Hi Matthijs,
One industry standard is that Modbus registers are read only, until a password has been written into a specific register*.
Also, when writing mission critical registers, then 2 registers have to be written simultaneously with either the same or 2’s complement values. Response to an unauthorised write could either be a return of the current register value, or a modbus error code indicating ‘illegal’ register or function.
As far as security goes, Most connections from LAN to WAN go through a router with a firewall. All that is needed here is to block incoming access to port 502.
For security on your LAN - that is your local problem.
I do like the read only options as above.
If you want someone to have a look at your modbus documentation, then I think you have access to my email.
- Note: This concept could embody 2 or 3 different passwords, each allowing greater access to register sets, thus allowing restricted, elevated or unlimited access.