Because a large proportion of installed plant communicates over RS-232 or RS-485 and will not be replaced for many years.

Modbus RTU, DNP3 and a range of manufacturer protocols run over serial links, and the equipment using them - flow meters, protection relays, older PLCs, environmental controllers - is long-lived and expensive to replace.

The router bridges that gap. It either tunnels the serial data transparently to a central system over the network, or converts it into a network-native form such as Modbus TCP so modern software can read it directly.

RS-485 in particular allows many devices on one multi-drop pair, so a single serial port can reach a whole set of instruments.

What to check is the electrical detail: isolation, which matters greatly on long lines between buildings where earth potentials differ; termination and biasing on RS-485; and whether the router's software supports the specific protocol conversion rather than only raw tunnelling.

By translating each one onto a unique range at the router, so the central system sees distinct addresses while the machine keeps the addressing its supplier commissioned.

The problem is universal in industry. A machine supplier configures every unit identically, so ten machines on a site all use the same subnet with the same device addresses. They cannot all be routed to.

The router performs one-to-one translation between the machine's internal range and a unique range on the plant network. The central system addresses the unique range; the router rewrites it; the machine sees exactly what it expects.

The advantages are that no equipment is reconfigured, machine suppliers keep their standard build, and support arrangements are unaffected.

The requirements are careful documentation of the translation map, and attention to protocols that embed addresses in their payload - some industrial protocols do, and they need application-level handling rather than plain address translation.

Firmware update, configuration backup and restore, a connectivity watchdog, and diagnostics readable from the centre - because nobody will visit.

Remote firmware update needs to be robust against interruption: a router that bricks itself when a cellular link drops mid-update is a site visit at best. Dual-image platforms that fall back to the previous version are the safe design.

Configuration must survive power loss and be restorable centrally, so a replacement unit can be commissioned by a local electrician.

A watchdog that pings a known target and reboots the router or the modem on sustained failure recovers the common case of a cellular session that has hung - which would otherwise be an outage until someone notices.

Diagnostics should include signal metrics, data usage, interface state and event logs, all retrievable remotely. Where the platform provides a management portal for a fleet, that is usually worth more than any single hardware feature.

Outbound-only connections, no exposed management, certificate-based authentication, and segmentation between the plant and everything else.

The router should establish a tunnel outward to a central concentrator rather than accepting inbound connections. That removes the entire class of attack against exposed services and works on ordinary cellular addressing.

Management interfaces should not be reachable from the wide area at all, only across the tunnel.

Authentication should use certificates rather than shared keys where the platform allows, since a shared key across a fleet becomes a single compromise.

Segmentation matters because the plant network behind the router is usually old and unpatched by design - equipment that cannot be updated without revalidation. The router is the boundary that keeps it isolated, and its firewall rules should permit only the specific traffic the central system needs.

Physical security deserves a thought too: a router in an unlocked roadside cabinet is a network connection anybody can borrow.

Wide-tolerance DC input, ideally redundant, and a design that survives the site's own power quality - which is usually worse than expected.

Remote industrial sites have dips, spikes and interruptions from motor starts, switching and weather. A router with a wide input range rides through what would reset a fixed-voltage supply.

Where the site has two supplies, dual DC inputs give real redundancy. Where it has one, a small DC uninterruptible arrangement keeps the router and modem alive through short interruptions - which matters because the router is what reports the power problem in the first place.

Solar and battery sites add a different constraint: total power consumption becomes a design parameter, and routers vary considerably. Cellular transmission in poor signal is the largest consumer, which is another reason a good antenna pays for itself.

Confirm the behaviour on power restoration. The router must come back unattended, with its configuration intact, and re-establish its tunnel without help.

Yes, and the outbound tunnel is normally the whole architecture rather than an add-on.

Typical support covers IPsec, OpenVPN and increasingly WireGuard, plus vendor-managed overlays that handle key distribution and addressing for a fleet.

The architecture that works at scale is a concentrator at the centre with every remote router dialling in. Each site gets a unique address range across the tunnel, the central system reaches all of them uniformly, and no site needs a fixed public address.

For fleets in the hundreds, a managed overlay is usually preferable to hand-built tunnels: certificate rotation, per-site policy and onboarding become manageable rather than a spreadsheet.

Check the encrypted throughput of the router itself. Industrial units have modest processors, and while telemetry needs very little, a site with cameras or file transfer can exceed what the device can encrypt - a limit that appears as inexplicable slowness rather than an error.

Match it to the enclosure, not the location - and check the enclosure is what you think it is.

A router inside a sealed roadside cabinet needs a wide temperature range but not ingress protection; the cabinet provides that. The same router on an open structure needs an IP-rated housing.

Temperature inside an unventilated cabinet in direct sun can far exceed the ambient air, and an unheated cabinet in winter can start well below zero - so check the start-up rating as well as the operating range, since they sometimes differ.

Vibration matters on vehicles, rail and rotating plant, and there are specific approvals for those applications that go well beyond a general industrial rating.

Corrosive atmospheres - wastewater treatment being the classic case - attack electronics quickly, and conformally coated variants exist for exactly that.

Where a site has surge exposure, particularly on long copper runs between buildings or on antenna feeds, fit surge protection. Lightning damage on remote sites is a leading cause of equipment failure and is entirely preventable.