If an enterprise firewall already controls routing, VPNs and security policy, choosing between a 4G modem and a 4G router should start with one architectural question: which device should own the network functions after cellular WAN is added?
A FortiGate, Cisco, Sophos, pfSense or similar firewall may already manage NAT, DHCP policy, VPN termination, access rules, logging and WAN failover. Adding a cellular device in front of it can preserve that design—or quietly create a second routing layer that makes the network harder to operate.
Start by deciding what the firewall must continue to control. Then determine whether the cellular device should act mainly as the WAN access layer, provide IP passthrough or bridge-like behaviour, or remain a routed device for a specific reason.
If the existing firewall should remain the main router and security boundary, choose the cellular device by the WAN handoff it can provide—not simply by whether the product is called a modem or router. A direct modem can be appropriate when its interface fits the firewall or host. An Ethernet cellular router with a suitable passthrough mode can be more practical when the firewall expects an RJ45 WAN connection.
Where should the cellular layer stop and the firewall begin?
The cellular device is only one layer in the connection. The important boundary is where routing, translation, VPN and security responsibility moves to the existing enterprise firewall.
1. Decide what the existing firewall should continue to own
Start with the existing network rather than a product catalogue. If the firewall already operates as the site’s security boundary, it probably has established rules for outbound traffic, site-to-site VPNs, segmentation, remote administration, logging and failover.
Moving some of those responsibilities into the cellular device changes more than the WAN medium. It changes where routes are created, where addresses are translated, where engineers change policy and where they must look when a connection fails.
The firewall remains the intended translation point between the protected network and WAN.
Determine whether the cellular device adds another translation layer before traffic reaches the mobile network.
LAN-side addressing stays under the existing firewall or established network infrastructure.
Confirm how the firewall WAN port receives its address and whether another private subnet is being created.
Existing site-to-site or remote-access tunnels continue to terminate on the enterprise firewall.
Confirm that cellular addressing and translation do not create an avoidable conflict with the established tunnel design.
Security rules, segmentation and logging remain in one established operational control point.
Identify whether the cellular device is applying another firewall or filtering policy that must also be maintained.
If NAT, VPN and security policy should all remain on the firewall, the cellular device should usually be evaluated mainly on how cleanly it provides the required WAN connection. If some of those functions deliberately belong upstream, a routed cellular device may be the more coherent architecture.
2. A router is not automatically the wrong choice when a firewall already exists
The word on the product label does not tell you how the device will fit into the final network.
A modem may use an interface the existing firewall cannot accept directly. Conversely, a cellular router may support a passthrough mode that allows the enterprise firewall to retain the network responsibilities that matter.
This becomes important when the firewall expects a conventional Ethernet WAN port. A USB cellular modem and an Ethernet router are not interchangeable merely because both connect to LTE.
Adding LTE backup to a firewall that already runs the branch
Consider a branch where the existing firewall already manages the primary internet connection, IPsec tunnels, VLAN policy, logging and WAN failover. Cellular connectivity is being added only as a backup path.
If an LTE router is installed in its normal routed configuration with NAT enabled, the backup connection may still pass a simple internet test. However, the firewall is now operating behind another routed network whenever failover occurs.
If that extra network provides no deliberate value, the better requirement is not simply “buy a modem.” It is: provide the firewall with an appropriate cellular WAN handoff while keeping VPN and security ownership on the firewall.
3. Identify double NAT before it becomes a troubleshooting problem
A successful browsing test does not prove that the network is designed correctly. Internet access can work while both the cellular router and enterprise firewall translate the same traffic.
Firewall-led path
The cellular layer provides the intended WAN connection and the firewall remains the planned NAT and policy point.
Unplanned double NAT
Both devices translate traffic even though the project never intentionally created two separate routing domains.
Double NAT is not automatically invalid. Some architectures intentionally isolate the firewall behind another routed network. The problem is allowing that design to appear accidentally because both devices were left in their default router mode.
VPN establishment, inbound services, port forwarding and remote administration can become harder to diagnose because engineers must work out which device translated, filtered or routed the packet.
During commissioning, record the WAN address visible on the firewall, the address range between the firewall and cellular device, and which device actually performs translation. That evidence is far more useful than assuming behaviour from the words “modem” or “router.”
4. Choose bridge, IP passthrough or routed mode by the result you need
Once network ownership is clear, the operating mode becomes much easier to select. The terminology should still be checked against the actual product documentation, because bridge and passthrough behaviour is not necessarily identical across every cellular platform.
Bridge or bridge-like operation
This direction is relevant where the enterprise firewall should remain the primary WAN router and the cellular device should introduce as little routing behaviour as practical.
Verify: what address reaches the firewall, whether NAT remains active and how the modem can still be managed.IP passthrough
Passthrough can be particularly useful when the firewall requires an Ethernet WAN connection but routing, VPN termination and security policy should remain primarily on the enterprise firewall.
Verify: the downstream address handoff, management access and whether any unexpected translation remains in the path.Routed mode
Keep the cellular device routed when it has a defined routing job—for example, it must create its own subnet, connect several downstream systems or manage cellular redundancy independently of the firewall.
Verify: who owns NAT, routing, VPN and policy after both devices become part of the network edge.One limitation also sits outside the local hardware: the mobile carrier’s addressing environment. Passthrough does not automatically create public inbound reachability.
If the SIM is behind carrier-grade NAT, the restriction exists upstream of the firewall and cellular device. The RFC Editor’s RFC 6598 defines the shared IPv4 address space used for service-provider address sharing. For projects requiring inbound access, confirm the SIM addressing model, APN and carrier policy separately from the modem/router decision.
5. Use six architecture questions before choosing the hardware
These questions convert a vague “4G modem vs router” discussion into a requirement that procurement and engineering teams can verify.
If yes, avoid moving routing upstream unless another routed domain solves a clearly defined requirement.
If NAT belongs on the firewall, confirm that the cellular mode does not introduce another unnecessary translation layer.
A USB modem is not automatically a replacement for an Ethernet WAN device. Match the physical interface before comparing secondary product features.
If the existing firewall already owns IPsec or remote-access policy, avoid moving that function into the cellular router without a reason.
Decide whether SIM redundancy belongs inside the cellular device or whether the enterprise firewall should remain responsible for WAN-path decisions.
Confirm CGNAT, public IP or private APN conditions separately. Local passthrough settings cannot remove a carrier-side routing restriction.
6. Match the E-Lins device to the firewall architecture
These three products represent different integration directions. They should not be read as a “good, better, best” ranking. Start with the firewall interface and routing ownership, then choose the product architecture that fits.
M300 4G IoT Modem
The M300 is the most direct modem direction here. Its USB interface is relevant where the firewall or industrial host can accept modem integration directly and routing should remain on the existing platform.
H685t 4G Router
The H685t is the more natural direction when the enterprise firewall expects Ethernet rather than USB. H685 platform documentation includes IP passthrough, making this family relevant to firewall-led WAN designs.
H720tt-G Dual SIM 4G Router
The H720tt-G becomes relevant when the cellular layer itself has a larger routing role and the ordered configuration provides the cellular redundancy required for failover or load balancing.
Which direction fits the existing firewall?
Compare the product category that matches the required WAN handoff
If none of the three architectures above matches the firewall, compare the industrial 4G modem range for host-led integration or the industrial 4G router range for Ethernet handoff, passthrough or a deliberate routing role. Do not force the project into a product with the wrong interface or network responsibility.
Before selecting a model, confirm the firewall WAN interface, required address handoff, NAT ownership, carrier environment and whether cellular redundancy belongs on the modem/router or on the existing firewall.
7. Prove the architecture before the cellular WAN goes live
Basic internet connectivity is not enough for project acceptance. A browser opening a website only proves that packets can leave the network. It does not prove that routing ownership matches the intended firewall design.
The commissioning test should leave enough evidence that another engineer can understand exactly where routing, NAT and policy occur without repeating the entire investigation.
Cellular WAN acceptance check
- Record the firewall WAN address. Compare it with the address expected from the selected cellular mode.
- Identify every subnet in the path. An unexpected private subnet between the cellular device and firewall may reveal another routed layer.
- Confirm where NAT occurs. Do not infer NAT behaviour from the product name.
- Test the actual VPN design. If site-to-site VPNs terminate on the enterprise firewall, test the real tunnel across the cellular connection.
- Check security-policy ownership. Verify that upstream filtering is not changing traffic the firewall team expects to control.
- Confirm cellular-device management. Make sure engineers can still manage the modem/router after passthrough or other special modes are enabled.
- Trigger the actual failover event. For LTE backup projects, disconnect the primary WAN and prove the firewall’s real recovery path.
- Save the final network map. Record WAN addresses, routing boundaries and ownership so future troubleshooting starts from a known baseline.
The purchasing rule can therefore remain simple: decide who owns NAT, DHCP, VPN, policy and failover before deciding which cellular device to buy.
A direct modem makes sense where the interface fits the existing firewall or host and the cellular device should carry minimal routing responsibility. An Ethernet router with passthrough can be the more practical answer when the firewall requires an RJ45 WAN connection. A dual-cellular router makes sense when cellular redundancy is deliberately assigned to the cellular edge.
Frequently asked questions
Does a firewall need a 4G modem or a 4G router?
How can double NAT be avoided on a cellular WAN?
When should the cellular device remain in routed mode?
Which device should receive the cellular WAN address?
Send the firewall architecture before asking for a cellular WAN recommendation
The most useful inquiry is not simply “Which cellular device should I buy?” Provide the information that determines whether the project needs a direct modem, an Ethernet passthrough device or a routed dual-cellular edge.
With those requirements defined, E-Lins can confirm the model against the real firewall integration instead of selecting hardware from the modem/router label alone.
