Remote SCADA communication is not simply an internet-access problem. The router must connect field devices, preserve protocol integrity, maintain links under changing radio conditions and prevent unauthorized access to operational technology.
At Tespro, we evaluate a 4G Industrial Router for SCADA Remote Access as part of the complete data path—from PLC, RTU or meter to the SCADA server—not as an isolated networking device.
Selection summary: Match the router to the regional LTE network, field interfaces, industrial protocols, traffic profile, VPN architecture, redundancy target, power supply and operating environment. Remote diagnostics and firmware management should also be evaluated before large-scale deployment.
Start With the SCADA Communication Requirements
Before selecting hardware, define what the router must carry and how important each connection is.
1. Identify the Operational Function
Separate the required functions into:
• Periodic meter or sensor polling
• Alarm and event transmission
• PLC or RTU status monitoring
• Engineering access and diagnostics
• Configuration or firmware transfer
• Remote control commands
4G is generally suitable for telemetry, alarms and controlled maintenance access. However, cellular latency and jitter are variable. Deterministic control loops and safety functions should remain local unless the complete system has been engineered and validated for remote operation.
2. Build the Field Device Map
Record each device's interface, protocol role and communication settings. For serial equipment, confirm:
• RS232 or RS485
• Baud rate, parity and stop bits
• Half-duplex or full-duplex operation
• Master/client and slave/server roles
• Termination, biasing and isolation requirements
A router with an RS485 connector is not necessarily a protocol gateway. Determine whether the application requires transparent serial tunneling, Modbus RTU-to-TCP conversion or data conversion to MQTT or OPC UA.
3. Estimate Traffic and Availability
Estimate normal polling traffic, alarm bursts, VPN overhead and engineering-session traffic. The required LTE category should be based on real data flow rather than theoretical peak speed.
Also define:
• Maximum acceptable outage
• Reconnection time
• Data buffering requirements
• Primary and backup carriers
• Whether remote access must be available continuously or only on demand
Eight Criteria for Selecting a 4G Industrial Router
| Decision area | Engineering checks |
| Cellular compatibility | Regional LTE bands, carrier approval, SIM type, APN settings and roaming requirements |
| Radio performance | RSRP, RSRQ and SINR—not only signal bars—plus antenna gain, cable loss and cabinet location |
| LTE category | Cat.1 for basic telemetry; Cat.4/Cat.6 for larger data volumes, more concurrent sessions or remote file transfer |
| Field interfaces | LAN/WAN quantity, RS232, RS485, GPIO, serial isolation and connector arrangement |
| Protocol support | Modbus RTU/TCP, DNP3, OPC UA, MQTT or other required protocols, including supported roles |
| OT security | IPsec, OpenVPN or WireGuard, certificates, firewall, VLAN, access rules and audit logs |
| Resilience | Dual SIM/eSIM, multi-carrier failover, link detection, watchdog recovery and wired/Wi-Fi backup |
| Lifecycle | Remote configuration, FOTA, configuration backup, batch management, certifications and technical support |
A suitable 4G Industrial Router for SCADA Remote Access must satisfy all eight areas. High LTE throughput cannot compensate for missing protocols, weak security controls or an unsuitable power and temperature rating.
Match the Router Class to the Application
| SCADA application | Recommended focus | Typical router requirement |
| Remote meter or sensor polling | Low data usage and serial integration | Cat.1, RS485, Modbus and MQTT |
| Pump station or utility cabinet | Mixed PLC, RTU and instrument connections | Cat.1/Cat.4, multiple interfaces, dual SIM and VPN |
| Multi-device industrial site | Concurrent connections and engineering access | Cat.4/Cat.6, multiple LAN ports, VLAN and QoS |
| Edge-to-cloud integration | Protocol conversion and local processing | More CPU/RAM, MQTT, OPC UA, APIs and scripting |
| Critical remote site | Communication continuity | Independent carriers, failover, watchdog and remote alarms |
This comparison prevents over-specification. A small telemetry station may not benefit from Cat.6, while a site handling multiple VPN sessions, firmware packages and edge data may require more processing and network capacity.
Design Secure SCADA Remote Access
A private APN can reduce exposure, but it does not replace encryption, authentication or network segmentation. Carrier-grade NAT may also prevent direct inbound connections, so many deployments use a router-initiated VPN tunnel to a fixed control-center endpoint.
A practical architecture is:
PLC/RTU → Industrial Router → 4G Network → Private APN Or Encrypted VPN → OT Firewall/Jump Server → SCADA Server
For a secure 4G Industrial Router for SCADA Remote Access:
• Avoid exposing PLC, HMI or router management ports directly to the internet.
• Use IPsec, OpenVPN or WireGuard instead of outdated tunnel protocols.
• Apply allowlist rules by IP address, protocol and port.
• Separate field devices, maintenance users and management traffic with VLANs or firewall zones.
• Use individual credentials or certificates and remove default accounts.
• Log access, configuration changes, VPN events and link failures.
• Test firmware updates and maintain a recovery or rollback procedure.
These controls align with the risk-based approach in NIST SP 800-82 Rev. 3, which addresses OT security without ignoring availability and operational safety.
Validate Redundancy and Industrial Reliability
Dual SIM does not automatically mean true redundancy. Both SIMs should preferably use independent carriers, and the switching logic should be tested under weak signal, registration failure and upstream network loss.
Hardware selection should also cover:
• DC input range and reverse-polarity protection
• Surge, ESD and electromagnetic immunity
• Operating temperature and non-condensing humidity
• Metal enclosure and fanless cooling
• DIN-rail or wall mounting
• Required IP protection
An IP30 router, for example, normally belongs inside a suitable industrial enclosure rather than in an exposed outdoor location.
How Tespro Approaches SCADA Router Design
Tespro develops industrial cellular routers with different combinations of LTE, Ethernet, Wi-Fi, serial interfaces and GPIO. Depending on the model, users can select LTE Cat.1, Cat.4 or Cat.6, dual SIM/eSIM switching, and protocols such as Modbus RTU/TCP, DNP3, MQTT and OPC UA.
The TR-244 provides one WAN, four LAN, two RS485, one RS232 and four configurable GPIO interfaces. It also supports:
• IPsec, OpenVPN and WireGuard
• Link detection and automatic reconnection
• Remote configuration and log diagnostics
• Batch configuration and firmware updates through TesproOS
• 12–36V DC input
• Fanless metal construction
• A stated −40°C to +75°C operating range
Projects requiring Gigabit Ethernet, different Wi-Fi capabilities or additional processing resources can be matched to other models in the Tespro industrial cellular router range. Tespro's independent hardware and software development also supports protocol, firmware, interface and OEM/ODM customization.
Conclusion
The right 4G Industrial Router for SCADA Remote Access is the model that fits the complete operational architecture—not simply the router with the highest data rate.
For a new deployment or legacy SCADA upgrade, provide Tespro with the field device list, protocols, carrier region, security policy and environmental conditions. The Tespro engineering team can help evaluate and customize a maintainable router configuration for the application.
FAQs
Q1. Do Tespro routers support dual-SIM failover?
Selected models support dual SIM, dual eSIM or mixed SIM/eSIM configurations. Link detection and automatic switching can maintain connectivity if the primary connection fails. Using independent carriers provides stronger redundancy than two SIMs from the same operator.
Q2. Which cellular networks do Tespro industrial routers support?
The Tespro router range includes models supporting 2G, 3G, 4G and 5G networks. Its 4G configurations may support LTE Cat.1, Cat.4 or Cat.6. Frequency-band compatibility should be confirmed for the target country and carrier.
Q3. Can Tespro routers connect to PLCs, RTUs and industrial meters?
Yes. Depending on the model, Tespro routers provide Ethernet, RS232, RS485 and configurable GPIO interfaces. For example, the TR-244 includes one WAN, four LAN, one RS232, two RS485 and four GPIO interfaces.
Q4. Which SCADA and industrial protocols are supported?
Selected Tespro models support protocols such as Modbus RTU, Modbus TCP, DNP3, MQTT and OPC UA. Protocol roles, conversion modes, register mapping and data formats should be verified against the selected router model.
Q5. Which VPN options are available for secure SCADA access?
Tespro industrial routers can support IPsec, OpenVPN and WireGuard, along with firewall rules, VLAN isolation, certificate management and access control. The final VPN design should follow the asset owner's OT security policy.
