Remote sites on Starlink and 4G

A practical guide to connecting a remote site over Starlink or 4G: a farm, a quarry, a construction site, a pump station, a bach. It is written for the installer and for the site's owner.

The short version: the box and the software agent need only outbound internet. Starlink and mobile networks rarely give a site a public address, and neither part needs one. Most problems at remote sites are power, signal and data allowances, not networking, so most of this guide is about those.

A site behind a Starlink dish: the box dials out through the router and the dish, and nothing is forwarded in. A 4G router works the same way.

Why these sites are different

Fixed broadband, Starlink and mobile compared, for a site that must be reached from outside.
	Fixed broadband	Starlink	4G and 5G
Public IPv4 address	Often, or available	No: carrier-grade NAT (CGNAT)	No: CGNAT, unless a paid private APN or static-IP plan
Port forwarding works	Usually	No	No
Typical latency	Low	Low to moderate, with brief dropouts	Moderate; varies with signal and load
Data allowance	Usually unlimited	Depends on the plan	Usually capped; video uses it quickly
Main causes of failure	ISP faults	Obstructions, power, weather	Signal, congestion, data caps, power

CGNAT is carrier-grade NAT: the site shares a public address with many others, so nothing can be forwarded to it. Port forwarding and dynamic DNS fail behind it, which is why camera makers' P2P apps and VPN appliances are the usual workaround. The Relayant box or agent dials out to the relay and keeps that connection open, so CGNAT makes no difference to it.

You can confirm a site is behind CGNAT from the router's WAN address. An address from 100.64.0.0 to 100.127.255.255, or a private address, means CGNAT. That is expected and needs no action.

Both networks also carry packets in smaller units than fixed broadband. The tunnel uses a 1320-byte MTU, so packets are not fragmented on them.

Choosing how to connect

There are three ways to put Relayant at the site. All three use the same portal, the same setup codes and the same monitoring.

The three ways to put Relayant at a remote site.
Option	Hardware	Best for	Limits
A. A Relayant box behind the router (recommended)	The Starlink or Teltonika router, plus a Relayant box	Any site; one device to add	One more device to power, about 3 to 5 W
B. The software agent on the Teltonika router	A Teltonika router with enough memory and flash (below)	Sites where every watt and every box matters	Only on larger Teltonika models; updated by package, not over the air
C. The software agent on a Raspberry Pi	The router, plus a Raspberry Pi or small Linux PC	Sites that already have a Pi or a small Linux PC	SD cards wear out; use a good card or a USB SSD, and a stable power supply

In every case the cameras, recorder, controllers and the Relayant box or agent sit on the same local network. That is the router's LAN, usually through a PoE switch.

Starlink with 4G backup. A dual-WAN Teltonika router, such as the RUTX11 or RUTX50, can use Starlink as the main connection and a 4G SIM as backup. It switches by itself. Put Starlink into bypass mode, or connect it to the Teltonika's WAN port, and set up failover in the Teltonika's WAN settings. When the connection fails over, the site's public address changes. The tunnel follows it by itself, and the portal shows the gap.

A suggested kit

A starting point, to be adjusted per site. Model names are examples, not endorsements; check current models, local approvals and prices with your supplier.

A suggested kit for a remote site, as examples.
Item	Example	Notes
Connectivity, Starlink	Starlink Standard or Mini kit	Check whether the kit's router has an Ethernet port; some kits need the Starlink Ethernet adapter.
Connectivity, 4G	Teltonika RUT241 (4G), or RUTX11 (4G, dual SIM, more memory)	The RUTX series if the agent will run on the router (option B).
Antennas, 4G	Two external MIMO antennas, or one dual-element MIMO panel	See Signal, below.
Relayant	A Relayant box, or a Raspberry Pi 4 or 5 with the software agent
Switch	An unmanaged PoE switch with enough PoE budget for all the cameras	Industrial models tolerate wider temperatures.
Power	A 12 V or 24 V DC system with a battery and, off grid, solar	See Power, below.
Enclosure	IP65 or better, ventilated, shaded	See Enclosures, below.
Protection	Surge protection on the antenna feed and any long outdoor Ethernet run; correct earthing

Relayant on a Teltonika router

Option A: a Relayant box behind the Teltonika

Plug the box into a LAN port of the Teltonika. The box takes an address from the Teltonika by DHCP and needs nothing configured on the router.

Option B: the software agent on the Teltonika itself

The agent installs as a package on Teltonika RutOS; the software agent guide has the commands. Before choosing this option, check the router has room:

Flash: about 9 MB free. Over SSH, df -h /overlay shows it. Models with 16 MB of flash, such as the RUT241 and RUT950 class, do not have it; the RUTX series does.
Memory: 128 MB of RAM or more. free shows it.
WireGuard: the kmod-wireguard, wireguard-tools and ip-full packages. RutOS includes WireGuard for its own VPN feature; opkg list-installed | grep -E 'wireguard|ip-full' shows what is installed.

What the package changes on the router is deliberately small. It adds its own interface and one firewall zone of its own, and does not change the LAN, WAN, DHCP, Wi-Fi or existing firewall rules. It runs beside Teltonika RMS and beside any WireGuard VPN the owner already runs, because it uses its own interface.

The Teltonika steps have not yet been checked on a real router; confirm them on the first router of each model before installing at scale.

Signal

Starlink

The dish needs a clear view of the sky. Use the Starlink app's obstruction check before fixing the mount. Trees grow: a site that was clear at installation may not be clear in two years.
Mount it rigidly. A dish that moves in wind loses connection.
Keep the dish cable intact and protected. Do not cut or re-terminate it unless the kit supports that.
Heavy rain and snow cause short dropouts. The tunnel reconnects by itself, and the portal shows the gap.

4G and 5G

Check signal from the router before mounting, and again after. Teltonika routers show these values under Status, Mobile.

Mobile signal readings, as rules of thumb.
Measure	Good	Usable	Poor
RSRP (signal strength)	above −90 dBm	−90 to −105 dBm	below −105 dBm
SINR (signal quality)	above 13 dB	0 to 13 dB	below 0 dB
RSRQ (signal quality)	above −10 dB	−10 to −15 dB	below −15 dB

These are rules of thumb. A site with usable strength but poor quality, from interference or congestion, performs worse than the strength suggests.

To improve them:

Use external antennas, mounted high and outside any metal enclosure or building. Use both MIMO connectors; a single antenna typically halves throughput.
Keep antenna cable short and low-loss. Every metre of thin cable costs signal. For a long run, put the router up near the antennas and run Ethernet down instead, PoE where possible.
For a distant tower, use a directional antenna aimed at it. Find the tower with the carrier's coverage map or a tower-finding app, and confirm by watching RSRP and SINR while adjusting.
Try each carrier's SIM if you can. Coverage maps are estimates.
Lock the router to 4G only if 5G or 3G fallback causes repeated reconnections.

Power

Most remote-site outages are power. Size the system for the worst week of the year, not an average day.

Typical consumption

Approximate figures for planning. Use the datasheets for your actual equipment.

Typical power draw of the equipment at a remote site, approximate.
Equipment	Typical draw
Relayant box	3 to 5 W
Raspberry Pi 4 with the software agent	3 to 7 W
Teltonika RUT241 or RUTX11	2 to 7 W
Starlink Mini	about 25 to 40 W
Starlink Standard	about 50 to 75 W
PoE camera, each	4 to 8 W; more with infrared at night, or heaters
4-channel recorder with a disk	10 to 15 W

Starlink dominates any off-grid budget. Where the 4G signal is good enough, a 4G-only site needs a fraction of the power.

Sizing

Add up the average draw in watts and multiply by 24 for watt-hours per day.
Multiply by the days of autonomy you need with no sun. Two to three days is common; more in winter or in cloudier regions.
Divide by the usable fraction of the battery to get its rated watt-hours: about 0.8 for lithium iron phosphate, about 0.5 for lead-acid.
Size the solar array to recharge that in winter sun, with margin. Your solar supplier will have local figures for peak sun hours.

Fit a low-voltage disconnect, so a flat battery switches the load off cleanly rather than browning out equipment. A brownout is worse than an outage: it can corrupt the recorder's disk and the router's settings.

Boxes and agents reconnect by themselves when power returns, restore their connections and report. The portal shows when the site was unreachable, and the monthly report includes it.

Enclosures and environment

Use an enclosure rated IP65 or better for outdoor equipment, with cable glands rather than open holes.
Heat is the common killer. An enclosure in direct sun runs far hotter than the air around it. Shade it, mount it on the cool side of a structure, ventilate it, and check every device's operating temperature range on its datasheet.
Condensation forms in sealed boxes with daily temperature swings. A breather vent and a desiccant pack help.
Protect against lightning and surges: earth the antenna mast and the enclosure correctly, and fit surge protection on antenna cables and long outdoor Ethernet runs.
Label everything, including which port goes where, and leave a printed sheet in the enclosure. The next person on site may not be you.

Data use

The tunnel and its monitoring traffic are in the order of a few megabytes a day per site. Measure on your first sites; it depends on how many devices are monitored. Video is what uses the allowance.

Approximate data use at a remote site.
Activity	Approximate use
The Relayant connection and monitoring	A few MB per day
Viewing one camera's sub-stream (low resolution)	0.2 to 0.5 Mbit/s: about 100 to 250 MB per hour
Viewing one camera's main stream (1080p)	2 to 4 Mbit/s: about 1 to 2 GB per hour
A recorder uploading to a maker's cloud	Can be gigabytes per day; switch it off if not needed

On capped plans:

Set the monitoring software and phone apps to use the sub-stream by default.
Turn off camera and recorder cloud services the site does not use. They often upload continuously.
Use the Teltonika's data limit and usage alerts, under Services, Data limit, so the site is not cut off without warning.

Installation checklist

Survey: Starlink obstructions, or 4G signal for each carrier, at the planned mount position.
Power: budget calculated, battery and solar sized, low-voltage disconnect fitted.
Router online; WAN address noted (CGNAT is fine); data limit alerts on; firmware current.
In the portal: the site created. For a box, its serial number added under Add a box. For the software agent, the commands from Install the software agent.
The Relayant box or agent connected to the router's LAN and powered.
The box shows Online in the portal once it has checked in. Choose Resync devices and check that every camera and controller appears.
Connect each device the client needs reaching, and test it from off site.
Turn on device monitoring and check who gets told.
Record antenna aim, signal readings, power figures and photos for the site file.

Getting started with a box has steps 4 to 8 in detail.

Troubleshooting

Symptoms at a remote site, their likely causes, and what to check.
Symptom	Likely cause	What to check
The box or agent does not come online	No internet at the router	The router's status page: WAN connected, mobile data on, SIM active, data limit not reached.
	Outbound traffic blocked	Some private APNs and business firewalls block outbound UDP. The tunnel needs outbound UDP to the relay.
	Wrong or used setup code	Box: the code on its label, added in the portal. Agent: its log, as the software agent guide describes.
	Clock wrong after a long power cut	The box waits for the time to be set before connecting. Check the router has internet and DNS.
Online, but drops every few minutes	4G signal or congestion	RSRP and SINR, above. Try another carrier or antenna position.
	Starlink obstructions	The Starlink app's obstruction map.
	Power brownouts	Battery voltage under load, especially at night with infrared on.
Online, but devices are not found	Devices on another network or VLAN	The box or agent must be on the same LAN as the devices, or that network routed to it.
Online, but devices are not found	The agent on Wi-Fi	Wi-Fi client isolation hides other devices. Use a wired connection.
Devices found, but connecting to one fails	Device off or moved	The portal's device health. The box follows a device that changes address by its hardware address.
Devices found, but connecting to one fails	The agent's host firewall	A Linux host firewall can drop the relay's connections; the software agent guide has the rule.
Video stutters or stops	Bandwidth	Use the sub-stream. Check other traffic and data caps.
Everything stops at the same time each day	Power	Battery and solar sizing; low-voltage disconnect settings.
Everything stops on hot afternoons	Heat	Enclosure temperature; shade and ventilation.

If it still does not work

Email [email protected] with the site name, when the portal last saw it, and the router's signal readings. For the software agent, add the last 50 lines of its log.

Something in this guide is wrong or missing? Tell us: [email protected].