Protectli 4G LTE Modem
Table of Contents
Nearly a year ago at the time of this writing, I received the Protectli 4G LTE modem along with the VP2410. I briefly discussed the modem in my Protectli accessories review. I have been wanting to take a closer look at the modem so that I can not only test how well it functions but also to learn more about dual WAN configurations in OPNsense. Since I work from home, having the modem will also be nice if I need a backup connection if my primary Internet is down or is having intermittent issues.
Unboxing
The build quality of the modem seems nice. It has a solid metal case which feels very sturdy. The antennas feel substantial and stay in place when tightened.
The 4G LTE modem comes with 2 large antennas as well as a micro-USB power cable.
You do not receive a power brick so you will need to either purchase one or simply plug it into a USB port to obtain power. A standard USB port can provide enough power for the modem which is convenient. The USB cable is short so the intended default use case is to plug it into your mini-PC and place the modem beside it. Since the modem is external, you have the option to locate it anywhere that has the best cellular reception.
You also receive a piece of paper including the default IP address and credentials for the modem’s web interface (not pictured below).
A closer look at the front shows the Ethernet port as well as the micro-USB port used for power. The Ethernet port is a 1 Gbps interface. Protectli’s website states you may receive speeds up to 150 Mbps so it is not the fastest cellular data plan available but for a backup connection, it should be plenty of bandwidth for certain tasks.
On the back, you can see the rubber cover which hides the SIM card as well as the factory reset button.
When pulling the cover over, you can see the tiny reset button (requires a paperclip to reset) as well as the inserted SIM card.
Web Interface
The default IP address of the 4G LTE modem is 192.168.123.254. Out of the box, you should be able to access this IP address when you plug a system directly to the modem.
When you open the modem web UI, you will be prompted for a username and password. The default username is admin and the default password will either be admin or admin12345. You should receive a piece of paper in the box which includes the default credentials.
Tip
My default password was admin12345 and I noticed when I factory reset the modem that the default password changed to admin. That is something to keep in mind in case this also affects you as well.
Upon the first login, you will be prompted to change your password. Once you change your password, you will have to log back in again.
NAT Mode Interface
By default the 4G LTE modem is set to “NAT” mode. This means it operates similar to a very basic consumer grade router. There are more options available when running in “NAT” mode, which I will discuss below.
The “Status” page is displayed after you log in. You will see the IPv4 network information for the modem. Notice that it falls within the reserved IP range for CGNAT (RFC 6598), which is 100.64.0.0-100.127.255.255. Since the addresses are not directly accessible and they change frequently, I did not blur out the IP address in the screenshot.
Because the modem is in “NAT” mode with the DHCP server enabled, the modem will assign any connected system such as OPNsense an IP address in the range of 192.168.123.5-192.168.123.10. The IP address range is in the same network as the modem’s web interface.
The “Device Mode” page is where you can change the “NAT” mode to “Modem” mode. “NAT” mode as I mentioned earlier is the default mode.
“Modem” mode essentially puts the modem in bridge mode and passes the IP address to the connected device. Most likely, you will want to use “Modem” mode when using the modem as a secondary WAN connection since you do not need the extra layer of NAT while behind CGNAT.
On the “Ethernet” page, you will see the default IP address of the modem, which is 192.168.123.254. You have the option to change it on this page, but that is perhaps more important when running in “NAT” mode.
There is an option for “DHCP Server” that I recommend you leave checked regardless of the mode you are running unless perhaps you purchased a data plan with a static IP address. If you are running in “NAT” mode, you will want the DHCP server enabled so the device that is plugged into the modem will obtain an IP address.
However, I found out the hard way that disabling the DHCP server while running in “Modem” mode would cause the OPNsense WAN interface to not obtain an IP address. My guess is that disabling the DHCP server also disables all DHCP services. I had assumed the DHCP client would still function properly, but apparently that is not the case.
There are options for “Port Forwarding” and “DDNS” on the “Network” page that you may find useful if you are hosting services on a standalone network. The port forwarding option is likely only useful when you have a data plan with static IP addresses since with the dynamic IP address plans you are behind CGNAT.
When in “NAT” mode, you have a VPN client option for OpenVPN which may be nice if you need to connect to another network securely. However, if you are using the modem as a secondary WAN for your router/firewall appliance, you may be better off using VPN clients on that system since it will likely be much more capable, and you will have other options besides OpenVPN.
The “System” page contains the system time settings, language options, system information, and time scheduling.
You may switch the time zone and the NTP server that is used to synchronize time. Time scheduling might be useful if you want to limit usage during certain hours especially since the connection is metered. Schedules may help save some money by ensuring data is not being used during off hours.
In the “Administrator” section on the “Manager” page, firmware updates can be performed as well as configure remote access options. Additionally, you can reboot/reset the modem.
Remote access may be useful if you are setting up the modem for a standalone system or network that is located offsite. If you are using “Modem” mode, you will not have remote access options available.
On the “Password & MMI” page, you can see the options to change your username/password. You can also limit the number of password attempts, which is a nice feature to have to prevent password guessing attacks.
Modem Mode Interface
When the modem is in “Modem” mode, many of the options are no longer available. This behavior is similar to all-in-one devices that are rented or provided by ISPs and you set the device to “bridge” mode. Essentially the device is functioning purely as a modem rather than modem + router.
I noticed when switching to “Modem” mode, I could no longer access the web interface via 192.168.123.254. Instead, I was able to connect to the web interface using the CGNAT address assigned to the device which is plugged into the modem. For example, when my OPNsense WAN interface was assigned 100.114.91.184 for the gateway (displayed on the “Dashboard” page), I simply used that IP address to access the modem’s web interface.
After logging in when in “Modem” mode, you will notice that the “Network” tab is no longer displayed with the IPv4 address of the modem. That is because the IP address is now passed through to the device which is connected to the modem since the modem is operating as a bridge now. If you have OPNsense connected, for example, you will see an IP address in the CGNAT IP address range instead of an address in the 192.168.123.x network.
On the “Network” page in the “Setup” section, the options for port forwarding and dynamic DNS are no longer available. There is also no VPN client available.
The “Ethernet” page will still show the 192.168.123.254 IP address even though you cannot use it to access the web interface in “Modem” mode as far as I am aware (as mentioned, the CGNAT IP address works fine).
Warning
As mentioned above, do not disable the DHCP server on the “Ethernet” page when in “Modem” mode (unless perhaps you are using a static IP address configuration) since your connected device will no longer be able to obtain an IP address.
On the “System” page, the only option available is the “Language” option. The “System Information” page is still available.
For the “Administrator” section, there is no longer a “Utility” page and the “Manager” page only has firmware upgrade options and the reboot/reset functionality.
Interestingly, the options to change your username and password are no longer displayed so you should change them before switching to “Modem” mode.
I hope you found the walkthrough of the Protectli 4G LTE modem to be informative! Stay tuned for future guides on dual WAN configurations if you are interested in that topic!
