An industrial router is a Layer-3 network device hardened for continuous operation in plants, substations, and outdoor cabinets, typically rated for -40 to 75 °C, DC 9-60 V inputs, and IP30-IP65 enclosures, far beyond consumer SOHO units [S1][S2].
Selection is driven by the four quadrants buyers always lose points on: environmental rating, cellular/wired uplink generation, protocol and routing depth, and security/VPN stack [S1][S4][S5]. For a deeper read on the wireless counterpart module, see the industrial wireless module sizing guide.
Operating envelope: temperature, IP rating, power
Industrial routers are specified for ambient temperatures from -40 to 75 °C, with industrial-grade 4G/5G modules and 32-bit ARM CPUs to keep MTBF high under continuous load [S1][S5]. Power input is typically 9-60 V DC with reverse-polarity and surge protection, and 24 V remains the most common industrial rail, while redundant DC inputs are standard on DIN-rail and substation builds [S2].
Ingress protection should be chosen by site: IP30 covers control cabinets with filtered airflow, IP54 covers washdown-adjacent and outdoor rooftops, and IP65 covers direct rain, dust, and hose-down zones [S2][S4]. A site drawing that fixes the cabinet IP rating, ambient min/max, and surge class collapses roughly half the candidate list before any radio decision is made.
Uplink generation: 4G LTE, 5G, or wired-first
Cellular routers dominate new IIoT rollouts, with 5G favored where uplink throughput exceeds 1 Gbps or sub-10 ms latency matters, while LTE Cat-4/Cat-6 remains the workhorse for telemetry and SCADA backhaul and should be supported via backward compatibility with 4G/3G fallback [S1][S4]. Dual-SIM redundancy, embedded cellular failover, and regional band locking (North American B2/B4/B12/B13 vs European B1/B3/B7/B20) should be confirmed against the carrier SIM before commissioning [S4].
Wired-first sites (substations, digital grid) still need an industrial router for routing functions even when the uplink is fiber or copper, because Layer-3 protocols such as IPv6, OSPF, BGP, VRRP, and LLDP are required to ride hierarchical or large mesh networks [S4]. For protocol-heavy sites, treat the router and the protocol gateway as a paired buy; the 2026 protocol gateway spec map covers that side of the decision.
Interface and protocol stack: serial, Ethernet, fieldbus
Routers with RS232/RS485 serial ports, multiple Ethernet ports (typically 4-5 with FE/GE mix), and digital I/O are favored because brownfield sites still carry Modbus RTU/TCP, OPC UA, and proprietary SCADA protocols that must traverse without loss [S1][S2]. Multi-protocol support is not optional: Modbus and OPC UA are the two non-negotiables on most RFPs, and the gateway function (not the routing function) is what bridges them to MQTT/HTTPS cloud uplinks.
Industrial protocol traffic has different sizing rules than office LAN. A 4G LTE Cat-4 link of 150 Mbps downlink / 50 Mbps uplink is comfortable for hundreds of Modbus tags but tight for 4K video at 30 fps, so buyers should size the link by peak uplink payload, not headline speed. Watch for a verifiable 32-bit ARM CPU on the datasheet, since 8-bit legacy MCUs cannot sustain encrypted VPN throughput on the same uplink [S5].
Security stack: VPN, firewall, AAA, OOB
Every serious industrial router should ship with IPSec and OpenVPN tunnels, a stateful firewall with port/IP filtering, AAA via RADIUS or TACACS+, and out-of-band (OOB) management for recovery during WAN outages [S4][S5]. Watchdog timers (hardware and software) are a basic reliability primitive: the MCU must auto-reboot on lock-up so an unattended cabinet does not silently fall off the SCADA poll list [S1][S5].
Segmentation matters as much as crypto. Place the industrial router on the plant DMZ edge, terminate the VPN at a known peer, and keep engineering workstations off the fieldbus VLAN. For the Layer-3 routing depth needed, IPv6 plus OSPF/BGP/VRRP/LLDP support is the minimum bar to avoid forklift upgrades when the site moves to a hierarchical WAN [S4].
Selection matrix: matching router class to duty
A compact DIN-rail 4G router with 2 Ethernet ports and 1 serial port is right for a small remote cabinet (telemetry, 1-2 PLCs, < 50 Modbus tags, IP30 cabinet, no VPN mesh), typically under USD 300 list and powered from 12-24 V DC. [S4]
A mid-range 4G/5G router with 4-5 Gigabit Ethernet, dual SIM, RS232/RS485, IPSec/OpenVPN, and an IP54 metal housing is the mainstream pick for plant cells and SCADA backhaul (5-50 PLCs, video sub-stream, redundant uplinks, 9-60 V DC), and usually lives in the USD 400-900 band.
Substation-grade routers add IEC 61850-3, IEEE 1613 surge/vibration ratings, redundant DC and AC inputs, BGP/OSPF/VRRP depth, and OOB console, and they target digital substation and digital grid buyers where failure is not an option. The trade-off is list price in the USD 1,500+ range and longer lead times.
Skip the mainstream mid-range box if the site is outdoor, Class I Div 2 hazardous, or substation-hardened; in those duties an IP65 or IEC 61850-3 SKU is mandatory, not a nice-to-have. The reverse is also true: do not pay the substation premium for an indoor control cabinet on a single 24 V rail, the budget is better spent on a stronger firewall license and dual SIM.
Reliability, certifications, and lifecycle signals
Key reliability primitives to demand on the datasheet: hardware watchdog, software watchdog, automatic reboot on link loss, dual-SIM failover, and a published MTBF figure (typically 100,000+ hours for industrial SKU) [S1][S4][S5]. For hazardous or substation sites, look for ATEX, IECEx, UL Class I Div 2, IEC 61850-3, and IEEE 1613, but only when the exact standard and zone are written into the project spec, since adding every cert is a budget trap.
Lifecycle signals matter more than spec sheets: a vendor with a documented firmware CVE patch cadence, a 5-7 year product availability window, and a hardware revision history is a safer buy than a cheaper box with no public errata. Confirm VPN/SSL library versions, open OpenSSL/OpenVPN branches, and the last firmware date before PO; routers older than 24 months without a security update are a known OT-incident pattern. For a wider view of how spec discipline applies across adjacent process equipment, see the shaped buying map for industrial ceramics reference page.
For a 2026 shortlist, filter candidates by three hard gates first (operating temperature, IP rating, uplink generation), then by protocol and routing depth, and only then by price. Trackable signals for the next quarter: carrier 5G SA vs NSA coverage changes in your region, and any CVE advisory on the candidate router's OpenSSL or IPSec stack.
Spec-level background on the components involved: industrial router, and industrial adhesive.