An interface module in a programmable logic controller, PLC, comprising: an Ethernet switch; a first port electrically coupled to a Central Processing Unit, CPU, module of the PLC and to the Ethernet switch; a second port (225a, 225b) electrically coupled to a plant network and the Ethernet switch; a third port (227a, 227b) electrically coupled to a control/office network and the Ethernet switch; and a processor configured to control communication to the PLC and the plant network from the control/office network by: extracting an allowable source media access control, MAC, address, an allowable destination MAC address, and a service protocol type from a packet; determining layer 2 packet activity level; determining whether to pass the packet for further processing at layer 3 based on layer 2 configuration information, the extracted allowable MAC addresses, the extracted service protocol type, and the determined layer 2 packet activity level; when the packet is processed at layer 3, extracting an allowable IP source address, an allowable IP destination address, and an application services indicator from the packet, wherein the allowable IP source address and the allowable IP destination address are in accordance with the configuration information; determining layer 3 packet activity level; determining whether to pass the packet based on layer 3 configuration information, the extracted allowable IP addresses, the extracted application services indicator at a deepest level of information, and the determined layer 3 packet activity level, wherein the packet is either forwarded to the allowable IP destination address through one of the ports or sent to higher layer processing when the allowable destination IP address corresponds to the interface module; and filtering as configured at a deepest level of an application protocol based on a predetermined criterion corresponding to an packet activity level. an Ethernet switch; a first port electrically coupled to a Central Processing Unit, CPU, module of the PLC and to the Ethernet switch; a second port (225a, 225b) electrically coupled to a plant network and the Ethernet switch; a third port (227a, 227b) electrically coupled to a control/office network and the Ethernet switch; and a processor configured to control communication to the PLC and the plant network from the control/office network by: extracting an allowable source media access control, MAC, address, an allowable destination MAC address, and a service protocol type from a packet; determining layer 2 packet activity level; determining whether to pass the packet for further processing at layer 3 based on layer 2 configuration information, the extracted allowable MAC addresses, the extracted service protocol type, and the determined layer 2 packet activity level; when the packet is processed at layer 3, extracting an allowable IP source address, an allowable IP destination address, and an application services indicator from the packet, wherein the allowable IP source address and the allowable IP destination address are in accordance with the configuration information; determining layer 3 packet activity level; determining whether to pass the packet based on layer 3 configuration information, the extracted allowable IP addresses, the extracted application services indicator at a deepest level of information, and the determined layer 3 packet activity level, wherein the packet is either forwarded to the allowable IP destination address through one of the ports or sent to higher layer processing when the allowable destination IP address corresponds to the interface module; and filtering as configured at a deepest level of an application protocol based on a predetermined criterion corresponding to an packet activity level. extracting an allowable source media access control, MAC, address, an allowable destination MAC address, and a service protocol type from a packet; determining layer 2 packet activity level; determining whether to pass the packet for further processing at layer 3 based on layer 2 configuration information, the extracted allowable MAC addresses, the extracted service protocol type, and the determined layer 2 packet activity level; when the packet is processed at layer 3, extracting an allowable IP source address, an allowable IP destination address, and an application services indicator from the packet, wherein the allowable IP source address and the allowable IP destination address are in accordance with the configuration information; determining layer 3 packet activity level; determining whether to pass the packet based on layer 3 configuration information, the extracted allowable IP addresses, the extracted application services indicator at a deepest level of information, and the determined layer 3 packet activity level, wherein the packet is either forwarded to the allowable IP destination address through one of the ports or sent to higher layer processing when the allowable destination IP address corresponds to the interface module; and filtering as configured at a deepest level of an application protocol based on a predetermined criterion corresponding to an packet activity level.