A Modbus gateway converts between Modbus RTU (serial RS-485/RS-232) and Modbus TCP (Ethernet port 502), letting existing serial instruments appear as native TCP devices on the plant LAN without rewriting the field device firmware [S1][S2].
Configuration spans four layers: physical serial parameters (baud, parity, data bits, stop bits, flow control), Ethernet side (listening IP, port 502 default, IP allowlist), Modbus role mapping (master/slave on each side, server/unit ID), and an optional data transformation rule (scaling, byte swap, alarming) [S2][S4].
What the Gateway Actually Does on the Wire
Modbus RTU frames are wrapped in a 16-bit CRC and travel on RS-485 two-wire or four-wire buses; Modbus TCP replaces that CRC with an MBAP header and rides on TCP port 502 [S4]. The gateway strips the CRC, prepends the MBAP header (transaction ID, protocol ID 0x0000, length, unit ID), and forwards the payload to the addressed TCP peer, and vice versa [S4].
Most production gateways expose one or more serial ports and a single Ethernet RJ45 port; the Real Time Automation 460MSMRS ships with a 5-pin screw terminal that supports either RS-232 or RS-485 plus one Ethernet RJ45 and carries CE and UL marks [S2]. RS-485 is the dominant field bus in retrofit work because it survives 1200 m cable runs and 32 unit loads per segment when terminated correctly, which is why a protocol gateway often sits between a legacy RTU slave fleet and a new TCP-based SCADA client.
Serial Side: Baud, Parity, and Timing Traps
RTU timing is non-negotiable: Modbus RTU requires a silent inter-character gap of at least 3.5 character times to delimit frames, which is why most gateways cap practical baud at 38400 bit/s on half-duplex RS-485 and recommend 9600 or 19200 for noise margins [S4].
Common serial presets on production gateways are 9600-8-N-1, 19200-8-N-1, and 19200-8-E-1, matching the typical 460-series and GE Multilin 469 defaults [S3][S4]. Mismatched parity (even vs none) or stop bits (1 vs 2) is the single most common cause of a gateway that opens the TCP socket but returns exception code 0x02 (illegal data address) or no response, since the CRC fails before any register is parsed [S3][S4].
Flow control must also match: if the gateway serial port is set to "none" and the slave expects RTS/CTS hardware handshaking, the slave's driver chip will ignore bytes once its buffer fills, producing intermittent timeouts at high poll rates [S4]. For dense polling of 30+ holding registers per slave, drop the gateway inter-frame timeout to 10 ms and increase the master's read timeout to 1500 ms to ride out TCP retransmits on a shared plant LAN [S6].
Ethernet Side: Port 502, Listening IP, and IP Filtering
TCP port 502 is reserved for Modbus by IANA, so most gateways default to it and let the user override only when running multiple gateway instances on the same host (typical second instance: 5020, 5030) [S4][S7].
Listening IP is a security control: setting 0.0.0.0 accepts any IPv4 client on any local interface, while binding to a specific address (for example 192.168.10.5) restricts access to whichever subnet is routed there [S4]. On the Teltonika RUT956 firmware 00.07.20 path, the operator adds an IP filter list under the same configuration screen; the safe plant default is to enter a /24 mask rather than 0.0.0.0/0 unless the gateway is on an isolated OT VLAN [S4].
For routing-aware deployments, a fieldbus gateway is often installed behind a managed switch with DHCP snooping disabled on the gateway port, and the gateway itself is given a static IP; a common pattern is to map each serial port to a distinct TCP port so that firewall rules can permit or block per device group rather than the whole gateway [S4][S7].
Master, Slave, and the Unit ID / Server ID Field
The MBAP unit ID (also called "server ID" on Teltonika firmware, "slave address" on RTA's 460MSMRS) is what tells the gateway which downstream RTU slave should answer a TCP master's request [S3][S4]. On the Moxa N5232 and most RTU-over-TCP setups, the TCP client (Ignition, modpoll, QModMaster) sets the unit ID byte to the RTU slave address 1-247; the gateway then forwards the request to that physical slave on the RS-485 bus [S3].
Two operational modes are common. In "transparent pass-through" the gateway forwards any unit ID it receives and the SCADA master is responsible for slave addressing; in "master mode" the gateway itself polls each configured RTU slave on a schedule and exposes a flat register map to TCP clients, which simplifies the SCADA tag database but adds one polling layer of latency [S2][S7]. RTA's 460-series lets the user pick the role per port: the 460MSMRS label literally means "Modbus Serial Master to Modbus TCP/IP Server", i.e. the gateway acts as a serial master polling downstream RTU slaves and exposing them as a TCP server to clients [S2].
ProSoft gateways support both directions: a single chassis module can be a PROFIBUS DP slave to EtherNet/IP and Modbus TCP/IP, or a Modbus TCP/IP client/server, depending on which in-chassis module is loaded into the ControlLogix backplane [S5]. This means a pressure transmitter sitting on RS-485 at address 11 will answer any TCP request that the SCADA client sends with unit ID 11, with the gateway doing no addressing logic of its own.
Connection Capacity, Polling, and Refresh Rates
Production gateways typically allow up to 16 simultaneous Modbus TCP masters to poll a shared RTU/ASCII slave bus, which is the figure Moxa, RTA, and most Chinese OEM modules publish on the same datasheet lineage [S7]. Each TCP master opens a separate socket on port 502; the gateway serializes the requests onto the RS-485 bus and arbitrates collisions using a configurable inter-frame delay (1-50 ms is the typical adjustment range) [S4][S7].
On the serial side, classic Modbus RTU supports up to 32 slave devices per segment without repeaters, dropping to about 31 when the gateway itself counts as a node; long cable runs or high-noise environments (VFD-rich panels) typically reduce that to 16-20 for reliable CRC pass rates [S4]. ProSoft's PROFIBUS DP master/slave to Modbus TCP/IP or Modbus Serial Gateway modules are designed for higher density, with versions carrying four serial ports to fan out to four independent RS-485 trunks from one Ethernet uplink [S5].
Refresh rate is not a gateway parameter, it is a master parameter: the SCADA client (Ignition, FactoryTalk, WinCC) sets the poll interval per tag group, and the gateway simply answers whatever arrives. The Moxa N5232 user-reported working rate in [S3] is 1-2 s for typical 469 relay register polls; pushing it below 200 ms is possible but tends to surface TCP retransmits on a shared plant LAN [S3][S4].
Configuration Walkthrough on a Typical Industrial Router
On the Teltonika RUT956 (firmware 00.07.20), the path is Services, then Modbus, then Modbus TCP over Serial Gateway; the operator enters a configuration name, picks RS485/RS232/USB as the transport, enables the serial interface, sets the listening IP (0.0.0.0 for any), the port (502 default), and the server ID, then saves and applies [S4].
The matching serial parameters (baud, data bits, parity, stop bits, flow control) must be byte-for-byte identical on the gateway and on the RTU slave simulator; a typical debug setup uses ModRSsim2 on the serial PC and QModMaster on the TCP PC, with the master's slave IP pointing at the gateway and port 502 [S4]. To verify the round trip, poll holding register 1 from the TCP master and confirm that the value pre-loaded in the ModRSsim2 holding register window echoes back; if it does not, the first thing to check is parity, the second is the server ID field, the third is whether the gateway actually enabled the serial port after the save-and-apply [S4].
For sites already running a pressure sensor on Modbus RTU at address 5, the equivalent config is: server ID 5, listening port 502, IP filter restricted to the SCADA subnet, baud matching the sensor's datasheet (often 9600-8-N-1), and the SCADA tag prefix set to HR for holding registers. Ignition then reads the sensor as a TCP device with unit ID 5 rather than a serial device, which is what unblocks the migration path described in the Inductive Automation forum thread on the GE Multilin 469 / Moxa N5232 setup [S3].
Common Failure Modes and How to Diagnose Them
Symptom: TCP socket opens, but every read returns exception 0x02 or 0x0B. Cause: unit ID / server ID mismatch between the SCADA tag configuration and the physical RTU slave address, or the wrong function code (input register FC 04 versus holding register FC 03) [S3]. Fix: confirm the slave address with a Modbus scanner tool (modpoll, QModMaster) directly against the gateway, then mirror the unit ID into the SCADA tag prefix [S3].
Symptom: TCP socket opens, the first read works, subsequent reads time out. Cause: RS-485 bus contention, missing termination, or the RTU slave's response timer is shorter than the gateway's serial timeout. Fix: enable 120 ohm termination at both ends of the RS-485 trunk only (never in the middle), reduce the master's poll rate below the slave's worst-case response time, and confirm the gateway inter-frame delay is at least 3.5 character times [S4].
Symptom: data is offset by one register, or bytes appear swapped within each register. Cause: the gateway is doing no data transformation, but the field device uses word-swapped 32-bit floats (CDAB vs ABCD). Fix: on gateways that support it (RTA 460, ProSoft PLX32, Moxa MGate), enable a byte-swap or word-swap rule on the affected register range, or use a scaling block to multiply the raw 16-bit value by the sensor's published scale factor [S2][S5].
Comparison of Main Gateway Classes by Decision Criteria
For a retrofit at a small site with one RS-485 trunk and 5-10 RTU slaves, a compact industrial gateway such as the Moxa MGate or RTA 460MSMRS (RS-232/RS-485 plus Ethernet RJ45, CE/UL listed) is the lowest-friction pick [S1][S2]. For a multi-trunk plant with 30+ slaves across four RS-485 buses, a multiport serial module or a ProSoft 4-port Modbus TCP/IP to Modbus Master/Slave Gateway is the right tier, with the trade-off being higher cost and a ControlLogix or similar backplane requirement for in-chassis variants [S5].
For SCADA-only integration where the gateway has to terminate the RTU bus itself (master mode), a pressure transmitter or flow meter network is the typical use case: the gateway polls the field devices, builds a flat register map, and serves up to 16 TCP clients concurrently, with configuration in the gateway's web UI rather than in the SCADA project [S7]. For deeper integration where the same module also has to bridge to PROFINET or EtherNet/IP, ProSoft's PLX31/PLX32 family or the Moxa MGate 5100/5200 line is the typical answer, with the added cost of PROFINET conformance certification [S1][S5].
Decision criteria to weigh: number of serial ports (1, 2, or 4), maximum simultaneous TCP masters (typically 16, occasionally 32), operating temperature range (-40 to 75 degrees C is common for industrial-rated units), certifications (UL, CE, ATEX/IECEx for hazardous areas), and configuration interface (web UI, Telnet, Windows utility, or in-chassis module configuration over Ethernet/IP) [S1][S2][S5].
Sourcing, Standards, and Lead-Time Signals
Two of the most-cited gateway families, RTA 460 and Moxa MGate, list UL and CE marks on their product pages; ATEX/IECEx Zone 2 variants exist in the Moxa MGate line for oil and gas skids and similar hazardous-area cabinets, and the RTA 460MSMRS ships with a 5-year hardware warranty and lifetime firmware upgrades [S1][S2]. Pricing for a single-port, RS-232/RS-485, CE/UL-listed unit is in the $896-$1,035 range as published on the RTA product page, while multiport ProSoft modules for ControlLogix chassis list 2-3x higher depending on protocol count [S2][S5].
For purchasing, the RTA 460MSMRS ships in 1-2 weeks from US stock; Moxa MGate units through authorised distributors typically run 2-4 weeks, and ProSoft in-chassis modules 3-6 weeks depending on backplane variant, which is consistent with the broader 2026 industrial-component lead-time picture discussed in crystal oscillator and MEMS timing lead-time tracking. Configuration documentation (web UI screenshots, register maps, firmware notes) is maintained on vendor wikis: the Teltonika RUT956 Modbus gateway page was updated Mon, 05 Oct 2026 to firmware 00.07.20, and is a useful reference even for non-Teltonika gateways because the parameter set (listening IP, port, server ID, IP filter) is essentially the same across brands [S4].
Track two signals over the next quarter: firmware updates on RTA 460 and Moxa MGate lines (the August 2025 PUSR walkthrough suggests more industrial IoT gateway vendors are publishing browser-based Modbus TCP configuration guides, which often accompanies a firmware revision [S8]), and whether the user's SCADA platform adds native "Modbus RTU-over-TCP" driver templates to reduce the unit-ID-in-tag-prefix pattern that tripped up the GE Multilin 469 / Moxa N5232 deployment in [S3].