Public Questions & Answers

RS-232 is commonly used for point-to-point serial equipment over shorter distances. RS-485 supports differential signalling and is often used for longer industrial runs or multiple devices on a bus. GPIO provides logic-level inputs or outputs, while a relay offers an electrically isolated contact for switching an external circuit. Check the equipment manual for electrical standard, connector pinout, baud rate, parity and control protocol. “Serial” is not …

A dry contact can report whether an external switch or alarm circuit is open or closed. It might monitor a door, pump fault, mains-failure relay, float switch or equipment alarm. A relay output can provide a controlled contact to reset a device, trigger an alarm input, switch an interface relay or operate another low-power control circuit. The router should not directly switch loads beyond its rated output. Pumps, motors, locks and higher-voltage circuits…

Risks include spoofed or forwarded messages, lost phones, shared credentials and commands sent to the wrong device. Restrict accepted sender numbers if supported, use command passwords or tokens, change defaults and keep the allowed command set as small as possible. Do not include sensitive information in reply messages, and consider whether a phone number alone is an adequate identity for the action involved. Log commands and alert on failed attempts. Fo…

A router can lose its internet session while remaining registered to the mobile network. In that case, an SMS command may still reach it and allow a status check, modem reset, SIM change or full reboot. This gives support staff a second recovery channel without travelling to the site. It is particularly useful where the normal management tunnel depends on the failed data session. The recovery path must be configured and tested before deployment, including…

SMS can be useful for status requests, controlled rebooting, changing between WAN and cellular paths, switching a supported relay output or reporting a digital-input alarm. Because SMS uses the mobile signalling path, it may still work when normal packet data or the remote VPN is unavailable. Only functions explicitly supported by the router and safely connected equipment should be used. Physical control requires interlocks and a fail-safe design; an SMS …

Alerts for loss of heartbeat, repeated WAN failover, poor signal quality, high data usage, low supply voltage, excessive temperature, repeated reboots and failed VPN tunnels can reveal problems before a user complains. Digital-input alarms can report events such as a cabinet door opening, pump fault or external power failure. Good alerts include enough context to act: site name, time, current path, recent readings and suggested checks. They should use thr…

Low-risk actions such as collecting diagnostics, refreshing status, retrying a failed connection or performing a scheduled health check can often be automated. A staged recovery sequence may restart a modem interface, renew the WAN, switch SIMs and finally reboot the router if earlier steps fail. Actions that can interrupt control systems, change security policy, update firmware, erase configuration or operate physical equipment should normally require ap…

Put the contractor into a separate VPN identity or group and apply firewall rules that permit access only to the required device, port and time window. Where practical, place the target equipment in its own VLAN and deny access to router administration and other site networks. Use named accounts rather than shared passwords, record connection logs and remove access when the task is complete. A jump host or remote-management platform can provide an additio…

At a glance, the dashboard should show whether each router is online, its last contact time, active WAN or SIM, carrier, public and local addresses, signal-quality readings, data use and recent alarms. It should make abnormal devices obvious rather than forcing the operator to open every record. Useful detail includes firmware and configuration version, uptime, temperature or voltage where available, VPN state, interface traffic and a change history. Grou…

The usual approach is to make the router establish an outbound encrypted connection to a reachable service. Because outbound traffic is allowed through carrier-grade NAT, the technician can then enter through a managed tunnel, overlay network or central VPN gateway without exposing the device directly to the public internet. Comset’s supported options may include its Network Management System, conventional VPNs or ZeroTier on selected models. Access shoul…

A managed cloud tunnel is usually quick to deploy and works through carrier-grade NAT, with central user and device management. The trade-off is dependence on the provider’s platform, subscription and security model. A private APN can give many SIMs controlled connectivity through the carrier, but it normally requires carrier setup, commercial arrangements and routing into the organisation’s network. A conventional VPN gives the organisation more direct c…

VPN encryption consumes processor time and adds packet overhead. The reduction depends on the router CPU, encryption algorithm, packet size and number of tunnels. A modem capable of high cellular speed may still deliver much lower encrypted throughput if the router’s processor is the limiting factor. For low-volume telemetry the impact may be negligible. For 5G, cameras or large file transfers, ask for tested VPN performance rather than assuming the modem…

A site-to-site VPN is usually best when two networks need ongoing communication, such as a branch, plant or remote cabinet connecting to a central office. The routers maintain the tunnel automatically and devices can communicate according to fixed firewall rules without each user starting a VPN client. Individual remote-access accounts are better for people who need temporary or personal access from different locations. They allow user-level credentials a…

Carrier-grade NAT means the mobile carrier shares a public IP among many customers. The router receives a private address, so unsolicited inbound connections from the internet cannot be forwarded directly to it. Ordinary port forwarding or hosting a traditional inbound VPN server may therefore fail even when the router is configured correctly. Options include an outbound VPN to a server with a reachable address, a managed remote-access platform, ZeroTier-…

Use a separate access point when the Wi-Fi coverage area is large, there are many users, multiple floors, metal obstructions, specialised antennas or a need for modern roaming and central management. The router’s built-in Wi-Fi is convenient for commissioning, a small room or a few local devices, but its ideal cellular location may be a poor Wi-Fi location. Separating the functions lets the industrial router sit near the cellular antenna or equipment cabi…

Use VLANs to separate management, industrial equipment, cameras, staff devices and guest access. Apply firewall rules so each group can reach only the services it needs. The router’s administration interface should not be exposed to ordinary users, and remote access should terminate in a controlled management network rather than the whole LAN. Change default credentials, disable unused services, restrict administration by source address and keep configura…

Count every local device that needs a wired connection, then allow for a management laptop, future equipment and any uplink to a switch. If the router will serve only one controller, two ports may be enough. A camera or small office deployment may need a separate managed switch rather than a router with many built-in ports. Port speed should match the traffic. Gigabit Ethernet is sensible for 5G, high-rate cameras, local file movement or a fast WAN; 100 M…

Not for every application. Most multi-WAN load balancing assigns each session to one path. Several users or downloads can share the total capacity, but one TCP session generally remains on one WAN so its public IP and packet order stay consistent. Some applications can open multiple parallel connections and appear to benefit from both links, while true single-session aggregation normally requires a bonding service or compatible endpoint. Mobile and fixed …