During the rainy season, an outdoor station has had LAN and COM ports burn out several times after lightning. How do we protect it?

Lightning rarely strikes the machine itself. Ports burn out from induced surges travelling along long cables: network cable, RS-485 lines and power cables entering the cabinet from outside. Protect in layers: 1. Power: a surge protective device (SPD) at the cabinet input, correctly earthed. 2. Signal lines: surge protectors for network cable (PoE-compatible versions exist) and for RS-485 where the cable enters the cabinet, mounted close to the earth bar. 3. Ports on the machine: prefer machines with isolated COM, CAN and DIO. Isolation does not stop a direct strike but withstands induced surges far better. 4. Long outdoor runs: consider fibre instead of copper. Fibre does not conduct, so it cuts the surge path between the two ends entirely. In datasheets you can refer to immunity test levels under IEC 61000-4-5 (surge) and IEC 61000-4-4 (fast transients). These levels do not replace surge protection at the cabinet. All surge protection only works when the earthing system is sound.