The regulatory landscape for M2M and IoT connectivity is changing fast. In 2025, simply deploying a Teltonika router or similar device with a Fixed Public IP SIM isn’t just outdated—it may be dangerously non-compliant.
Two major forces are reshaping the way businesses deploy connected infrastructure:
- The Radio Equipment Directive (RED) and its new cybersecurity requirements
- The Network and Information Security Directive 2 (NIS2)—soon followed in the UK by the Cyber Security and Resilience Bill (CSRB)
In this post, we unpack the full scope of these regulatory shifts, highlight why public IP SIMs are now a liability, and show how platforms like IoTinix provide a secure, modern alternative for remote access—without sacrificing control.
🔍 What is RED?
The Radio Equipment Directive (2014/53/EU) governs how wireless and IoT-enabled devices are sold in the European Union. As of August 2024, additional security clauses (3.3(d), (e), and (f)) are now mandatory, requiring manufacturers to:
- Protect networks from device misuse
- Safeguard personal data and privacy
- Prevent fraud via connected equipment
Devices like routers, gateways, and industrial modems must now include features like:
- Encrypted communication (HTTPS)
- Signed firmware and secure boot
- Protection from open interfaces and vulnerabilities
UK equivalent: This is covered under the Radio Equipment Regulations 2017 with UKCA marking, retaining RED’s structure post-Brexit.
Manufacturers like Teltonika have responded by certifying new hardware (e.g. RUTM30, RUTX50) with these RED standards in mind.
🧠 What is NIS2?
NIS2 is not about hardware. It’s about how organisations govern cybersecurity. Effective across the EU from October 2024, it applies to organisations operating in critical sectors:
- Energy
- Transport
- Healthcare
- Public administration
- Telecommunications
- Smart infrastructure (e.g., BMS, CCTV, IoT platforms)
Core NIS2 obligations include:
- Risk assessment and management
- Incident detection and response (reporting within 24h)
- Access control, encryption, logging, and monitoring
- Supply chain assurance
- Governance accountability (fines + management liability)
If your IoT system touches any of these sectors—or connects to them as a vendor—you are likely in scope.
UK equivalent: The Cyber Security and Resilience Bill (CSRB) is expected to become law in 2025–2026. It mirrors many NIS2 elements:
- 24h alert + 72h incident reporting
- Expanding scope to include MSPs and data centres
- Emphasis on third-party/vendor risk
⚠️ Why Fixed Public IP SIMs Are a Major Risk in 2025
Fixed Public IP SIMs were once a staple in remote access for IoT devices. But they’re now one of the most common failure points in otherwise secure deployments.
Real-World Risks:
- Devices exposed to the public internet with open ports
- Default Teltonika/Proroute credentials still active
- Attack surface is live 24/7
- IPs indexed by Shodan and similar tools
- Increasingly targeted by ransomware and brute-force bots
RED compliance does not protect you if your deployment is openly reachable with no authentication or VPN.
✅ When Fixed IP SIMs Might Still Be Acceptable
There are edge cases where Fixed IP SIMs can be secured—but only if best practices are rigorously enforced:
🏢 Office Failover (4G/5G Backup)
- SIM connected to firewall in bridge mode
- All access is routed through internal VPN/firewall
- Router is not accessed directly
🔌 Site-to-Site VPN Initiation
- Router initiates outbound IPsec/OpenVPN tunnel
- Only VPN endpoint is exposed
🔐 Whitelisted Access with IP Filters
- Public IP only reachable from specific static IPs
- Port forwarding is tightly scoped
But Even Then:
- Default router UI must be disabled or locked down
- Updates must be applied regularly
- Logging and monitoring must be active
🏗️ Case Study 1: Legacy CCTV System – Public IP Exposure
Situation: An installer used Fixed IP SIMs to provide access to Teltonika RUT240 routers powering CCTV towers across a business park. Ports 80 and 37777 were left open.
Result: Within 4 months, cameras were hijacked, images were scraped, and multiple routers were soft-bricked by brute force login attempts.
Violation:
- RED: technically passed
- NIS2: total failure in operational security
Fix:
- IoTinix VPN deployed
- SIMs replaced with private IP roaming SIMs
- Router ports closed, RMS logging enabled
🛠️ Case Study 2: Energy Site with IP Bridged Router
Situation: A remote energy monitoring system used Teltonika RUTX50 routers with Fixed IP SIMs. However, the IP was bridged to a firewall with its own strong authentication.
Result: Deployment was considered secure and passed third-party pen testing.
Key Difference: Router itself was not exposed—public IP landed on a hardened firewall.
🔐 IoTinix: A Modern Approach to Secure IoT Connectivity
IoTinix is a VPN-first platform built to eliminate the need for Fixed Public IP SIMs entirely.
Key Benefits:
- No port forwarding or open interfaces
- Compatible with private IP SIMs (roaming or UK-based)
- Centralised user access and logging
- One-click VPN profile generation (OpenVPN/WireGuard)
- Works across Teltonika, Robustel, Proroute, and more
How It Works:
- Router boots and establishes outbound VPN tunnel to IoTinix node
- User receives a secure
.ovpnfile or connects via browser - All device access occurs within a secured tunnel
No exposure. No public IP. No risky shortcuts.
📜 Regulatory Summary Table
| Regulation | Type | Applies to | Covers | UK Equivalent |
|---|---|---|---|---|
| RED | Hardware | Manufacturers | Encryption, firmware, network protection | Radio Equipment Regulations 2017 |
| NIS2 | Organisational | Critical sectors, suppliers | Risk mgmt, monitoring, incident reporting | Cyber Security & Resilience Bill (2025) |
🔧 Implementation Checklist
- ✅ Use RED-compliant devices (Teltonika RUTM30, RUTX50, etc.)
- ✅ Avoid Fixed Public IP SIMs unless essential
- ✅ Use private IP + outbound VPN (e.g., IoTinix)
- ✅ Lock down access with firewalls, certificates, and logging
- ✅ Ensure updates and firmware are managed centrally
- ✅ Document access, recovery plans, and incident protocols
Final Thoughts
IoT and M2M connectivity is no longer just a technical problem. It’s a security and compliance issue. RED ensures the device can be secure. NIS2 (and CSRB) ensure the deployment actually is.
Stop relying on Fixed Public IP SIMs unless you are fully in control of the security perimeter.
Platforms like IoTinix allow you to build flexible, secure remote access into your projects without compromising on control—or compliance.