A surge in ransomware attacks targeting production lines calls for OT network isolation.  Neither OPC UA nor MQTT traverse DMZs very well, but tunnel/mirroring with outbound-only connections and DMZ support keeps OT networks truly isolated, and allows full data access.