How to Choose an Industrial IoT Gateway: 9 Essential Criteria (2026 Guide)

· 12 min read
12 min read
Eziwan Team
Eziwan Team
IoT Infrastructure

The market for industrial IoT gateways has expanded significantly in recent years. With such a vast array of options—from Taiwanese brands priced at €80 to integrated solutions costing €2,000, and from simple Modbus devices to gateways with VPN and edge computing—how can you make sense of it all?

This guide describes the nine criteria that help distinguish a gateway truly suited for industrial environments from a poorly repurposed consumer-grade product. It is intended for maintenance managers, automation engineers, and industrial IT directors who are planning a connectivity or monitoring project.

Criterion 1: Industrially supported protocols​

This is the number one criterion. If your gateway doesn't "speak" the same protocol as your devices, all other criteria become secondary.

Essential Protocols in France in 2026​

Modbus RTU (RS-485) — The gold standard in French industry. Energy meters, HVAC controllers, sensors, variable-frequency drives: if your equipment has an RS-485 serial port, it likely uses Modbus RTU. Any industrial gateway worth its salt must support it natively.

Modbus TCP (Ethernet) — The network version of Modbus. Newer PLCs, Modbus-Ethernet gateways, and devices with RJ45 interfaces. Check whether the gateway supports the role of Modbus master (active polling) or only that of a server (passive).

MQTT — The quintessential IoT messaging protocol. Used to publish data to cloud brokers (AWS IoT, Azure IoT Hub, local Mosquitto MQTT). Essential for cloud-native architectures.

OPC-UA — IEC 62541 industrial standard, adopted by Siemens, Rockwell, and Beckhoff for recent PLCs. If your IT system includes Siemens S7-1500/1200 PLCs or a recent version of TIA Portal, check for OPC-UA compatibility.

Specific Protocols:

  • DNP3: power grids, drinking water, gas (France, North America)
  • IEC 61850: high-voltage substations
  • M-Bus: heat, water, and gas meters (buildings, district heating networks)
  • BACnet: HVAC and building automation systems (BAS)

Protocol Checklist:

  • Modbus RTU (RS-485) in master mode
  • Modbus TCP in master mode
  • MQTT with TLS 1.2/1.3
  • Industry-specific protocols

Criterion 2: Network Connectivity and Redundancy​

4G LTE: The Current Standard​

An industrial gateway in 2026 must include at least a 4G LTE Cat-M1/Cat-4 module. 4G covers 97% of France’s population and is sufficient for 95% of industrial IoT applications (real-time monitoring, alerts, remote access).

Points to Consider:

  • Is the 4G module built-in (internal M2M SIM) or external (USB dongle)?
  • An external module is an additional source of failure and poor thermal management
  • Some gateways are labeled “4G compatible” but require an external modem—proceed with caution

Dual SIM: True Network Redundancy​

One SIM card = one carrier = one point of failure. In certain industrial areas (partial dead zones, tunnels, areas with poor coverage), one carrier may lose signal while the other maintains it.

Dual SIM, which supports two SIM cards from different carriers and automatic switching, is the solution for mission-critical applications. Eziwan supports Dual SIM natively.

Questions to Ask:

  • Does the gateway support two SIM cards simultaneously?
  • Is the failover automatic (without human intervention)?
  • Is the failover time acceptable for your application (target: less than 30 seconds)?

Wired Backup Connection​

For sites with fiber or Ethernet available, a gateway with an Ethernet WAN port allows you to use fiber as the primary connection and 4G as a backup. Both connections must be managed simultaneously with automatic and transparent failover.

Criterion 3: Security and Zero Trust Architecture​

Cybersecurity for industrial IoT gateways has become a non-negotiable requirement, driven by NIS2, which now covers a wide range of industrial companies.

What to Check​

Outbound-only architecture: The gateway must establish outbound connections only. No inbound ports should be open on your OT network. This eliminates the attack surface accessible from the Internet. This is the Zero Trust architecture: "Never trust, always verify."

VPN Protocol: OpenVPN is currently the industry standard: robust, extensively audited, it traverses firewalls via TCP port 443 and authenticates using X.509 certificates (AES-256-GCM encryption). IPSec (IKEv2) remains relevant for FIPS 140-2-regulated environments.

Data encryption in transit: TLS 1.3 or higher for cloud communications. Verify that the gateway does not communicate in plain text with an unencrypted MQTT broker.

Authentication: Cryptographic keys per device, individually revocable. Avoid gateways that use a single administrator password shared across all devices.

Secure firmware updates (OTA): Gateways that have not been updated become attack vectors. Verify that the gateway supports cryptographically signed OTA updates.

NIS2 and Liability​

Since October 2024, NIS2 has required essential and significant entities to manage the security of their digital supply chains, including IoT gateways. A gateway that opens incoming ports on the OT network or communicates in plain text is considered a NIS2 non-compliance.

Criterion 4: Robustness in Industrial Environments​

An "industrial" gateway must be able to withstand real-world industrial environments. Here are the certifications and specifications to check:

Operating Temperature​

ApplicationMin. temperatureMax. temperature
Air-conditioned equipment room-10°C+40°C
Non-air-conditioned cabinet-20°C+60°C
Outdoor / cold environment-40°C+70°C

A standard IT gateway operates between 0°C and +40°C. A true industrial gateway typically operates between -20°C and +70°C.

IP Rating​

IP20: Minimum protection; for use only in a closed cabinet in a clean room.
IP40: Protection against solid objects larger than 1 mm. Standard equipment cabinet.
IP65: Dust-tight and protected against water jets. For dusty environments (food processing, construction, outdoor use under cover).
IP67: Temporary submersion up to 1 meter. For very humid environments.
IP68: Prolonged submersion. Rarely necessary but useful for underground equipment.

Vibrations and Shocks​

For applications in industrial vehicles, overhead cranes, compressors, or vibrating environments: verify compliance with EN 61131-2 or IEC 60068 for mechanical testing.

DIN Rail Mounting​

For installation in an electrical cabinet, mounting on a 35mm DIN rail is the industry standard. Avoid gateways that require wall screws or non-standard 19" rack mounting for industrial installations.

Regulatory Certifications​

CE (EU requirement): CE marking is required for all electronic equipment sold in Europe.
ATEX (explosive atmospheres): For chemical and oil facilities with potentially explosive atmospheres. ATEX Zone 1/2 or Zone 21/22, depending on the application.
EN 61131-2: Specific standard for equipment used with programmable logic controllers (PLCs).

Criterion 5: Zero-Touch Provisioning (ZTP)​

ZTP is a criterion that is often underestimated, especially when deploying dozens or hundreds of gateways.

Without ZTP: Each gateway must be configured manually before deployment. A technician must log in to the local interface, enter the cloud server's IP address, credentials, network settings, etc. For 50 sites, that’s 50 visits of at least 30 minutes each = 25 hours of technical work, plus travel time.

With ZTP: The gateway automatically connects to the management cloud the first time it is powered on (via a preconfigured M2M SIM). It downloads its configuration from the server and is operational in less than 5 minutes without any local intervention.

Questions to Ask the Provider:

  • Is ZTP truly "zero-touch," or does it still require initial configuration?
  • Is the M2M SIM preconfigured with the cloud server settings?
  • If there is a provisioning issue, how is remote diagnostics performed?

Criterion 6: Edge Computing and Local Logic​

The most advanced gateways have enough computing power to execute logic locally, without relying on the cloud:

Local aggregation: Calculate averages, min/max values, and totals over a period (e.g., energy consumed in kWh per hour) before sending the data to the cloud. This reduces the required bandwidth.

Local Alerts: Trigger a local alarm (relay, buzzer, direct SMS) without going through the cloud. Useful in the event of a network outage—the gateway continues to monitor and send alerts locally.

Data Filtering: Send only data that has changed by more than a defined threshold. This drastically reduces mobile data costs at sites with high traffic.

Logic Scripts: On advanced gateways (Eziwan, certain Teltonika models), you can run Python or JavaScript scripts locally to handle complex business logic.

Criterion 7: Management and monitoring from a centralized console​

For multi-site projects (3–4 sites or more), the centralized management console is a key differentiator:

Fleet Dashboard: Real-time view of the status of all gateways (connected/disconnected, signal strength, active alerts).

Remote firmware updates: Deploy a security update to 50 gateways with just a few clicks, without having to travel to the site.

Remote Configuration: Change an alarm threshold, add a new sensor, or modify a network setting—all from the web console.

Fleet Alerts: Receive a notification when a gateway loses its connection or when a device exceeds a threshold.

Criterion 8: Data Hosting and Digital Sovereignty​

This criterion has become strategic for French companies in light of NIS2 and digital sovereignty requirements.

Key Questions:

  • Where is the data collected by the gateway hosted?
  • Is the software provider subject to the U.S. CLOUD Act (as a subsidiary of a U.S. company)?
  • Can the data be seized by foreign authorities without notification?
  • Is the service provider ISO 27001 certified? Is it SecNumCloud (ANSSI) certified for OIVs?

For NIS2 essential entities and operators of critical infrastructure, hosting data in France with a service provider not subject to foreign extraterritorial laws is a de facto requirement.

Criterion 9: Technical Support and Assistance​

Even the best gateway in the world is worthless without support that can answer your technical questions in real time:

Support SLA: What is the guaranteed response time? 4 hours, 8 hours, or 24 hours? For mission-critical industrial applications, an SLA of less than 4 business hours is recommended.

Industrial expertise: Is the support team familiar with the Modbus, PROFIBUS, and Siemens S7 industrial protocols? Or is it a general IT support team?

Documentation: Is the API documented (OpenAPI 3.0)? Are there code examples? Are there Python/Node libraries?

Project Support: Does the vendor offer support during the initial deployment?

Summary Checklist: 9 Criteria​

□ Protocoles
  □ Modbus RTU (RS-485) master
  □ Modbus TCP Master
  □ MQTT TLS
  □ Industry-specific protocols

□ Connectivité
  □ Built-in 4G LTE
  □ Dual SIM with two carriers
  □ Port Ethernet WAN (optionnel)
  □ Délai failover < 30 secondes

□ Sécurité
  □ Architecture outbound-only (zero inbound port)
  □ OpenVPN/IPSec VPN or a modern equivalent
  □ TLS 1.3 for cloud communications
  □ Authentication using a cryptographic key
  □ Signed OTA update

□ Robustesse
  □ Temperature: -20°C / +70°C minimum
  □ IP40 minimum (IP65 if the environment is dusty)
  □ Montage rail DIN 35mm
  □ CE Certifications (+ ATEX if necessary)

□ ZTP
  □ Deployment without local intervention
  □ Preconfigured M2M SIM

□ Edge computing
  □ Local aggregation
  □ Alertes locales sans cloud
  □ Logique locale configurable

□ Centralized console
  □ Real-time Fleet Dashboard
  □ OTA firmware updates
  □ Remote configuration

□ Data hosting
  □ Hosting in France or the EU
  □ Non soumis au CLOUD Act
  □ ISO 27001 minimum

□ Support
  □ Documented SLA
  □ Expertise protocoles industriels
  □ OpenAPI-documented API

FAQ​

What is the difference between an industrial IoT gateway and an industrial 4G router? An industrial 4G router provides IP network connectivity (routing, NAT, VPN). An industrial IoT gateway adds field capabilities: an RS-485 port for Modbus RTU, edge computing, and cloud-native integration (MQTT, REST API). Some products, such as the Eziwan Gateway, combine both functions in a single device.

Can an industrial IoT gateway be used without an Eziwan cloud subscription? The Eziwan Gateway hardware can operate in standalone mode with your own MQTT broker or API. The Eziwan cloud platform (dashboard, ZTP, fleet management, alerts) is optional. That said, it is included in the subscription and eliminates the need to manage server infrastructure.

How many Modbus registers can be collected simultaneously? The Eziwan Gateway can handle up to 500 Modbus registers (RTU or TCP) per polling interval. For deployments with higher requirements (multi-circuit energy meters, lines with numerous sensors), polling can be distributed across multiple configurable time slots.

What is edge computing on an industrial gateway, and do I need it? Edge computing allows logic to be executed directly on the gateway (aggregation, filtering, local anomaly detection, cloud-free alerts). Useful when: connectivity is intermittent (data is processed and buffered locally), the volume of raw data is too large to send to the cloud, or a rapid response is required (<1 s) without going through the cloud.

How can you verify that a gateway complies with NIS2 regulations? NIS2 compliance for gateways includes: communication encryption (TLS 1.3 minimum), strong authentication (X.509 certificates, no default passwords), access traceability (audit log), security updates (signed OTA updates), and data hosting within the EU (GDPR). Ask your provider for their compliance attestation or ISO 27001 certifications.

Further Reading​

Resources​

Additional Resources​