I used this approach with a gateway to get isolation between the PLC and the IT-network. The s7-benthos connected to some random port like 444 or whatever and the router accepted data from only the umh-server ip on that port. The traffic was the redirected to the PLC on port 102 with a IP mask changing the ip to something like 192.168.240.55 which was the internal network on the machine. I had no access to change the ip on the PLC nor did i want to alter the ip or expose the machine network externally. The internal network connected the PLC to servo drives, IOs etc so the integrity of the network was crucial.