Industrial 4G router buying guide: IEC 104, Modbus, private APN and M2M SIMs

An industrial router is built to run unattended for years. The differences show up in five places:

• Serial ports and protocols. RS232 or RS485 ports, and software that speaks the protocols your SCADA or PLC uses, so the router can act as a gateway rather than a plain modem.
• Cellular resilience. Two SIMs from different operators, with the router switching by signal or link quality, not by a person swapping cards.
• Mounting and enclosure. DIN-rail clips for control panels, and sealed outdoor units for poles and masts.
• Remote management at scale. Zero-touch set-up, central firmware updates and alarms, because nobody will visit 3,000 sites to change a setting.
• Indian compliance. MTCTE certification, and settings that suit Indian private APNs and M2M SIMs.

SBI's RFP for 4G at about 15,000 off-site ATMs rules out "retail products like USB dongle and home use router" and asks for SNMPv3 management (SBI RFP).

Start with the protocol at each end of the link. The router has to carry it, and often convert it.

IEC 104, DNP3 and Modbus TCP have no strong built-in encryption in their common forms, so the router's VPN does the protecting. If your RTUs speak IEC 101 and your SCADA expects IEC 104, ask in writing whether the router converts between them or only tunnels the serial stream.

Instaroute routers on NexappOS support Modbus RTU/ASCII/TCP gateway, DNP3, IEC 60870-5-101/104 and an MQTT data publisher, with serial DTU over TCP or UDP on models with RS232/RS485 ports. See IoT and M2M connectivity.

"Dual SIM router" covers two different designs, and the difference matters at an ATM or a substation.

• Dual SIM, single module. One cellular modem, two SIM slots. The router uses one SIM at a time and switches when the active link fails a health check. There is a short gap during the switch.
• Dual module. Two modems, each with its own SIM. Both operators are live at the same time, so the router can load-balance or fail over without re-registering on a network.

Pick dual module where a switch-over gap is not acceptable; pick dual SIM where cost matters more. Either way, ask how the router decides to switch: signal strength alone is a weak test of health. Instaroute arbitrates between SIMs by signal, latency or data usage, and runs link health checks for backup, switch and load-balance modes.

Private APN. Operators can put your SIMs on a private APN, often called a closed user group, so field traffic never touches the public internet. SBI's ATM RFP requires this: the network "should be a closed user group for Bank". The router needs a per-SIM APN setting, and ideally per-site variables so each site can use a different operator's APN. Instaroute sets the APN per SIM, with SIM PIN lock and per-modem keepalive, and SDWAN Lite 2.0 lets you set the APN as a per-site variable in the template.

13-digit M2M numbers. DoT decided that all new SIM-based M2M connections would get 13-digit numbers from 1 July 2018, with 10-digit numbers migrated later that year (Moneylife). This mostly affects your operator's systems, not the router. But if your platform sends SMS commands to routers or matches devices by MSISDN, make sure it handles 13-digit numbers.

eSIM. DoT's M2M eSIM instructions of 16 May 2018 (quoted by TRAI) permit embedded SIMs with single or multiple profiles and over-the-air subscription updates. An eSIM avoids SIM theft and loose trays in vibrating cabinets. If you want one, confirm eSIM support model by model before you order, because many industrial routers still ship with physical SIM trays only.

Match the enclosure to where the router lives.

• Inside a panel or cabinet: a DIN-rail router saves space and wiring. IP30 is normal here, because the cabinet provides the protection. Under IEC 60529, IP30 keeps out objects larger than 2.5 mm and offers no water protection.
• On a pole, mast or roof: an outdoor unit rated IP65, which means dust-tight and protected against water jets. Mounting the modem outside, close to the tower, often fixes weak signal in basements, steel kiosks and rural sites better than a longer antenna cable.
• At a desk or wall in a branch: a desktop or wall-mount router with Wi-Fi.

Also ask for operating temperature, power input and surge protection on each model's datasheet.

The router is paid for once; management is paid every year it runs. Check:

• Pricing unit. Per device per year, per data volume, or credit packs. Some cloud platforms meter remote-access or VPN data.
• Hosting. Whether the platform runs in India or can be self-hosted. CERT-In's 2022 Directions require ICT logs to be kept for 180 days within India (CERT-In Directions).
• Zero-touch provisioning and firmware control. Import serial numbers, push templates, and roll firmware to a small canary group before the whole fleet.

Instaroute SDWAN Lite 2.0 charges one flat price per device with no data metering, runs Nexapp-hosted in India or self-hosted, and scales to 100,000 devices per deployment. See SDWAN Lite 2.0.

Telecom equipment sold in India needs a TEC Mandatory Testing and Certification of Telecom Equipment (MTCTE) certificate for its product category. You can check any certificate on the public MTCTE portal. Check the exact model number, not just the brand, because certificates list specific models.

IP routers also come under the National Centre for Communication Security (NCCS) security certification scheme, tested against the Indian Telecom Security Assurance Requirements (ITSAR) for IP routers (NCCS notification). Ask each bidder for the current status per model. Our guide Is MTCTE mandatory for routers? explains both schemes.

Nexapp's TEC MTCTE certificate 244903206 (IoT Gateway, valid to March 2035) covers the IR11004GS, IR11004GSW, IR11004GD, IR11004GDW, IR1180DM, IR1190DMG, IR1105-ODU-4G, IRX100-5G and IRX1160-ODU-5G. It does not cover the IRX100-5Gv2. Details are on the Trust page.

Copy these lines into your RFP or evaluation sheet.

These pairings use only the published specs on each model page.

Every model runs NexappOS with IPsec IKEv2 (AES-GCM, SHA-2, DH groups 14–16), hybrid post-quantum key exchange (ML-KEM, NIST FIPS 203), a zone firewall and SNMP v2c/v3. Compare them side by side on the router range page.

SBI's off-site ATM RFP asks for 99.50% uptime, latency of 100 ms or less, jitter of 10 ms or less, a signal of at least -80 dBm, multi-operator SIMs and a closed user group. That points to a dual-SIM or dual-module router, a private APN on each operator, and an outdoor unit where indoor signal is weak. Nexapp has moved 2,500 ATM sites from VSAT to dual-LTE with day-1 zero-touch provisioning. Read the full VSAT to 4G/LTE playbook or the ATM solution page.