Easiest thing is to do it in Luci.
Start from the default out of the box settings.
I don't know your device details myself, like how many ports, what switch layout it has, how many cpu ethernet connections, etc.
So, go to the Network > Switch settings and add a VLAN say number 5, this will be your command and control VLAN. Make this VLAN tagged in the CPU and untagged on a specific port on the switch of your device (try plugging a cable in and seeing what port Luci says it's connected to, then choose that one ) turn this vlan off for all other ports. Note that you will want to be making these edits from a different port than the one you're adding to the vlan, so that you don't lose ethernet connection after clicking save.
Now in Luci create a new "network" call it "command" and set up DHCP on this network and set its physical settings to eth0.5 (or eth1.5 depends on your hardware if it has more than one cpu ethernet connection, but the important thing is that you selected that the eth device for the CPU would be tagged above). Make the subnet say 192.168.77.0/24 and give the router 192.168.77.1 on the network.
Create its own firewall zone as well called "command". Turn off forwarding from LAN to command firewall zone (all of this is straightforward pointy clicky in Luci).
Now, your goal is to forward from WAN to LAN DNATting all inbound traffic to a specific LAN IP say 192.168.5.2 which you will change depending on what your PLC or whatever needs. Let's just assume 192.168.5.2 is hard-coded into your device.
Connect to the router on the command and control port we set up above if this doesn't work, something went wrong above.
Go to Network > interfaces > Lan and set up protocol "static address" 192.168.5.1 for your router. Set up the DHCP server at the bottom to hand out 192.168.5.0/24 type addresses if needed for your PLC.
Now go to Network > firewall select "Port Forwards" tab, call it "allports" select TCP+UDP external zone "wan" leave external port blank, internal zone lan, internal ip address: select the one for your PLC, leave internal port blank, click add. then click save and apply.
that should do it, now any packet coming in on WAN will be rewritten to the IP address you selected on the LAN. You'll need to change this constantly as you use different devices with different hard-coded addresses on your LAN.
see if that works.