Industrial Router

What is an Industrial Router

An industrial router is a network device that forwards IP traffic between a local field network and a wide-area network (WAN), built to operate unattended in environments that a consumer or office router cannot survive. It is the gateway that lets a remote pumping station, a wind turbine, a moving train, a roadside cabinet, or a factory cell reach a central SCADA server, a cloud platform, or a corporate data center. The radio or Ethernet WAN side may look familiar, but the housing, the power stage, the connectors, and the software lifecycle are engineered to a different discipline.

Functionally, an industrial router bundles several roles that were once separate boxes. At its core it does routing and network address translation (NAT) between the LAN and WAN. Around that it adds a stateful firewall, one or more VPN engines (IPsec, OpenVPN, and increasingly WireGuard) for encrypted site-to-site tunnels, and frequently a small managed Ethernet switch so several field devices share one uplink. Many models also carry a cellular modem with one or two SIM slots, Wi-Fi for local access, serial ports (RS-232/RS-485) to bridge legacy PLCs and meters, and digital I/O for alarms or ignition sensing. When the cellular WAN dominates the design, the market often calls the same device a cellular router or cellular gateway.

Three properties separate an industrial router from the consumer product that shares its chipset. First, environmental endurance: a wide operating temperature window, commonly -40 to +70 degrees Celsius (-40 to +158 degrees Fahrenheit), fanless conduction cooling so there is no fan to clog or fail, and shock and vibration tolerance verified to the IEC 60068-2 series and, for transport, EN 61373. Second, power and mounting: a wide DC input, frequently 9 to 60 VDC, a 35 mm DIN-rail or panel-mount body, and locking M12 or screw-terminal connectors that survive vibration where an RJ45 clip or barrel jack would shake loose. Third, lifecycle: a 7 to 10 year product availability commitment, long-term firmware and security patching, dual SIM failover, and hardware or software watchdogs that reboot a hung unit so a site does not need a truck roll.

The history of the industrial router tracks the arrival of each WAN technology into the field. Early remote telemetry in the 1990s rode leased lines, dial-up modems, and private radio. GPRS and 2G in the early 2000s brought the first cellular routers for utility metering and vending telemetry. 3G and then 4G LTE through the 2010s made remote video and richer SCADA practical, and the 4-band-plus LTE Cat 4 modem became the default telemetry workhorse. From around 2019, 5G NR (Sub-6 GHz first) opened higher capacity and lower latency for machine vision, mobile robotics, and SD-WAN edges, while the same generation of products absorbed edge computing: container or Docker support so a router can run analytics locally instead of shipping every byte upstream. The trend line is consolidation: routing, security, switching, serial, and compute converging into one ruggedized box.

Five engineering attributes determine whether an industrial router is fit for its job: environmental rating (temperature, vibration, ingress), WAN technology and throughput (cellular category or wired speed), power and form factor, security and certification posture (IEC 62443-4-2, sector standards), and lifecycle support. Unlike an office router, where price and Wi-Fi speed dominate, an industrial selection is governed by the cost of an unplanned site visit. A unit that saves a few hundred dollars upfront but reboots unpredictably, loses cellular registration, or reaches end-of-support in three years can cost far more in dispatched technicians and downtime than the premium for a properly rated product.

Industrial Router Types

Industrial routers are classified by their WAN technology and by their deployment context. The two axes overlap: a single product may be both a cellular router and a rail-certified router. The table below organizes the field by primary WAN and typical role, so a buyer can locate the category before drilling into a model. Choosing the wrong category, for example specifying a fixed cabinet router for a moving vehicle, is the most common early mistake and surfaces only after field failures.

Cellular LTE routers are the volume category. They use a 4G LTE modem (most commonly Cat 4 at 150 Mbps down, or low-power Cat 1 for telemetry) with one or two SIM slots, and connect remote assets that have no wired path: water and gas distribution, oil and gas wellheads, solar and wind sites, traffic systems, and ATM or kiosk fleets. Their virtue is reliability in weak signal and low power draw, often around 5 to 10 W. They frequently double as the backup WAN for a wired site, taking over when the primary fiber or DSL fails.

5G routers add a 5G NR modem, almost always Sub-6 GHz (commonly 3.3 to 4.2 GHz) for coverage and building penetration rather than mmWave. They support standalone (SA) and non-standalone (NSA) modes and reach much higher throughput, for example LTE Cat 20 fallback at up to 2 Gbps down with 5G peaks higher still. The justification for 5G is capacity and latency, not coverage: remote HD video, vision inspection, mobile robots, and SD-WAN edges that backhaul an entire site. For pure telemetry, a 5G router is usually over-specified.

Wired and VPN routers drop the radio and route between Ethernet segments, often with fiber uplinks via SFP. They build encrypted IPsec or OpenVPN tunnels between plants, segment a flat factory network into security zones, and apply firewall policy at the boundary between OT and IT. Rolling-stock, substation, and edge-compute routers are the same routing function wrapped in a context-specific certification and feature set: EN 50155 and EN 61373 ruggedness for trains, IEC 61850-3 and IEEE 1613 for substations, and container runtimes (Docker) for edge compute. A single chassis, such as the Cisco Catalyst IR1101, can be configured across several of these roles through pluggable modules.

Cellular and Ethernet Technologies

The WAN technology decides what an industrial router can and cannot do, and it is where datasheet acronyms create the most confusion. On the cellular side, the key term is the 3GPP UE Category (Cat), which defines peak modem throughput. On the wired side, the terms are port speed and SFP. The table below compares the common cellular generations a buyer will meet. Note that the figures are radio peaks under ideal conditions; field throughput is typically 20 to 60 percent of peak depending on signal, carrier bandwidth, and contention.

LTE Cat 1 is the low-power, low-rate tier, peaking at 10 Mbps down and 5 Mbps up. It is purpose-built for telemetry: meters, sensors, alarm panels, and any application where reliability and battery or solar power matter more than speed. Because it uses a single antenna path and modest signalling, it holds a usable link in fringe coverage where a faster modem would drop. LTE Cat 4, peaking at 150 Mbps down and 50 Mbps up over a single 20 MHz carrier, is the industrial default. It is mature, inexpensive, available in nearly every regional band combination, and performs reliably in challenging RF, which is why products such as the Moxa OnCell G4302-LTE4 and Teltonika RUT956 build on it.

LTE Cat 12 and Cat 20 use carrier aggregation (combining 2 to 5 carriers) and higher-order MIMO to multiply throughput, reaching roughly 600 Mbps and 2,000 Mbps down respectively. They suit sites with multiple devices, video streams, or as the LTE fallback inside a 5G router. 5G NR in industrial routers is almost exclusively Sub-6 GHz (frequently 3.3 to 4.2 GHz), chosen for coverage and indoor penetration over the multi-gigabit but short-range mmWave bands used in dense urban consumer deployments. A 5G router such as the Teltonika RUTX50 advertises up to 3.3 Gbps down with Cat 20 LTE fallback. Crucially, 5G has two cores: non-standalone (NSA) anchors the 5G radio on a 4G control plane, while standalone (SA) is a pure 5G core needed for low-latency and network-slicing features. Confirm which mode and which band your carrier actually provisions before specifying a 5G unit.

On the wired side, industrial routers expose Fast Ethernet (10/100) or Gigabit (10/100/1000) RJ45 ports, and higher-end units add SFP cages for fiber uplinks, which give electrical isolation and long reach in substations and between buildings. The number of LAN ports indicates whether an integrated switch is present: a 2-port unit is a pure router, while an 8-port model (for example the Moxa OnCell G4308-LTE4) folds a managed switch into the same chassis. Wi-Fi on industrial routers (Wi-Fi 5 or Wi-Fi 6) is generally for local maintenance access, an onboard passenger network on rail, or a short-range field LAN, not as the primary WAN. Serial ports (RS-232/RS-422/RS-485) and Modbus translation remain common because brownfield meters and PLCs still speak serial, and the router tunnels that traffic to a modern host.

Ruggedization and Security Standards

A router earns the label "industrial" through standards, not adjectives. Two families matter: environmental and EMC ruggedization, which proves the hardware survives the deployment, and cybersecurity, which proves the software can be trusted at the boundary between the field network and the public internet. The relevant certificates depend heavily on the vertical, and specifying the wrong set is a common and expensive error. The table below maps verticals to the standards a buyer should demand.

EN 50155 is the European standard for electronic equipment used on rolling stock. It requires correct operation across a wide temperature range, including a 10-minute start-up tolerance at temperature extremes, and tolerance of supply voltage interruptions and variations that occur on a train's power bus. It references EN 61373 for shock and vibration so the router survives the constant mechanical stress of a moving vehicle, and pairs with the EN 50121 series for railway EMC. A router intended for onboard or trackside rail duty without these certificates is unqualified for the application regardless of how robust its housing looks.

IEC 61850-3 and IEEE 1613 govern communications equipment installed in electrical substations. They define environmental and electromagnetic withstand levels appropriate to the high-EMI, wide-temperature substation environment, so that protection and automation traffic is not disrupted by switching transients or fault currents nearby. Equipment meeting both is suitable for substation automation, transmission and distribution automation, and grid integration. For general industrial use outside these regulated verticals, the baseline is the IEC 60068-2 series of environmental type tests (such as 2-1 cold, 2-2 dry heat, 2-6 vibration, 2-27 shock) plus EMC immunity and emissions to the IEC/EN 61000 and EN 55032 families, and an ingress rating (IP30 for a cabinet unit, up to IP66/IP67 for an exposed outdoor or vehicle unit).

On the cybersecurity side, IEC 62443-4-2 is the standard that matters. It specifies the technical security capabilities required of individual components such as a router: identification and authentication, use control, data integrity and confidentiality, and resource availability. Manufacturers increasingly develop products "according to IEC 62443-4-2" and add Secure Boot with signed firmware to block tampered code, as Moxa does on its OnCell secure routers. Because the router is the trust boundary, a buyer should also verify practical hardening features: role-based user accounts, the ability to disable unused services and default credentials, TLS-only management interfaces, deep packet inspection, and centralized device management for fleet-wide patching. For installations in explosive atmospheres, ATEX, IECEx, or North American Class I Division 2 (ANSI/ISA 12.12.01) certification is mandatory and non-negotiable.

Key Specification Parameters

Reading an industrial router datasheet is the core skill of the selection. A spec sheet may list 30 or more lines, but a manageable set of parameters drives the decision: operating temperature, power input, WAN technology and bands, port count and type, dual SIM behaviour, VPN and security capability, certification set, and lifecycle. Each is decoded below.

Operating temperature is the first filter. Industrial units typically rate -40 to +70 degrees Celsius (-40 to +158 degrees Fahrenheit); the Cisco Catalyst IR1101 is rated -40 to +60 degrees Celsius standard and is type-tested to higher extremes, and Teltonika's RUT956 spans -40 to +75 degrees Celsius. Confirm whether the rating is for ambient still air or requires forced airflow, and check that the cellular module and any SFP carry the same rating, because a commercial-temp SFP silently narrows the whole unit's window. Storage temperature and humidity (often 5 to 95 percent non-condensing) are listed separately.

Power input on industrial routers is a wide DC range, commonly 9 to 60 VDC, accommodating 12 V, 24 V, and 48 V plant buses and vehicle systems; rail and substation units extend higher (for example 72 to 110 VDC). Look for reverse-polarity and surge protection, redundant power inputs on higher-end models, and ignition-sense or delayed-off behaviour on vehicle units. Typical power draw is modest, around 5 to 12 W, which keeps the unit fanless. Power over Ethernet (PoE/PoE+) input or output may be offered.

WAN and radio specifications define connectivity. For cellular, this is the modem category (Cat 1/4/12/20 or 5G SA/NSA) and the exact band list (for example LTE B2/B4/B5/B12/B13/B14/B17/B66 on a North American unit), which must match the local carrier; a region-specific SKU exists precisely because bands differ. Antenna count and type (2x2 or 4x4 MIMO, SMA/TNC/N connectors) and GNSS support (GPS, GLONASS, BeiDou, Galileo) for location and time sync are listed here. For wired WAN, the spec is port speed and whether an SFP fiber uplink is present.

Ports and SIM indicate the integration level. Two LAN ports means a pure router; four to eight means an integrated managed switch. Note RJ45 versus locking M12 connectors, the number and form factor of serial ports (RS-232/422/485), and digital I/O channels. Dual SIM is near-universal on cellular units, but it is sequential failover on one modem, not simultaneous dual-carrier; verify the failover trigger options (timeout, signal threshold, data cap, ping).

VPN, security, and management close the spec. Expect IPsec, OpenVPN, and increasingly WireGuard, plus GRE and L2TP for legacy peers; a stateful firewall with NAT and port forwarding; and ideally IEC 62443-4-2 alignment with Secure Boot. Edge-compute models add a container runtime such as Docker. Finally, confirm the management ecosystem (web UI, CLI, cloud platform, SNMP) and, critically, the lifecycle: product availability and security-patch commitment of 7 to 10 years, because an industrial router is bought to outlive several generations of office hardware.

Selection Decision Factors

To convert the preceding chapters into a specific model, work the decision sequence below in order. Most selection failures come not from a single wrong line but from deciding throughput or brand before pinning the environment and certification requirements that actually gate the choice. These eight steps double as a fixed RFQ template.

1. Deployment environment and certification: Fix the vertical first. Rail demands EN 50155 and EN 61373; substation demands IEC 61850-3 and IEEE 1613; vehicle demands ECE R10; hazardous areas demand ATEX, IECEx, or Class I Div 2. This single decision eliminates most of the catalog before throughput is even discussed.
2. WAN technology and bands: Decide cellular versus wired, then the cellular category. For telemetry and remote access, LTE Cat 1 or Cat 4 is robust and economical; for video, vision, or SD-WAN, choose Cat 12, Cat 20, or 5G NR Sub-6. Verify the band list and 5G mode (SA/NSA) against the actual local carrier provisioning.
3. Operating temperature and ingress: Match the rated window to the site, not to the brochure. Confirm -40 to +70 degrees Celsius if outdoor, and that the cellular module and SFP share the rating. Pick the IP rating: IP30 inside a cabinet, IP66/IP67 for exposed outdoor or vehicle mounting.
4. Power and form factor: Match the DC input to the plant or vehicle bus (9 to 60 VDC typical, higher for rail). Choose DIN rail (EN 60715) for cabinets, panel/M12 for machines and vehicles, rack for telecom rooms. Decide on redundant power and ignition sensing if needed.
5. Ports and integration: Count the LAN ports, serial ports, and I/O you need. A 2-port unit is a pure router; choose an integrated-switch model (4 to 8 ports) if field devices must share the uplink. Specify RJ45 versus M12 and any fiber SFP requirement.
6. Security and VPN: Require the VPN protocols your headquarters uses (IPsec, OpenVPN, WireGuard), a stateful firewall with NAT, and, for OT networks, IEC 62443-4-2 alignment with Secure Boot. Confirm role-based access, TLS-only management, and the ability to disable defaults.
7. Management and edge compute: Decide how a fleet is configured and patched: web UI and CLI for a handful of units, a cloud or on-premises management platform for hundreds. If local analytics are planned, require a container or Docker runtime and adequate CPU and RAM.
8. Total cost of ownership (TCO): Purchase price plus SIM/data plan, installation, and, dominantly, the cost of site visits over a 7 to 10 year life. A cheaper router that reboots unpredictably or reaches end-of-support early triggers truck rolls that dwarf the upfront saving. Weight lifecycle and reliability above peak throughput.

One last dimension that buyers routinely underweight is manufacturer serviceability and longevity: documented 7 to 10 year availability, long-term security patching, a stable management ecosystem, and a regional support and RMA presence. A remote router is bought precisely so that nobody has to visit the site; that promise is only as good as the vendor's firmware discipline and spare-parts logistics over a decade. Cisco (Catalyst IR1101, IR1800), Moxa (OnCell), Teltonika Networks (RUT and RUTX/RUTM), Westermo, Belden/Hirschmann, Digi, Robustel, InHand, Peplink, and Advantech all field credible industrial lines; the right choice aligns the certificate set, software ecosystem, and support horizon with the deployment rather than chasing the highest peak data rate.