Teltonika · Router · OTD500 · 5G Outdoor Router

Key features at a glance

• 5G Sub-6GHz connectivity SA/NSA with downlink speeds up to 3.4 Gbps in 4x4 MIMO and LTE Cat 19 fallback
• Dual SIM with automatic failover across eight failure scenarios and inactive SIM protection
• PoE In and PoE Out via RJ45, 42.5–57.0 VDC power input with reverse polarity and surge protection
• Extensive VPN support: OpenVPN, IPsec, WireGuard, Tailscale, ZeroTier, DMVPN, GRE, L2TP, SSTP, Tinc, and Stunnel
• Advanced routing BGP, OSPF v2, RIP v1/v2, EIGRP, NHRP, VRF, and multi-WAN load balancing
• Hardware security with TPM 2.0 module, 802.1x access control, and DDoS and port scan attack prevention
• Outdoor design IP55, PC+ASA plastic housing, operating range from -40 °C to 55 °C, wall or pole mounting

Mobile connectivity and radio performance

The router leverages 5G Sub-6GHz in SA and NSA modes with downlink speeds of 2.4/3.4 Gbps in 4x4 MIMO and uplink speeds of 900/550 Mbps in 2x2. It complies with 3GPP Release 16 and supports LTE Cat 19 with 1.6 Gbps downlink and 200 Mbps uplink. In 3G fallback, speeds reach up to 42 Mbps downlink and 5.76 Mbps uplink.

Four internal omnidirectional antennas cover bands from 617 to 5000 MHz with 50 Ω impedance, a VSWR of 3.5, and a gain of 4.9 dBi. Band locking and used-band display enable fine control over the radio connection. The router supports two Mini SIM 2FF slots at 1.8 V/3 V, as well as a consumer-type eSIM capable of storing up to seven profiles, with no data plans included.

Automatic switching between the two SIMs is triggered by eight scenarios: weak signal, data limit, SMS limit, roaming, no network, network denied, data connection failure, and inactive SIM protection. When two SIMs are present, the inactive card remains in full standby until failover, preventing unintended data usage. The router exposes all SIM status parameters, including IMSI, ICCID, operator, RSSI, SINR, RSRP, RSRQ, RSCP, cell ID, LAC, TAC, MCC, and MNC.

Ethernet, power, and PoE

Two Gigabit Ethernet ports (10/100/1000 Mbps) compliant with IEEE 802.3, 802.3u, and 802.3az standards can be configured as WAN. The router supports auto MDI/MDIX crossover to simplify cabling. Power is supplied via RJ45 with 802.3af/at PoE In over a voltage range of 42.5 to 57.0 VDC. An 802.3af Alternative B PoE Out port allows powering an adjacent device with a maximum output of 15 W, depending on the power supply.

The router’s own power consumption is 2.5 W at idle and 9 W at full load, up to 24 W with PoE Out active. Reverse polarity and transient surge protection are built in. The PC+ASA plastic housing measures 110 x 49.30 x 235 mm and weighs 385 g, with a mounting bracket for vertical wall or pole installation.

Routing, protocols, and load balancing

The router supports static routing, dynamic routing via BGP, OSPF v2, RIP v1/v2, EIGRP, and NHRP, as well as policy-based routing. Initial VRF (Virtual Routing and Forwarding) support allows isolating routing tables within the same device. Load balancing distributes internet traffic across multiple WAN connections, while VRRP and wired links provide automatic failover.

The network protocol stack includes TCP, UDP, IPv4, IPv6, ICMP, NTP, DNS, HTTP, HTTPS, FTP, SMTP, SSL v3, TLS, ARP, VRRP, PPP, PPPoE, UPnP, SSH, DHCP, Telnet, SMPP, SNMP, MQTT, Wake On LAN, and VXLAN. Bridge mode establishes a direct connection between the mobile carrier and a LAN device, while passthrough mode assigns the mobile WAN IP address to another device on the LAN. Framed routing enables support for an IP network behind a 5G UE device.

Mobile quota control allows setting a data limit with a customizable period, start time, warning threshold, and phone number. QoS and Smart Queue Management prioritize traffic by source, destination, service, protocol, or port, with WMM and 802.11e support. DNS over HTTPS secures DNS resolution, and DDNS supports over 25 preconfigured providers with manual addition possible.

Security, VPN, and access control

The router includes a TPM 2.0 module for hardware-based identification and authentication. 802.1x port-based access control ensures secure authentication, and SSL certificate generation is supported via Let’s Encrypt and SCEP. Authentication methods include pre-shared keys, X.509 digital certificates, TACACS+, and internal/external RADIUS servers. IP and login-based connection attempt blocking, along with temporary lockouts, further enhance security.

Attack prevention covers DDoS attacks via SYN flood, SSH, and HTTP/HTTPS, as well as port scans using SYN-FIN, SYN-RST, X-mas, NULL flags, and FIN scan. The firewall manages port forwarding, traffic rules, custom rules, and TTL target customization. Port-based and tagged VLANs ensure traffic separation, while a blacklist/whitelist web filter controls site access.

VPN support is particularly extensive. OpenVPN can run multiple clients and a server simultaneously with 27 encryption methods. IPsec supports XFRM, IKEv1, and IKEv2 with 14 encryption methods. WireGuard, Tailscale, ZeroTier, Tinc, SSTP, Stunnel, GRE, GRE over IPsec, PPTP, L2TP, L2TPv3, L2TP over IPsec, and DMVPN Phase 2 and Phase 3 with Dual Hub are also supported.

Monitoring, SMS, and hotspot

Connection monitoring includes Ping Reboot, Wget Reboot, periodic reboot, and LCP/ICMP link inspection. SMS features cover status checks, configuration, sending and receiving via HTTP POST/GET, EMAIL to SMS, SMS to EMAIL, SMS to HTTP, SMS to SMS, scheduled SMS, autoreply, and SMPP. USSD support enables sending and reading Unstructured Supplementary Service Data messages.

The captive portal hotspot supports internal or external RADIUS servers with MAC authentication, SMS-based authorization, and SSO. Nine customizable themes are provided by default, with options to import and export custom themes. The portal manages internal and external landing pages, walled garden, user scripts, URL settings, user groups, and individual or group-based limitations. DHCP provides static and dynamic allocation with relay, static leases by MAC (with wildcards), and server configuration.