A networking vendor recently released an industrial gateway line built for harsh environments: fanless chassis, wide-temperature design, SIM slots — clearly made for sites where a rack isn't an option. The most common topic in the surrounding discussion wasn't performance, but the same question: once these sites get connected, how do they stay secure?
The question is hard to avoid. Remote sites usually have no cabinet, no room for firewalls or audit appliances, and no dedicated IT staff on site. Once a device is powered on, nearly the entire security job falls on that router — over a carrier cellular link the site doesn't fully control. To get such sites online securely, focus on three things.
Cellular links pass through carrier networks, so data between a site and headquarters should be encrypted before it leaves the device. The approach: the cellular router acts as a VPN client and dials into an OpenVPN or IPsec server at headquarters or in the cloud, establishing an encrypted tunnel between the two ends. It can also work the other way — the router itself runs as an OpenVPN server, and headquarters connects in remotely for checks.
PUSR's USR-G816 and USR-G806w both carry a full VPN protocol stack: OpenVPN, IPsec, L2TP, PPTP, GRE. OpenVPN is enhanced: one device can connect to three different servers as a client at the same time, and can also act as a server. The USR-G806w additionally supports one-click import of .ovpn config files and PKCS#12 certificates — field installers don't need to understand OpenVPN's parameter system, just import and connect. Once the tunnel is up, site devices are no longer directly exposed to the public internet. It's the most basic layer of protection in a cellular scenario.
Remote sites have no fixed IP and nobody standing next to the equipment. Port-forwarding the management interface to the public internet isn't practical in a cellular environment, and it's also an obvious attack surface. The steadier direction is the reverse: the device initiates an outbound management connection, and staff at headquarters handle parameter configuration, device reboot, and firmware upgrade from a web page — no management port ever needs to be opened to the public internet.
Both the USR-G816 and USR-G806w connect to the PUSR remote management platform for parameter configuration, device reboot, and firmware upgrade. The platform also pushes real-time alarms — device offline, weak signal, traffic overrun — via email or SMS. The point of alarms: headquarters gets notified the moment a power loss, an outage, or abnormal traffic happens, instead of finding out at the next site inspection.
For a remote site, losing the link means losing contact, and temporarily losing control of on-site equipment. There should never be just one way to connect. The USR-G806w supports cellular, wired, and Wi-Fi access, switching to the backup link automatically when the primary fails; the USR-G816 has WAN failover, switching to the backup network automatically when the primary link goes down. Dual hardware and software watchdogs, surge and ESD protection, an operating range of -20°C to 70°C for the G806w and -35°C to 75°C for the G816 — these routers keep running 24/7; the G806w also mounts on DIN rail, so it can sit directly in an on-site distribution cabinet. Availability is itself part of security. If the link is down, every other protection is out of reach.
The more remote a site is, the fewer traditional IT devices it can rely on, and the more the security job falls to that cellular router. Tunnel at the router, management dialing out, link redundancy — get these three things right, and a site with no dedicated IT can stay controlled, manageable, and observable.
