W&T 55211 User manual

Manual
Startup and application
Microwall
Valid for the following models:
#55211: Microwall VPN
Firmware 1.30 or higher
#55212: Microwall IO
Firmware 1.10 or higher
Release 1.06 006/2022
W&T
www.WuT.de

W&T
© 06/2022 by Wiesemann und Theis GmbH
Microsoft and Windows are registered trademarks of Microsoft
Corporation.
WireGuard and the WireGuard logo are registered trademarks
of Jason A.Donenfeld
Subject to error and alteration:
Since we can make mistakes, none of our statements may be
used unchecked. Please report any errors or misunderstan-
dings you become aware of so that we can identify and cor-
rect them as quickly as possible.
Only carry out work on or with W&T products if you are de-
scribed here and have read and understood the instructions
completely. Unauthorized action can cause dangers. We are
not liable for the consequences of arbitrary action. In case of
doubt, please ask us or your dealer again!
This device contains software components that are licensed
under one or more open source licenses. For more informati-
on, refer to your device.
You can also obtain the source text from us in the form of a
data carrier at cost price for a period of three years after the
last delivery. Please contact us for this purpose at info@wut.
de.

W&T
Introduction
The Microwall VPN and Microwall IO are industrial-grade IPv4
router with two 1000BaseT network connections, integrated
whitelist-based firewall and a WireGuard VPN access. They
connect a network island, e.g. with automation components,
to a higher-level local network. Parallel to this, secure remote
access to the participants of the island network can take place
via the Wireguard VPN as a client or server. Suitable filter
rules at TCP/IP level protect all networks from unauthorized,
undesired and harmful communication.
The Microwall IO has 2 digital inputs and 2 digital outputs,
which allow the control of router/firewall functions and the
evaluation of messages in automation environments.

W&T
Content
1 Legal information and safety����������������������������������� 7
1.1 Legal notices .....................................................................8
1.2 Safety notices ..................................................................10
2 Hardware, interfaces and displays ������������������������ 13
2.1 Hardware installation........................................................14
2.2 Power supply....................................................................15
2.2.1 PoE- supply .................................................................15
2.2.2 External power supply ................................................15
2.3 Network Interfaces........................................................... 16
2.4 System and Error LED.......................................................18
2.4.1 System LED (green) .................................................18
2.4.2 Service LED (red) .....................................................18
2.5 Service button.................................................................. 19
3 Start-up ������������������������������������������������������������������ 21
3.1 IP assignment via DHCP ................................................... 22
3.2 Initial assignment of IP parameters with WuTility .............23
3.3 Start-up via the default IP address....................................26
3.4 Initial web page ...............................................................27
4 Web based management ���������������������������������������� 31
4.1 Start and navigation concept of the WBM ......................... 32
4.2 Login/Logout...................................................................33
4.3 Help and description texts ............................................... 34
5 DHCP server & Discover assistant ������������������������� 35
5.1 DHCP server.....................................................................36
5.2 Discover assistant............................................................38
6 Operating modes and rule configuration ��������������� 39
6.1 Mode NAT router ............................................................. 40
6.2 Mode Standard router .....................................................42
6.3 Mode Standard router with static NAT..............................44
6.4 IP inventories...................................................................46
6.4.1 Scan of Network 2.......................................................47
6.5 Creating firewall rules...................................................... 48
6.5.1 Using hostnames as the target of a rule ......................51
6.6 Examples Firewall rules....................................................52
6.6.1 Mode Standard router, Network 2 to Network 1 ..........52
6.6.2 Mode NAT-Router, Network 1 to Network 2.................54

W&T
7 Wireguard VPN server �������������������������������������������� 57
7.1 Overview WireGuard VPN Server .......................................58
7.2 Configuring the VPN environment....................................59
7.3 VPN client inventory......................................................... 61
7.3.1 New VPN clients - Standard configuration....................61
7.3.2 New VPN clients - Advanced configuration ..................63
7.4 VPN rules.........................................................................65
7.5 Step by step: VPN access for a mobile device ................... 68
8 Wireguard VPN client ��������������������������������������������� 75
8.1 Overview WireGuard VPN-Client........................................76
8.2 VPN client ........................................................................77
9 Wireguard-VPN Box-to-Box �������������������������������������� 81
9.1 Overview WireGuard VPN Box-to-Box................................82
9.1.1 Configuration example VPN Box-to-Box.......................82
10 Digital inputs and outputs (only Microwall IO)�����89
10.1 Digital inputs................................................................. 90
10.1.1 Wiring of the digital inputs .......................................90
10.2 Digital outputs...............................................................92
10.2.1 Wiring of the digital outputs .....................................92
11 Security & Maintenance������������������������������������������ 93
11.1 Security notes ................................................................ 94
11.1.1 Function and typical use ...........................................94
11.1.2 Requirements for integrators and operators..............94
11.1.3 Installation location ..................................................95
11.1.4 Commissioning.........................................................95
11.1.5 Operation and configuration .....................................96
11.1.6 Service, maintenance and decommissioning..............99
11.2 Up-/Download Configuration data................................100
11.3 Firmware updates ........................................................ 102
11.3.1 Where is the latest firmware available? ....................102
11.3.2 Firmware update with WuTility ................................103
11.3.3 Firmware Update via Web-Based Management .........104
11.4 Individual certificates...................................................106
11.5 Emergency access to the Microwall ..............................108
11.6 Reset to default settings .............................................110
Appendix������������������������������������������������������������������� 111
Technical data and form factor ............................................112
Microwall VPN, #55211......................................................112
Microwall IO, #55212.........................................................113
Index ������������������������������������������������������������������������� 114

W&T

7
W&T
Subject to error and alteration
1 Legal information and safety

8
W&T
1�1 Legal notices
Warning concept
This manual contains notices that must be observed for your
personal safety as well as to prevent damage to equipment.
The notices are emphasized using a warning sign. Depending
on the hazard level the warning notices are shown in
decreasing severity as follows.
1DANGER
Indicates a hazard which results in death or severe injury if no
appropriate preventive actions are taken.
1WARNING
Indicates a hazard which results in death or severe injury if no
appropriate preventive actions are taken.
1CAUTION
Indicates a hazard that can result in slight injury if no
appropriate preventive actions are taken.
1NOTE
Indicates a hazard which can result in equipment damage if
no appropriate preventive actions are taken.
If more than one hazard level pertains, the highest level
of warning is always used. If the warning sign is used in a
warning notice to warn of personal injury, the same warning
notice may have an additional warning of equipment damage
appended.
Qualified personnel
The product described in this manual may be installed and
placed in operation only by personnel who are qualified for
the respective task.

9
W&T
Subject to error and alteration
The documentation associated with the respective task
must be followed, especially the safety and warning notices
contained therein.
Qualified personnel are defined as those who are qualified
by their training and experience to recognize risks when
handling the described products and to avoid possible
hazards.
Disposal
Electronic equipment may not be disposed of with normal
waste, but rather must be brought to a proper electrical scrap
processing facility.
The complete declarations of conformity for the devices de-
scribed in the instructions can be found on the respective In-
ternet data sheet page on the W&T homepage at http://www.
wut.de.
Symbols on the product
Symbol Explanation
CE mark
The product conforms to the requirements
of the relevant EU Directives.
WEEE mark
The product may not be disposed of with
normal waste, but rather in accordance
with local disposal regulations for electri-
cal scrap.

10
W&T
1�2 Safety notices
General notices
This manual is intended for the installer of the Microwall
described in the manual and must be read and understood
before starting work. The devices are to be installed and put
in operation only by qualified personnel.
Intended use
1DANGER
The Microwall VPN is an industrial-grade IPv4 router with two
1000BaseT network ports, integrated whitelist-based firewall
and a Wireguard VPN client/server. It connects a network
island to a superordinate local network. At the same time,
secure remote access to the participants of the island network
can be provided via the WireGuard VPN. Suitable filter rules on
TCP/IP level protect all networks from unauthorized, undesi-
red and harmful communication.
The Microwall IO has 2 digital inputs and 2 digital outputs,
which allow the control of router/firewall functions and the
evaluation of messages in automation environments
Any other use or modification of the described devices is not
intended.
Electrical safety
1WARNING
Before beginning any kind of work on the Microwall you must
completely disconnect it from power. Be sure that the device
cannot be inadvertently turned on again!
The Microwall may be used only in enclosed and dry rooms.
The device should not be subjected to high ambient tempera-
tures or direct sunlight, and it should be kept away from heat

11
W&T
Subject to error and alteration
sources. Please observe the limits with respect to maximum
ambient temperature.
Ventilation openings must be clear of any obstacles. A dis-
tance of 10-15 cm between the Microwall and nearby heat
sources must be maintained.
Input voltage and output currents must not exceed the rated
values in the specification.
When installing be sure that no stray wires stick out through
the ventilation slit of the Microwall into the housing. Ensure
that no individual wires stand off from leads, that the lead is
fully contained in the clamp and that the screws are tightly
fastened. Fully tighten screws on unused terminals.
The power supply used for the Microwall VPN must absolutely
ensure safe isolation of the low-voltage side from the
supply mains according to EN62368-1 and must have “LPS“
designation.
EMV
1NOTE
Only shielded network cables may be used for connecting the
Microwall to the network.
In this case the Microwall meet the noise immunity limits for
industrial applications and the stricter emissions limits for
households and small businesses. Therefore there are no
EMC-related limitations with respect to the usability of the
devices in such environments.
The complete Declarations of Conformity for the devices
described in the manual can be found on the corresponding
Internet page at the W&T homepage: http://www.wut.de.

12
W&T

13
W&T
Subject to error and alteration
2 Hardware, interfaces and displays
. Hardware installation
. Power supply
. Network interfaces
. Service button
. Digital IOs (only Microwall IO)

14
W&T Hardware, interfaces and displays
2�1 Hardware installation
The Microwall is mechanically designed for mounting on a
standard DIN rail. In this case, as well as with alternative
mounting methods, the outlined air circulation must be gua-
ranteed.
A
i
r
c
i
r
c
u
l
a
t
i
o
n
iThe installation site must be adapted to the security requi- rements of the respective system environment. Physical
access to the Microwall enables a potential attacker to take
the device out of operation or to replace the password via the
service button.

15
W&T Hardware, interfaces and displays
Subject to error and alteration
2�2 Power supply
The power supply of the Microwall is alternatively via PoE or
an external power supply. Simultaneous connection of both
power supplies is not permitted. The current consumption
can be taken from the technical data.
2�2�1 PoE- supply
The Microwall can be supplied via the interface Network 1 (ye-
llow) via PoE according to IEEE802.3af. It is a PoE power class
2 device (power consumption from 3.84W to 6.49W).
2�2�2 External power supply
As an alternative to the PoE supply, the Microwall can be sup-
plied externally via the pluggable screw terminal located on
the underside of the housing. The DC voltage used must be
within the following range and the polarity must be observed:
•DC voltage: 24V (-10%) - 48V (+10%)
1WARNING
Only a floating power supply unit may be used for the ex-
ternal supply of the Microwall. Its reference ground for the
output voltage must not have a direct connection to the pro-
tective conductor.
The power supply unit used to supply the Microwall must
guarantee a safe separation of the low voltage side from the
supply network according to EN62368-1 and must have „LPS“
characteristics.

16
W&T
2�3 Network Interfaces
The Microwall has two network interfaces: Network 1 (yellow)
and Network 2 (green).
Microwall
VPN
www.WuT.de
Outputs InputsVdd GND
0 110 + -
Microwall IO
www.WuT.de
Network 1 (yellow) is used for connection to the higher-level
network in which the island network is to be integrated at the
Network 2 (green) connection.
Commissioning with the factory settings and a possible sup-
ply via PoE is only possible via Network 1 (yellow).
2�3�1 Gigabit Ethernet Features
Both Gigabit Ethernet connections have the following features:
RJ45 jack, shielded
Connections to the network infrastructure are via shielded
patch cables with a maximum length of 100m
Autocrossing / Auto MDI-X
The transmit/receive lines of the connected device are auto-
matically detected. Both 1:1 wired and crossed patch cables
can be used.

17
W&T Hardware, interfaces and displays
Subject to error and alteration
Galvanic isolation
There is an electrical isolation of at least 500Vrms from the
supply voltage
Auto-Negotiation
The transmission speed and duplex method are automatical-
ly negotiated with the connected device. To avoid problems
such as duplex mismatch, we recommend that the connected
devices are also operated in auto-negotiation mode.
2�3�2 Link state
The link status is indicated by LEDs integrated in the RJ45
sockets.
Pin
1
2
3
4
5
6
7
8
Richtung
Out
Out
In
In
IN
In
In
In
Funktion
Tx+
Tx-
Rx+
Vcc positive
Vcc positive
Rx-
Vcc negative
Vcc negative
8 7 6 5 4 3 2 1
Speed/
Activity FD/HD
Speed/Activity (green/orange)
Green = 1000MBit/s Link
Green flashing = 1000MBit/s Link und Datenverkehr
Orange = 100MBit/s Link
Orange blinken = 100MBit/s Link and data traffic
FD/HD (yellow)
ON = Full duplex
OFF = Half duplex

18
W&T Hardware, interfaces and displays
2�4 System and Error LED
System LED
Service LED
2�4�1 System LED (green)
ON: Signals normal operational readiness.
Flashing: The Microwall performs a reboot or receives a new
firmware.
2�4�2 Service LED (red)
The service LED is used to signal the emergency access and
factory default reset functions that can be controlled via the
service button.
Slow flashing: The service button was pressed between 3.5s
and 10s. The emergency access of the Microwall is activated.
Further information on emergency access can be found in the
chapter on emergency access.
iThe emergency access opens a non-password-protected HTTPS access (TCP port 446) with the possibility to over-
write the current password. Therefore, only start the emer-
gency access in an appropriately secure environment (e.g.
direct connection to a configuration PC).
Fast flashing: The service button was pressed for longer
than 10s and the Microwall is preparing a reset to the factory
settings. If the service button is still pressed, a reset to the
factory settings is performed after a total of 20s.

19
W&T Hardware, interfaces and displays
Subject to error and alteration
2�5 Service button
Service button
The service button is accessible recessed on the front side of
the Microwall to avoid operating errors. It is operated with a
suitable, pointed object (e.g. paper clip).
The following actions are triggered via the service button:
Reset/Restart
Pressing the button briefly between 0.2 and 3.5s triggers a
restart of the Microwall.
Starting the emergency access
After pressing the button for more than 3.5s, the error LED
starts flashing slowly. If the button is released during this
phase and before 10s have elapsed, the emergency access
of the Microwall is activated on both network connections via
TCP port 446. Pressing the button again briefly performs a
reset and ends the emergency access.
Further information on emergency access can be found in the
chapter emergency access.
iThe emergency access opens a non-password-protected HTTPS access (TCP port 446) with the possibility to over-
write the current password. Therefore, only start the emer-
gency access in an appropriately secure environment (e.g.
direct connection to a configuration PC).
Reset to factory settings
If the service button is pressed for more than 10s, the ser-
vice LED starts flashing rapidly and signals preparation for a
factory default reset. If the button is held down further, the
Microwall is reset to the factory default after 20s. Releasing
the service button while the service LED is flashing rapidly
(time window 10-20s) will cause the factory default reset to be

20
W&T Hardware, interfaces and displays
aborted. The Microwall continues with the standard operation
of the current configuration.
iA reset to the factory setting causes all settings (filter ru- les, IP parameters, log files, etc.) to be lost. Recommissio-
ning must be carried out as described in the chapter Start-up.