (e.g., eno1, eno2). The I226-V controller is often prioritized for management.
3. Netplan Configuration : The network configuration file is located in /etc/netplan/. Edit it with sudo nano /etc/netplan/01-netcfg.yaml. Define eno1 as the WAN (IT) interface with DHCP, and eno2 as the LAN (OT) interface with a static IP (e.g., 192.168.10.1/24). Ensure IPv4 routing is enabled.
4. Enable Routing : For the MS-U320 to forward packets between networks, enable forwarding. Create a file /etc/sysctl.d/99-forward.conf with the line net.ipv4.ip_forward=1. Apply with sudo sysctl -p.
5. Securing with UFW : Install the firewall sudo apt install ufw. Allow SSH traffic from the IT network only: sudo ufw allow from 192.168.1.0/24 to any port 22. Deny all incoming traffic from the OT LAN to the WAN by default to isolate industrial machines.
6. Log Persistence : Configure rsyslog to send network logs to a remote server if needed, or enable journald with limited size to avoid saturating NVMe storage.

Verification

Test connectivity from a PC on the OT network (LAN) to an IP on the IT network (WAN) using the ping command. Verify routing tables are correct with ip route. Ensure the firewall blocks unauthorized access by attempting an SSH connection from the OT LAN to the WAN.

Going Further

Integrate the MS-U320 into a MQTT architecture for sensor data collection. Exploit the RS232/485 serial ports to connect legacy equipment via protocols like Modbus, using software gateways like Node-RED.