Send HMI alarm emails over a cellular router

What you need

• A cellular router or gateway with at least one Ethernet LAN port, and a SIM on a data plan that permits mail traffic.
• The panel's network and mail screens from its programming software, with the documentation for that model's email fields.
• From your mail administrator: the outgoing server name, the submission port, and an account name and password. Get these from the administrator or the provider; do not guess them.
• A laptop on the same LAN for the checks.
• A small SMTP relay, on a PC or on the router itself if its firmware offers one, for the case described in the mail route section below.

Bring the panel onto the router's LAN

1. Install the SIM as the router's manual directs and power the router. Wait for its registration or signal indicator before configuring anything else.
2. Run an Ethernet cable from the panel to a LAN port. The WAN port faces the carrier; the LAN ports face the machines. Check that link LEDs light at both ends of the cable.
3. Give the panel an address. Reserve one in the router's DHCP server, or set a static address inside a private range: 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, the ranges RFC 1918 sets aside for private networks. Set the gateway to the router's LAN address and the DNS server to the router's LAN address or the carrier's resolver.
4. From the laptop, open a web page or ping a public address. If that fails, the problem is the router or the SIM, and no mail setting will fix it.

Set up the mail route

Enter the server name, port and credentials in the panel's mail setup exactly as your administrator gave them. Current mail submission uses two ports, both defined for that job in RFC 8314: port 587, which starts plain and upgrades to TLS with STARTTLS, and port 465, which runs TLS from the first byte. Port 25 is the server-to-server relay port. Providers refuse client logins on it, and many carriers filter it on cellular networks.

Then check which fields the panel actually offers. If its mail setup stops at a server address and a port, with no account name, password or TLS choice, the panel can only send plain SMTP, and the provider will refuse it. No retry fixes that. Put the relay in: it listens for the panel's plain SMTP on the machine LAN, then forwards every message to the provider on port 587 with the account login and TLS. The panel's mail settings never change again, and every credential that faces the internet stays in the relay, on the machine network, behind the router's firewall. If the mail client should live in a controller instead of the panel, a worked SMTP setup for a PLC mail function shows the same server, port and login entries in order.

A server name resolves only if the panel has a working DNS entry. When a send error names the server, the DNS-first check for an HMI email send error walks the resolver checks in the right order, before the mail settings get changed again.

Email carries the alarm text and small attachments. The full alarm history file is a separate job; saving more than 64 alarms from an HMI history to USB covers exporting the history to a drive.

What the carrier changes

Many cellular services put the router behind carrier-grade NAT, the shared address range 100.64.0.0/10 set out in RFC 6598. Connections started from the internet toward the panel will not arrive. Outbound mail does not care: the panel hands the message to the router, the router sends it from the carrier's address, and no public address or port forwarding is involved.

Do not add port forwarding to make mail work; mail is outbound. One safety rule covers the rest: if you also need remote access into the machine network from outside, that is a VPN job, and setting up a VPN router for remote PLC and HMI access is the design to use instead of opening the panel to the internet.

If the panel must speak plain SMTP and the carrier filters outbound port 25, the relay clears that too: the panel-to-relay leg stays inside the LAN and never crosses the cellular link, and only the relay's port 587 traffic leaves the site.

Example: a lift station panel on a 1 GB plan

A lift station panel must email high-level alarms to the on-call operator. There is no plant Ethernet at the pit, so a cellular router goes in the control panel with a 1 GB monthly plan.

The router's LAN is 192.168.10.0/24, mask 255.255.255.0. That is 256 addresses minus the network and broadcast, so 254 usable hosts, 192.168.10.1 through 192.168.10.254. The router takes 192.168.10.1. The panel gets a static 192.168.10.50, gateway 192.168.10.1, DNS 192.168.10.1.

The panel's mail setup offers a server field and nothing else, so a relay runs on a small PC at 192.168.10.2, listening on port 25. The panel sends each alarm to 192.168.10.2:25, and the relay forwards it to the provider's submission service on port 587 with the account login and TLS.

Now the traffic. Alarms run about 20 emails per shift at roughly 15 KB each: 20 × 15 KB = 300 KB per shift, × 3 shifts = 900 KB per day, × 30 days = 27 MB per month. Against 1,000 MB in the plan, alarm mail is under 3 percent of it. The result: the plan is sized by log uploads and remote access, and the operator's phone gets each high-level alarm within minutes of the pump event.

How to check it worked

1. Send the panel's documented test email. If the model has no test function, force a harmless configured alarm.
2. Look for the message in the intended inbox, including the spam or quarantine folder, within about five minutes. The delivered message is the acceptance check for the whole path: cable, address, DNS, mail client, relay and carrier in one result.
3. If it fails, name the layer before changing anything, in this order: link LEDs, ping the router's LAN address, resolve the mail server's name, the provider's login and TLS, then the relay's queue. Fix one layer at a time.
4. Power-cycle the router once and repeat the test. A route that recovers without manual steps after a reconnect is the one you can leave on site.
5. If a status indicator stays red while a TCP port test to the relay succeeds, the red offline link indicator that persists after a passing TCP port test explains that mismatch.

Recommendation: Use a cellular router with at least one Ethernet LAN port for any panel that must email alarms from a site without plant Ethernet. Reserve or set the panel's address in a private range with the router as gateway and DNS, and add a local relay the moment you see the panel's mail setup has no login or TLS fields. Choose a bare modem or a phone hotspot only where the panel's documentation names that connection type as supported.

Questions