The key to secure remote access
The only OT‑gateway with a built‑in key switch.
Your plus for ultimate control.
Highlights
Designed following 62443-4-1
Security by Design and Default
Secure Boot
Secure Startup, Reliable Operation
Secure Boot effectively protects the system startup against tampering and ensures maximum operational continuity. In the event of software issues, the device automatically boots from a protected backup partition.
Secure Firmware
Trust Starts with Your Software
Secure Firmware reliably prevents compromised or unauthorized firmware from being installed. Only cryptographically signed and approved software is allowed to run on the device.
Secure Enclave
Hardware-Based Protection for Sensitive Data
Secure Enclave protects cryptographic keys, certificates, and login data in a dedicated hardware environment – isolated from the operating system and therefore highly resilient.
62443-4-2 Security Level 3 Certification
We are aiming certification based on 62443-4-2 Security Level 3 to meet CRA requirements in Q4 2026.
enhanced level of security
Excellent data flow
With 4x Gbit/s LAN ports and 1x Gbit/s WAN port, plus an optional 1 Gbit/s DMZ port.
additional DMZ port
Maximum control, clear separation. The router provides secure, separate data paths to the external network and the production network.
compact Metal Case
The compact metal body saves space in the control cabinet and offers modern interfaces as well as DIN rail mounting.
Guaranteed IT-compatibility
Seamlessly integration into modern IT and OT infrastructures:
- SNMPv3, MQTT API, MQTT Bridge, and REST API for secure remote monitoring and control of the routers.
- Two-factor authentication (TOTP, PASSKEYS) for secure access to the GUI.
- Network segmentation (port-based VLAN).
- 802.1X client and server authentication for controlled network access.
- As a result, the device meets key requirements for security, transparency, and professional network segmentation.
Built-in Fault Tolerance
Failover for seamless connectivity and maximum availability.
SIMPLY.connect
More Highlights
- Local data acquisition
- Optional serial or MPI/Profibus connectivity
- Supports mbWEB2go
- Digital inputs and outputs
- IIoT ready
- Nano-SIM slot (for LTE only)
- Flexible connectivity via LAN, WiFi, or LTE
Your plus for ultimate control
OFF
When in the OFF position, the router does not establish a connection to the cloud and is displayed as offline.
ONL
In the ONL position, the router is online, has access to the cloud, and is also shown online in the cloud. In this switch position, access is permitted only to the router’s internal services, such as the configuration interface or the EDGE IIoT-License functions.
REM
Only when the switch is moved to the REM position is a connection allowed between the remote user and the LAN, and routing to the device is possible. If a router with a key switch is deployed, each remote access session will require a local contact person available on site. This person operates the key switch, thereby enabling access to the LAN.
OFF
When in the OFF position, the router does not establish a connection to the cloud and is displayed as offline.
ONL
In the ONL position, the router is online, has access to the cloud, and is also shown online in the cloud. In this switch position, access is permitted only to the router’s internal services, such as the configuration interface or the EDGE IIoT-License functions.
Features
With an integrated key switch, this remote access router offers all the essential security features recommended by BSI and other worldwide security authorities. Let us convince you.
Key-controlled Remote Access
The three positions of the key let you decide when remote users may access the router and when they are allowed to reach the devices behind it.
Onboard Security Chip
The hardware-based secure element cannot be read out. It is used to secure all processes and to encrypt your passwords and data.
Active Session Warning
Use an onboard DO to enable a local audible or visual alarm and notify local staff of an active remote access session on the unit.
Secure Boot Concept
Supports SIMPLY.connect
Unique Password
Booster
Get even more out of your mbNET.pro+ with our new features.
LAN segmentation /
port-based VLANs
With the new LAN segmentation, our mbNET.pro+ enables machine network architects to seamlessly and efficiently set up four separate local LAN segments directly on the remote access router. These segments are completely isolated when activated and are given individual IP address ranges, which significantly increases flexibility and control over your network infrastructure.
If communication between the segments is desired, this must first be actively configured. This ensures that only required and targeted data traffic is permitted. Layer 3 routing guarantees that ARP requests and unwanted broadcasts remain within the respective LAN segments, which optimizes both the performance and security of your network.
Optimize your machine network with the LAN segmentation of the mbNET.pro+!
802.1x Client
Authentification
Security at the highest level: 802.1x for mbNET.pro+
802.1x is the standard for port-based network security controls developed by the Institute of Electrical and Electronics Engineers (IEEE). This standard ensures seamless integration into existing IT infrastructures and enables secure authentication and authorized connection to the local network. Briefly: Access control to a network before an IP address is assigned.
Multiple authentication methods
The mbNET.pro+ supports a variety of secure authentication methods, including EAP-TLS, EAP-PEAP, EAP-TTLS and EAP-FAST. This ensures that your network security is always up to date.
Perfect for challenging IT environments
This feature is essential for administrators and allows machine and plant builders to easily integrate mbNET.pro+ into factories where complex network infrastructures such as Cisco architectures with EAP-FAST are already in use. Integrate your hardware effortlessly into any IT environment!
SNMPv3: Simple Network
Management Protocol
Discover the SNMP support for mbNET.pro+ as of version 8.2.0! This new feature ensures that network administrators can seamlessly integrate important key figures and status information from the mbNET.pro+ into their network monitoring. With SNMP, mbNET.pro+ offers a robust solution that meets the highest standards.
The following MIBs (Management Information Base) are now available: Device type, serial number, firmware version, Ethernet port status, operating time, CPU load, RAM utilization as well as security-related information such as openVPN connection activity, connected users and number of firewall drops.
This data is crucial for the early detection and prevention of potential security risks. Integrate your mbNET.pro+ seamlessly into your existing network monitoring.
MQTT Bridge
From now on, all internally used MQTT topics of the router and the associated data can be easily mirrored to an external MQTT broker. This innovative solution enables seamless integration and synchronization of data between internal systems and external applications or cloud services. The captured data is securely and efficiently transferred to an external MQTT broker hosted outside the machine network.
The security of the data transfer is guaranteed by SSL/TLS in conjunction with CA certificates. This feature is particularly interesting for all users of a mymbCONNECT24 portal.
License model
Data sheet / Flyer
Product variants
| Type | Item no. | WAN | LAN | Wireless technology | DMZ | RS232/485 | MPI/PROFIBUS | VPN* |
|---|---|---|---|---|---|---|---|---|
| MDH 5002 | K.002.000.01.00 | 1x | 4x | – | ✔ | – | – | ✔ |
| MDH 5022 | K.022.000.01.00 | 1x | 4x | – | ✔ | 1x | – | ✔ |
| MDH 5042 | K.042.000.01.00 | 1x | 4x | – | ✔ | – | 1x | ✔ |
| MDH 5302 | K.302.000.01.00 | 1x | 4x | IEEE 802.11 a/b/g/n/ac | ✔ | – | – | ✔ |
| MDH 5402 EU | K.402.020.01.00 | 1x | 4x | LTE Cat.1 & Cat.4 | ✔ | – | – | ✔ |
| MDH 5402 US | K.402.030.01.00 | 1x | 4x | LTE Cat.1 & Cat.4 | ✔ | – | – | ✔ |
* OpenVPN, WireGuard
Optional Features
| Product name | Item no. | Description |
|---|---|---|
| tec.boost License Bundle | 1.900.000.00.00 | License Bundle for a mbNET.pro+ including SNMP, 802.1X, MQTT Bridge, LAN Segmentation |
| LAN Segmentation | 1.904.000.00.00 | Single License LAN Segmentation for a mbNET.pro+ |
| MQTT Bridge | 1.905.000.00.00 | Single License MQTT Bridge for a mbNET.pro+ |
Downloads
You want to learn more about this product?
Visit our download portal and check out the latest brochures and all essential documents.
