Neuron IIoT Gateway on Ubuntu 24.04 on Azure User Guide

Overview

Neuron is an open-source industrial IIoT connectivity gateway that bridges operational technology and IT. It connects to industrial equipment and PLCs over south-bound field protocols such as Modbus TCP/RTU, OPC-UA and Ethernet/IP, normalises the collected tag data, and forwards it north-bound to MQTT brokers and cloud platforms in real time - all managed from a bundled web dashboard and REST API. The cloudimg image installs Neuron 2.15.0 from the upstream release, runs it as a dedicated systemd service bound to loopback behind an nginx reverse proxy on port 80, generates a unique dashboard password on the first boot of every VM, and ships a live end-to-end demo (a local Modbus simulator streaming a real register value through the gateway onto an MQTT topic) so you can see the pipeline working the moment it boots. Backed by 24/7 cloudimg support.

What is included:

• Neuron 2.15.0 (LGPL-3.0), installed from the pinned upstream release to /opt/neuron
• The bundled web dashboard and REST API, fronted by nginx on :80 (the dashboard websocket is proxied)
• A per-VM dashboard admin password generated on first boot and stored in a root-only file; the factory default is rotated before port 80 opens
• A live demo pipeline on loopback: a Modbus-TCP simulator (modbus1) streaming holding register 40001 through the gateway to an MQTT north node (mqtt1) on a local mosquitto broker
• neuron.service, neuron-modbus-sim.service, mosquitto.service and nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point; scale up for many devices or high tag volumes. NSG inbound: allow 22/tcp from your management network and 80/tcp for the dashboard (front with TLS for public exposure - see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Neuron IIoT Gateway by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name neuron-gateway \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name neuron-gateway --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active neuron.service neuron-modbus-sim.service mosquitto.service nginx.service

Each service reports active. Neuron starts in a few seconds, connects to its configured south devices, and begins polling tags.

Step 5 - Retrieve your dashboard password

The admin password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/neuron-credentials.txt

This file contains NEURON_ADMIN_USER (admin) and NEURON_ADMIN_PASSWORD, plus the dashboard URL and the demo endpoints. Store the password somewhere safe.

Step 6 - Check the health endpoint and REST API

nginx serves an unauthenticated health endpoint for load balancers and probes, and proxies the Neuron REST API on the same port:

curl -s http://localhost/health
PW=$(sudo grep '^NEURON_ADMIN_PASSWORD=' /root/neuron-credentials.txt | cut -d= -f2-)
curl -s -X POST http://localhost/api/v2/login -H 'Content-Type: application/json' \
  -d "{\"name\":\"admin\",\"pass\":\"$PW\"}"

/health returns ok, and the login call returns a JSON token (a JWT) that authorises further API calls.

Step 7 - Open the dashboard

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 5.

The dashboard opens on the Configuration -> South Devices view. The left navigation lists Monitoring, Configuration (South Devices, North Apps, Template, Plugin) and Administration. The image ships a working example: a Modbus TCP south node modbus1, shown here Running and Connected.

Step 8 - Watch live data flow through the gateway

Open Monitoring -> Data Monitoring, select the south device modbus1 and group grp1. The hr40001 tag reads holding register 40001 from the demo device and updates every two seconds:

Because the north node mqtt1 is subscribed to modbus1/grp1, every reading is published to the local MQTT broker. Subscribe on the VM to see the north-bound payload:

mosquitto_sub -h 127.0.0.1 -t '/neuron/mqtt1/grp1' -C 2

You get JSON messages carrying the real tag value that flowed south (Modbus) -> gateway -> north (MQTT):

Step 9 - Add your own south device

To collect from real equipment, add a south node from South Devices -> Add Device, choose a plugin (for example Modbus TCP or Modbus RTU), then set its connection (IP, port, unit id) under the node's settings. Add a Group with a poll interval, then add Tags mapping to your registers/points. Node settings can also be scripted through the REST API under /api/v2/node, /api/v2/group and /api/v2/tags.

Step 10 - Forward to your own MQTT broker or cloud

To send data to your production broker instead of the on-box demo sink, open the mqtt1 north node settings under North Apps and set the Broker Host, Broker Port, credentials and TLS options, or add a new MQTT north node and subscribe it to your groups. The image ships the Modbus TCP/RTU and MQTT plugins (LGPL-3.0):

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it - add a DNS name for the VM and use the companion cloudimg nginx-ssl-certbot image as a TLS reverse proxy, or install certbot and extend the existing nginx site with a listen 443 ssl; server block. Keep the Neuron dashboard bound to loopback so the only public surface is the authenticated, TLS-terminated proxy. The proxy already forwards the websocket the dashboard needs.

Maintenance

• Configuration: all nodes, groups, tags and subscriptions are persisted in /opt/neuron/persistence/sqlite.db and survive reboots.
• Demo device: the on-box Modbus simulator is neuron-modbus-sim.service; disable it once you have added your own devices (sudo systemctl disable --now neuron-modbus-sim.service).
• Upgrades: download a newer Neuron release from the project releases, replace /opt/neuron, and sudo systemctl restart neuron.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.