Teltonika RUT WireGuard Remote Access: Reach a Cellular Site Behind CGNAT

Teltonika RUT routers are the default choice for sites that live on cellular. The RUT240, RUT360, RUT955, RUT956, and RUTX-series show up on remote pumping stations, solar farms, construction offices, ATMs, digital signage, and any branch where fixed broadband was never an option. That is exactly where traditional remote access falls apart. A 4G or LTE connection almost always sits behind carrier-grade NAT (CGNAT), so the router has no public IP, no way to accept an inbound connection, and no port to forward. A forwarded RDP port or DDNS entry does not exist on a mobile network.

ProxyLink solves this the way the whole platform is built: the router dials outbound. One WireGuard tunnel on the RUT covers every device on the LAN, and because the connection is initiated from the router, CGNAT is irrelevant. RutOS has included WireGuard in the web interface for years, so no extra packages or CLI work are needed to make a Teltonika a ProxyLink tunnel host.

Why Cellular Sites Are the Hardest Case

On a fixed line you can sometimes fall back to a static IP add-on or a forwarded port. On a cellular carrier you usually cannot. Public IPs on mobile plans are either unavailable or an expensive per-SIM extra, and even then the address is dynamic. An outbound tunnel is the only reliable option, and it happens to be more secure: the site never exposes a single inbound port, so a scan of the carrier IP range finds nothing to connect to.

Getting the WireGuard Config from ProxyLink

In ProxyLink, create a new tunnel for the site and set the LAN subnet to match the RUT. The Teltonika default is 192.168.1.0/24. Download the WireGuard configuration, which looks like this:

[Interface]
PrivateKey = <generated-private-key>
Address = 10.100.0.X/16

[Peer]
PublicKey = <proxylink-server-public-key>
Endpoint = 46.225.153.241:51820
AllowedIPs = 10.100.0.0/16
PersistentKeepalive = 25

AllowedIPs = 10.100.0.0/16 sends only ProxyLink tunnel traffic through the VPN, so normal internet traffic and the site's own data still exit through the cellular WAN. PersistentKeepalive = 25 is not optional on a mobile link: it keeps the NAT mapping alive through carrier timeouts and ensures the RUT re-initiates the handshake after a signal drop or reconnect, which cellular connections do often.

Setting Up WireGuard on RutOS

Log into the RUT admin panel at 192.168.1.1 and go to Services → VPN → WireGuard:

1. Create a new instance and name it (for example, ProxyLink), then enable it.
2. Under the instance, set the Private Key to the value from the config, or generate a keypair on the router and paste the resulting public key into ProxyLink instead.
3. Set the interface IP address to the 10.100.0.X/16 address ProxyLink assigned.
4. Add a Peer: paste the ProxyLink server public key, set the endpoint to 46.225.153.241:51820, set Allowed IPs to 10.100.0.0/16, and set Persistent Keepalive to 25.
5. Save and apply.

RutOS installs the route for the peer's allowed IPs automatically. The one step people miss is the firewall: add the WireGuard interface to a firewall zone (or reuse the LAN zone) and allow forwarding from that zone to the LAN, otherwise the tunnel forms but traffic never reaches your devices. Under Network → Firewall → General Settings, confirm the WireGuard zone can forward to lan.

Multi-Subnet and Industrial Sites

Many Teltonika deployments segment an OT or camera network from the main LAN. You do not need a second tunnel. Declare each extra subnet in ProxyLink under Additional Subnets, and every declared subnet becomes reachable through the same peer. A remote site with a control VLAN on 192.168.1.0/24 and a camera VLAN on 192.168.20.0/24 uses one RUT and one ProxyLink tunnel. Make sure the RutOS firewall allows the WireGuard zone to forward to each VLAN's zone.

What Engineers Access

Once the tunnel is up, create a proxy link for each device and service:

• Windows PCs and servers (port 3389), browser RDP, no mstsc.exe or VPN client on the engineer's laptop.
• Linux and edge gateways (port 22), browser SSH terminal, with session recording on paid plans.
• PLCs and HMIs (TCP link), a VPN-secured TCP proxy link to Modbus TCP 502, EtherNet/IP 44818, or S7comm 102, so a laptop tool can go online with the controller.
• IP cameras and NVRs (port 80 or 443), HTTP or HTTPS proxy link to the web UI, no cloud account, no port forwarding.

Every session is logged with engineer identity, target IP and port, start time, and duration. The site keeps zero open inbound ports, and access requires a ProxyLink login with two-factor authentication.

Verifying the Tunnel

On the RutOS status page the WireGuard instance shows a recent handshake time and a non-zero receive counter when the tunnel is healthy. If the handshake never completes:

• Confirm the carrier is not blocking outbound UDP 51820. This is rare but happens on some locked-down APNs.
• Verify the ProxyLink server public key is pasted exactly. One wrong character silently prevents the handshake.
• Confirm PersistentKeepalive is set to 25 on the peer, without it the RUT will not re-establish after a cellular reconnect.
• Check that the WireGuard firewall zone is allowed to forward to the LAN.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. A Teltonika RUT site takes about 10 minutes to configure. Setup guides for MikroTik, pfSense, OPNsense, and OpenWRT-based routers are in the docs.