Public Questions & Answers

A router can lose its internet session while remaining registered to the mobile network. In that case, an SMS command may still reach it and allow a status check, modem reset, SIM change or full reboot. This gives support staff a second recovery channel without travelling to the site. It is particularly useful where the normal management tunnel depends on the failed data session. The recovery path must be configured and tested before deployment, including…

SMS can be useful for status requests, controlled rebooting, changing between WAN and cellular paths, switching a supported relay output or reporting a digital-input alarm. Because SMS uses the mobile signalling path, it may still work when normal packet data or the remote VPN is unavailable. Only functions explicitly supported by the router and safely connected equipment should be used. Physical control requires interlocks and a fail-safe design; an SMS …

Alerts for loss of heartbeat, repeated WAN failover, poor signal quality, high data usage, low supply voltage, excessive temperature, repeated reboots and failed VPN tunnels can reveal problems before a user complains. Digital-input alarms can report events such as a cabinet door opening, pump fault or external power failure. Good alerts include enough context to act: site name, time, current path, recent readings and suggested checks. They should use thr…

Low-risk actions such as collecting diagnostics, refreshing status, retrying a failed connection or performing a scheduled health check can often be automated. A staged recovery sequence may restart a modem interface, renew the WAN, switch SIMs and finally reboot the router if earlier steps fail. Actions that can interrupt control systems, change security policy, update firmware, erase configuration or operate physical equipment should normally require ap…

Put the contractor into a separate VPN identity or group and apply firewall rules that permit access only to the required device, port and time window. Where practical, place the target equipment in its own VLAN and deny access to router administration and other site networks. Use named accounts rather than shared passwords, record connection logs and remove access when the task is complete. A jump host or remote-management platform can provide an additio…

At a glance, the dashboard should show whether each router is online, its last contact time, active WAN or SIM, carrier, public and local addresses, signal-quality readings, data use and recent alarms. It should make abnormal devices obvious rather than forcing the operator to open every record. Useful detail includes firmware and configuration version, uptime, temperature or voltage where available, VPN state, interface traffic and a change history. Grou…

The usual approach is to make the router establish an outbound encrypted connection to a reachable service. Because outbound traffic is allowed through carrier-grade NAT, the technician can then enter through a managed tunnel, overlay network or central VPN gateway without exposing the device directly to the public internet. Comset’s supported options may include its Network Management System, conventional VPNs or ZeroTier on selected models. Access shoul…

A managed cloud tunnel is usually quick to deploy and works through carrier-grade NAT, with central user and device management. The trade-off is dependence on the provider’s platform, subscription and security model. A private APN can give many SIMs controlled connectivity through the carrier, but it normally requires carrier setup, commercial arrangements and routing into the organisation’s network. A conventional VPN gives the organisation more direct c…

VPN encryption consumes processor time and adds packet overhead. The reduction depends on the router CPU, encryption algorithm, packet size and number of tunnels. A modem capable of high cellular speed may still deliver much lower encrypted throughput if the router’s processor is the limiting factor. For low-volume telemetry the impact may be negligible. For 5G, cameras or large file transfers, ask for tested VPN performance rather than assuming the modem…

A site-to-site VPN is usually best when two networks need ongoing communication, such as a branch, plant or remote cabinet connecting to a central office. The routers maintain the tunnel automatically and devices can communicate according to fixed firewall rules without each user starting a VPN client. Individual remote-access accounts are better for people who need temporary or personal access from different locations. They allow user-level credentials a…

Carrier-grade NAT means the mobile carrier shares a public IP among many customers. The router receives a private address, so unsolicited inbound connections from the internet cannot be forwarded directly to it. Ordinary port forwarding or hosting a traditional inbound VPN server may therefore fail even when the router is configured correctly. Options include an outbound VPN to a server with a reachable address, a managed remote-access platform, ZeroTier-…

Use a separate access point when the Wi-Fi coverage area is large, there are many users, multiple floors, metal obstructions, specialised antennas or a need for modern roaming and central management. The router’s built-in Wi-Fi is convenient for commissioning, a small room or a few local devices, but its ideal cellular location may be a poor Wi-Fi location. Separating the functions lets the industrial router sit near the cellular antenna or equipment cabi…

Use VLANs to separate management, industrial equipment, cameras, staff devices and guest access. Apply firewall rules so each group can reach only the services it needs. The router’s administration interface should not be exposed to ordinary users, and remote access should terminate in a controlled management network rather than the whole LAN. Change default credentials, disable unused services, restrict administration by source address and keep configura…

Count every local device that needs a wired connection, then allow for a management laptop, future equipment and any uplink to a switch. If the router will serve only one controller, two ports may be enough. A camera or small office deployment may need a separate managed switch rather than a router with many built-in ports. Port speed should match the traffic. Gigabit Ethernet is sensible for 5G, high-rate cameras, local file movement or a fast WAN; 100 M…

Not for every application. Most multi-WAN load balancing assigns each session to one path. Several users or downloads can share the total capacity, but one TCP session generally remains on one WAN so its public IP and packet order stay consistent. Some applications can open multiple parallel connections and appear to benefit from both links, while true single-session aggregation normally requires a bonding service or compatible endpoint. Mobile and fixed …

VPN tunnels, voice calls, video meetings, banking sessions, remote desktop connections and some cloud applications can be interrupted when their public IP changes. Long-lived industrial or telemetry sessions may also need to reconnect. Even if the router fails over quickly, the application may take longer to recover. Use policy rules to keep sensitive traffic on a preferred path where appropriate, and test the actual application through failover. A site-t…

Use separate failure and recovery thresholds. For example, the router may switch to cellular after several failed checks but wait for a longer period of stable primary service before returning. This prevents a marginal NBN or fixed-WAN link from pulling traffic back and forth every few seconds. Health checks should use more than one dependable destination where possible, and the timers should reflect the application’s tolerance for interruption. Some VPNs…

Failover keeps one path active and moves to another when the first fails. Load balancing distributes new sessions across two or more paths, often according to weights or rules. True bonding combines traffic through a service at the far end so that a single flow may use multiple links as one logical connection. A normal multi-WAN router can improve total site capacity by putting different users or sessions on different services, but it does not automatical…