Neuron IIoT gateway

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size. Scale up for many devices or high tag volumes.

On the network security group, allow inbound 22/tcp from your management network and 80/tcp for the dashboard. For public exposure, front the dashboard with TLS, as described in Enabling HTTPS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Neuron IIoT Gateway by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

Run the commands below, substituting your own resource group, VNet and subnet.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:neuron-iiot-gateway-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name neuron-gateway \
  --image sac1647283583153:neuron-iiot-gateway-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name neuron-gateway --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that all four services are active:

systemctl is-active neuron.service neuron-modbus-sim.service mosquitto.service nginx.service

Each service reports active. Neuron starts within a few seconds, connects to its configured south devices and begins polling tags.

Step 5 - Retrieve your dashboard password

The first boot of your VM generates a unique admin password and writes it to a root-only file:

sudo cat /root/neuron-credentials.txt

The file contains NEURON_ADMIN_USER (admin) and NEURON_ADMIN_PASSWORD, plus the dashboard URL and the demo endpoints. Store the password somewhere safe.

Step 6 - Check the health endpoint and REST API

nginx serves an unauthenticated health endpoint for load balancers and probes. It also proxies the Neuron REST API on the same port:

curl -s http://localhost/health
PW=$(sudo grep '^NEURON_ADMIN_PASSWORD=' /root/neuron-credentials.txt | cut -d= -f2-)
curl -s -X POST http://localhost/api/v2/login -H 'Content-Type: application/json' \
  -d "{\"name\":\"admin\",\"pass\":\"$PW\"}"

/health returns ok. The login call returns a JSON token (a JWT) that authorises further API calls.

Step 7 - Open the dashboard

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 5.

The dashboard opens on the Configuration -> South Devices view. The left navigation lists Monitoring, Configuration (South Devices, North Apps, Template, Plugin) and Administration.

The image ships a working example: a Modbus TCP south node, modbus1, which shows as Running and Connected.

Step 8 - Watch live data flow through the gateway

Open Monitoring -> Data Monitoring, then select the south device modbus1 and group grp1. The hr40001 tag reads holding register 40001 from the demo device and updates every two seconds.

The north node mqtt1 is subscribed to modbus1/grp1, so every reading is published to the local MQTT broker. Subscribe on the VM to see the north-bound payload:

mosquitto_sub -h 127.0.0.1 -t '/neuron/mqtt1/grp1' -C 2

You receive JSON messages that carry the real tag value as it flows south (Modbus) -> gateway -> north (MQTT).

Step 9 - Add your own south device

To collect from real equipment, add a south node. Select South Devices -> Add Device and choose a plugin, for example Modbus TCP or Modbus RTU. Then set its connection (IP, port, unit ID) under the node's settings.

Add a Group with a poll interval, then add Tags that map to your registers or points.

You can also script node settings through the REST API under /api/v2/node, /api/v2/group and /api/v2/tags.

Step 10 - Forward to your own MQTT broker or cloud

To send data to your production broker instead of the on-box demo sink, open the mqtt1 north node settings under North Apps. Set the Broker Host, Broker Port, credentials and TLS options. Alternatively, add a new MQTT north node and subscribe it to your groups.

The image ships the Modbus TCP/RTU and MQTT plugins (LGPL-3.0).

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it. Add a DNS name for the VM, then use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy. Alternatively, install certbot and extend the existing nginx site with a listen 443 ssl; server block.

Keep the Neuron dashboard bound to loopback, so that the only public surface is the authenticated, TLS-terminated proxy. The proxy already forwards the websocket that the dashboard needs.

Maintenance

• Configuration. All nodes, groups, tags and subscriptions are persisted in /opt/neuron/persistence/sqlite.db and survive reboots.
• Demo device. The on-box Modbus simulator is neuron-modbus-sim.service. Disable it once you have added your own devices, with sudo systemctl disable --now neuron-modbus-sim.service.
• Upgrades. Download a newer Neuron release from the project releases, replace /opt/neuron, then run sudo systemctl restart neuron.
• Security patches. unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Neuron IIoT Gateway on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com