# WWAN (Wireless WAN)

> Complete guide to configuring WWAN interfaces (wireless modems) in VyOS for 2G/3G/4G/LTE/5G cellular networks, with examples for major mobile operators

Source: https://opennix.org/en/docs/vyos/interfaces/vyos-wwan/


## WWAN (Wireless Wide-Area-Network) Interfaces

## Overview

WWAN interfaces in VyOS provide network connectivity through wireless cellular modems. This technology lets you use carriers' mobile networks (2G/3G/4G/LTE/5G) to access the internet and build resilient, fault-tolerant solutions.

## Key Features

- Support for 2G/3G/4G/LTE/5G cellular modems
- Integration with the mobile networks of Russian and international operators
- Automatic IP address assignment via DHCP
- IPv4 and IPv6 support
- Integration with VRF (Virtual Routing and Forwarding)
- Signal strength and connection quality monitoring
- Support for modem firmware updates
- Use as a backup channel (failover)

## Supported Hardware

VyOS supports a wide range of cellular modems connected via miniPCIe, M.2, and USB interfaces:

### Sierra Wireless AirPrime Series

- **MC7304** - LTE Cat 3 (up to 100 Mbps)
- **MC7430** - LTE Cat 6 (up to 300 Mbps)
- **MC7455** - LTE Cat 6 (up to 300 Mbps)
- **MC7710** - LTE Cat 3 (up to 100 Mbps)
- **EM7455** - LTE Cat 6 (up to 300 Mbps)

### Huawei Modems

- **ME909u-521** - LTE Cat 4 (up to 150 Mbps)
- **ME909s-120** - LTE Cat 4 (up to 150 Mbps)
- **ME906s** - LTE Cat 4 (up to 150 Mbps)

### HP/Intel Modems

- **HP LT4120** - Snapdragon X5 LTE (up to 150 Mbps)
- **Intel XMM 7160** - LTE Cat 4

### Quectel Modems

- **EC25** - LTE Cat 4 (up to 150 Mbps)
- **EP06** - LTE Cat 6 (up to 300 Mbps)
- **RM500Q** - 5G (up to 2.5 Gbps)

### USB Modems

- Huawei E3372
- ZTE MF823
- Yota LTE modems

## Basic Configuration

### APN Configuration

The APN (Access Point Name) is the operator's access point name required to connect to the internet.

```bash
set interfaces wwan wwan0 apn 'internet.mts.ru'
```

### Obtaining an IP Address via DHCP

```bash
set interfaces wwan wwan0 address dhcp
```

### Static IP Address

Some operators provide static IP addresses:

```bash
set interfaces wwan wwan0 address '10.123.45.67/32'
```

### Interface Description

```bash
set interfaces wwan wwan0 description 'MTS LTE Backup Connection'
```

### MTU

Configuring the Maximum Transmission Unit:

```bash
set interfaces wwan wwan0 mtu 1430
```

## Configuration for Russian Operators

### MTS

```bash
set interfaces wwan wwan0 apn 'internet.mts.ru'
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 description 'MTS LTE Connection'
```

Alternative APNs for MTS:
- `internet.mts.ru` - standard internet
- `internet.mts` - alternative option
- `mts` - simplified option

### Beeline

```bash
set interfaces wwan wwan0 apn 'internet.beeline.ru'
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 description 'Beeline LTE Connection'
```

Alternative APNs for Beeline:
- `internet.beeline.ru` - standard internet
- `beeline` - simplified option

### MegaFon

```bash
set interfaces wwan wwan0 apn 'internet'
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 description 'MegaFon LTE Connection'
```

Alternative APNs for MegaFon:
- `internet` - standard internet
- `internet.mc` - for modems

### Tele2

```bash
set interfaces wwan wwan0 apn 'internet.tele2.ru'
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 description 'Tele2 LTE Connection'
```

Alternative APNs for Tele2:
- `internet.tele2.ru` - standard internet
- `internet.tele2` - alternative option

### Yota

```bash
set interfaces wwan wwan0 apn 'internet.yota'
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 description 'Yota LTE Connection'
```

## IPv6 Configuration

### DHCPv6

```bash
set interfaces wwan wwan0 address dhcpv6
```

### DHCPv6 Prefix Delegation

Obtaining an IPv6 prefix to delegate to local networks:

```bash
set interfaces wwan wwan0 dhcpv6-options prefix-delegation interface eth1 sla-id 0
set interfaces wwan wwan0 dhcpv6-options prefix-delegation length 56
```

## Integration with VRF

Assigning the WWAN interface to a specific VRF:

```bash
set interfaces wwan wwan0 vrf RED
set interfaces wwan wwan0 apn 'internet.mts.ru'
set interfaces wwan wwan0 address dhcp
```

## Backup Channel Configuration (Failover)

### Using WWAN as a Backup Connection

Configuration with a primary wired link and a backup WWAN connection:

```bash
# Primary interface (Ethernet)
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'Primary ISP'

# Backup interface (WWAN)
set interfaces wwan wwan0 apn 'internet.mts.ru'
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 description 'Backup LTE Connection'

# Routing using metric
set protocols static route 0.0.0.0/0 next-hop <primary-gateway> distance 10
set protocols static route 0.0.0.0/0 interface wwan0 distance 20

# Monitoring the availability of the primary channel
set service monitoring interface eth0 address <primary-gateway>
set service monitoring interface eth0 policy 'LTE-Failover'
```

### Policy-based Routing for Failover

```bash
# Creating a routing table for WWAN
set protocols static table 10 route 0.0.0.0/0 interface wwan0

# Policy-based routing
set policy route PBR rule 10 destination address 0.0.0.0/0
set policy route PBR rule 10 set table 10

# Applying the policy
set interfaces ethernet eth1 policy route PBR
```

## Load Balancing

Load balancing between a wired and a WWAN connection:

```bash
# Load balancing configuration
set load-balancing wan interface-health eth0 nexthop <eth0-gateway>
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 8.8.8.8

set load-balancing wan interface-health wwan0 nexthop dhcp
set load-balancing wan interface-health wwan0 test 10 type ping
set load-balancing wan interface-health wwan0 test 10 target 8.8.4.4

# Balancing rules
set load-balancing wan rule 1 inbound-interface eth1
set load-balancing wan rule 1 interface eth0 weight 70
set load-balancing wan rule 1 interface wwan0 weight 30
set load-balancing wan rule 1 protocol all
```

## NAT for the WWAN Interface

### Source NAT (Masquerade)

```bash
set nat source rule 100 outbound-interface name 'wwan0'
set nat source rule 100 source address '192.168.1.0/24'
set nat source rule 100 translation address masquerade
```

### Excluding Local Traffic

```bash
set nat source rule 90 outbound-interface name 'wwan0'
set nat source rule 90 source address '192.168.1.0/24'
set nat source rule 90 destination address '192.168.0.0/16'
set nat source rule 90 translation address masquerade
set nat source rule 90 exclude
```

## Firewall Rules for WWAN

### Basic WAN Interface Protection

```bash
# Creating a zone for WWAN
set firewall zone WWAN interface wwan0
set firewall zone WWAN default-action drop

# Allowing established connections
set firewall ipv4 name WWAN-LOCAL default-action drop
set firewall ipv4 name WWAN-LOCAL rule 10 action accept
set firewall ipv4 name WWAN-LOCAL rule 10 state established
set firewall ipv4 name WWAN-LOCAL rule 10 state related

# Blocking invalid packets
set firewall ipv4 name WWAN-LOCAL rule 20 action drop
set firewall ipv4 name WWAN-LOCAL rule 20 state invalid

# Allowing ICMP
set firewall ipv4 name WWAN-LOCAL rule 30 action accept
set firewall ipv4 name WWAN-LOCAL rule 30 protocol icmp

# Applying the rules
set firewall zone WWAN from LAN firewall name LAN-WWAN
set firewall zone WWAN to local firewall name WWAN-LOCAL
```

### Restricting Access to Management

```bash
# Blocking SSH from the WWAN interface
set firewall ipv4 name WWAN-LOCAL rule 100 action drop
set firewall ipv4 name WWAN-LOCAL rule 100 destination port 22
set firewall ipv4 name WWAN-LOCAL rule 100 protocol tcp
```

## Monitoring and Diagnostics

### Viewing Interface Status

```bash
show interfaces wwan wwan0
```

Example output:
```
wwan0: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 state UP
    link/ether 0e:3e:7d:98:a2:b4
    inet 10.123.45.67/32 scope global wwan0
    RX:  bytes    packets  errors  dropped  overrun       mcast
         15467284   12456       0        0        0           0
    TX:  bytes    packets  errors  dropped  carrier  collisions
          3456789    8234       0        0        0           0
```

### Checking Signal Strength

```bash
show interfaces wwan wwan0 signal
```

Example output:
```
Signal Quality: 85%
RSSI: -65 dBm
RSRQ: -9 dB
RSRP: -85 dBm
SNR: 15 dB
Technology: LTE
Band: B7 (2600 MHz)
```

### Modem Information

```bash
show interfaces wwan wwan0 capabilities
```

Example output:
```
Manufacturer: Sierra Wireless
Model: MC7455
Firmware: SWI9X30C_02.24.05.06
IMEI: 123456789012345
Supported modes: 2G, 3G, LTE
Max bandwidth: Cat 6 (300 Mbps DL / 50 Mbps UL)
```

### Viewing Network Information

```bash
show interfaces wwan wwan0 network
```

Example output:
```
Operator: MTS RUS (25001)
Registration: Registered (home network)
Technology: LTE
Band: B7 (2600 MHz)
Channel: 2850
Cell ID: 12345678
```

### Firmware Information

```bash
show interfaces wwan wwan0 firmware
```

### Interface Statistics

```bash
show interfaces wwan wwan0 statistics
```

### Viewing QMI Information

For modems that support QMI (Qualcomm MSM Interface):

```bash
sudo qmicli -d /dev/cdc-wdm0 --wds-get-packet-service-status
sudo qmicli -d /dev/cdc-wdm0 --nas-get-signal-strength
sudo qmicli -d /dev/cdc-wdm0 --nas-get-serving-system
```

## Advanced Configuration

### Configuring Modem Parameters

#### Forcing a Network Mode

Some modems allow you to force a specific network mode (2G/3G/4G):

```bash
# LTE only
sudo qmicli -d /dev/cdc-wdm0 --nas-set-system-selection-preference=lte

# Automatic mode
sudo qmicli -d /dev/cdc-wdm0 --nas-set-system-selection-preference=auto
```

#### Locking a Frequency Band

Forcing operation on a specific band:

```bash
# Operating only on band B7 (2600 MHz) - the primary LTE band in Russia
sudo qmicli -d /dev/cdc-wdm0 --nas-set-system-selection-preference=lte,band-7
```

### Configuring DHCP Timeouts

```bash
set interfaces wwan wwan0 dhcp-options default-route-distance 20
set interfaces wwan wwan0 dhcp-options no-default-route
```

### Disabling the Interface

```bash
set interfaces wwan wwan0 disable
```

## Updating Modem Firmware

### Sierra Wireless Modems

```bash
# Download the firmware from the manufacturer's website
# Update via qmi-firmware-update
sudo qmi-firmware-update -d /dev/cdc-wdm0 -u <firmware-file.cwe>
```

### Checking the Firmware Version

```bash
sudo qmicli -d /dev/cdc-wdm0 --dms-get-software-version
```

## Practical Scenarios

### Scenario 1: Remote Office with an LTE Connection

A small office with a single communication channel over LTE:

```bash
# WWAN interface
set interfaces wwan wwan0 apn 'internet.mts.ru'
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 description 'MTS LTE - Primary Connection'

# Local network
set interfaces ethernet eth1 address '192.168.1.1/24'
set interfaces ethernet eth1 description 'LAN'

# DHCP server for the local network
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 default-router 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 name-server 8.8.8.8
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 domain-name 'office.local'

# NAT
set nat source rule 100 outbound-interface name 'wwan0'
set nat source rule 100 source address '192.168.1.0/24'
set nat source rule 100 translation address masquerade

# Firewall
set firewall zone LAN interface eth1
set firewall zone LAN default-action accept

set firewall zone WWAN interface wwan0
set firewall zone WWAN default-action drop

set firewall ipv4 name WWAN-LOCAL default-action drop
set firewall ipv4 name WWAN-LOCAL rule 10 action accept
set firewall ipv4 name WWAN-LOCAL rule 10 state established
set firewall ipv4 name WWAN-LOCAL rule 10 state related

set firewall zone WWAN from LAN firewall name LAN-WWAN
set firewall zone WWAN to local firewall name WWAN-LOCAL
```

### Scenario 2: Dual WAN with Priority for the Wired Connection

An office with a wired connection and an LTE backup:

```bash
# Primary wired channel
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'Primary ISP - Fiber'

# Backup LTE channel
set interfaces wwan wwan0 apn 'internet.beeline.ru'
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 description 'Backup ISP - Beeline LTE'

# Local network
set interfaces ethernet eth1 address '192.168.10.1/24'
set interfaces ethernet eth1 description 'Office LAN'

# Routing with priority
# eth0 - primary (distance 10)
# wwan0 - backup (distance 20)
set protocols static route 0.0.0.0/0 dhcp-interface eth0 distance 10
set protocols static route 0.0.0.0/0 interface wwan0 distance 20

# NAT for both interfaces
set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.10.0/24'
set nat source rule 100 translation address masquerade

set nat source rule 110 outbound-interface name 'wwan0'
set nat source rule 110 source address '192.168.10.0/24'
set nat source rule 110 translation address masquerade

# DHCP for the local network
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 range 0 start 192.168.10.50
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 range 0 stop 192.168.10.250
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 default-router 192.168.10.1
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 name-server 8.8.8.8
set service dhcp-server shared-network-name LAN subnet 192.168.10.0/24 name-server 8.8.4.4
```

### Scenario 3: IoT Devices over LTE with Restrictions

Connecting IoT devices with traffic restrictions:

```bash
# WWAN interface
set interfaces wwan wwan0 apn 'internet.tele2.ru'
set interfaces wwan wwan0 address dhcp
set interfaces wwan0 description 'Tele2 LTE for IoT'

# Local network for IoT
set interfaces ethernet eth1 address '10.0.100.1/24'
set interfaces ethernet eth1 description 'IoT VLAN'

# Traffic shaping to limit the speed
set traffic-policy shaper IOT-LIMIT bandwidth '10mbit'
set traffic-policy shaper IOT-LIMIT default bandwidth '10mbit'
set traffic-policy shaper IOT-LIMIT default ceiling '10mbit'
set traffic-policy shaper IOT-LIMIT default queue-type fair-queue

set interfaces wwan wwan0 traffic-policy out IOT-LIMIT

# NAT
set nat source rule 200 outbound-interface name 'wwan0'
set nat source rule 200 source address '10.0.100.0/24'
set nat source rule 200 translation address masquerade

# Firewall - allow only HTTP/HTTPS and MQTT
set firewall ipv4 name IOT-WWAN default-action drop
set firewall ipv4 name IOT-WWAN rule 10 action accept
set firewall ipv4 name IOT-WWAN rule 10 state established
set firewall ipv4 name IOT-WWAN rule 10 state related

set firewall ipv4 name IOT-WWAN rule 20 action accept
set firewall ipv4 name IOT-WWAN rule 20 destination port 80,443
set firewall ipv4 name IOT-WWAN rule 20 protocol tcp

set firewall ipv4 name IOT-WWAN rule 30 action accept
set firewall ipv4 name IOT-WWAN rule 30 destination port 1883,8883
set firewall ipv4 name IOT-WWAN rule 30 protocol tcp
set firewall ipv4 name IOT-WWAN rule 30 description 'MQTT'

set firewall zone IOT interface eth1
set firewall zone WWAN interface wwan0
set firewall zone IOT from WWAN firewall name WWAN-IOT
set firewall zone WWAN from IOT firewall name IOT-WWAN
```

### Scenario 4: VPN over LTE

Connecting to a corporate network via VPN over LTE:

```bash
# WWAN interface
set interfaces wwan wwan0 apn 'internet.megafon.ru'
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 description 'MegaFon LTE for VPN'

# WireGuard VPN interface
set interfaces wireguard wg0 address '10.10.10.2/24'
set interfaces wireguard wg0 description 'Corporate VPN'
set interfaces wireguard wg0 peer HQ address 'vpn.company.ru'
set interfaces wireguard wg0 peer HQ allowed-ips '0.0.0.0/0'
set interfaces wireguard wg0 peer HQ port 51820
set interfaces wireguard wg0 peer HQ public-key '<server-public-key>'
set interfaces wireguard wg0 port 51820
set interfaces wireguard wg0 private-key '<client-private-key>'

# Local network
set interfaces ethernet eth1 address '192.168.20.1/24'
set interfaces ethernet eth1 description 'Local LAN'

# Route all traffic through the VPN
set protocols static route 0.0.0.0/0 interface wg0

# NAT for internet access (if allowed by policy)
set nat source rule 300 outbound-interface name 'wg0'
set nat source rule 300 source address '192.168.20.0/24'
set nat source rule 300 translation address masquerade

# Firewall rules
set firewall zone LAN interface eth1
set firewall zone VPN interface wg0
set firewall zone WWAN interface wwan0

set firewall zone LAN default-action accept
set firewall zone VPN default-action accept
set firewall zone WWAN default-action drop
```

### Scenario 5: Multi-WAN with Balancing Across Multiple Operators

Using two LTE modems from different operators:

```bash
# First modem (MTS)
set interfaces wwan wwan0 apn 'internet.mts.ru'
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 description 'MTS LTE'

# Second modem (Beeline)
set interfaces wwan wwan1 apn 'internet.beeline.ru'
set interfaces wwan wwan1 address dhcp
set interfaces wwan wwan1 description 'Beeline LTE'

# Local network
set interfaces ethernet eth1 address '192.168.30.1/24'

# Load balancing
set load-balancing wan interface-health wwan0 nexthop dhcp
set load-balancing wan interface-health wwan0 test 10 type ping
set load-balancing wan interface-health wwan0 test 10 target 8.8.8.8

set load-balancing wan interface-health wwan1 nexthop dhcp
set load-balancing wan interface-health wwan1 test 10 type ping
set load-balancing wan interface-health wwan1 test 10 target 8.8.4.4

# Even load distribution
set load-balancing wan rule 1 inbound-interface eth1
set load-balancing wan rule 1 interface wwan0 weight 50
set load-balancing wan rule 1 interface wwan1 weight 50
set load-balancing wan rule 1 protocol all

# NAT for both interfaces
set nat source rule 400 outbound-interface name 'wwan0'
set nat source rule 400 source address '192.168.30.0/24'
set nat source rule 400 translation address masquerade

set nat source rule 410 outbound-interface name 'wwan1'
set nat source rule 410 source address '192.168.30.0/24'
set nat source rule 410 translation address masquerade
```

## Troubleshooting

### Problem: Modem Not Detected

**Symptoms**: The wwan0 interface does not appear in the system

**Solution**:

1. Check the physical connection of the modem
2. Check whether the modem is detected by the system:
```bash
lsusb
lspci | grep -i wireless
```

3. Check that the drivers are loaded:
```bash
lsmod | grep -i qmi
lsmod | grep -i cdc
```

4. Check the devices:
```bash
ls -la /dev/cdc-wdm*
ls -la /dev/ttyUSB*
```

### Problem: Modem Detected but Not Connecting

**Symptoms**: The interface is present but does not obtain an IP address

**Solution**:

1. Verify that the APN is correct:
```bash
show interfaces wwan wwan0
```

2. Check the signal strength:
```bash
show interfaces wwan wwan0 signal
```

If the signal strength is below -100 dBm, try improving the antenna placement.

3. Check network registration:
```bash
show interfaces wwan wwan0 network
```

4. Restart the interface:
```bash
sudo ip link set wwan0 down
sudo ip link set wwan0 up
```

5. Check the logs:
```bash
show log | match wwan
journalctl -u NetworkManager | grep wwan
```

### Problem: Low Connection Speed

**Symptoms**: The speed is significantly lower than expected

**Solution**:

1. Check the signal strength and quality:
```bash
show interfaces wwan wwan0 signal
```

Optimal values:
- RSSI: above -70 dBm
- RSRQ: above -10 dB
- RSRP: above -80 dBm
- SNR: above 10 dB

2. Check the technology and band in use:
```bash
show interfaces wwan wwan0 network
```

3. Check the MTU:
```bash
set interfaces wwan wwan0 mtu 1430
commit
```

4. Use an external antenna with a higher gain

5. Check the operator's network load:
```bash
# Speed test
sudo apt install speedtest-cli
speedtest-cli --source wwan0
```

### Problem: Frequent Connection Drops

**Symptoms**: The connection periodically drops and reconnects

**Solution**:

1. Check the signal stability:
```bash
# Real-time monitoring
watch -n 1 'sudo qmicli -d /dev/cdc-wdm0 --nas-get-signal-strength'
```

2. Check the modem temperature (overheating):
```bash
sensors | grep -i temp
```

3. Add monitoring and automatic restart:
```bash
# Monitoring script (/config/scripts/wwan-monitor.sh)
#!/bin/bash
if ! ping -I wwan0 -c 3 8.8.8.8 > /dev/null 2>&1; then
    logger "WWAN connection lost, restarting interface"
    ip link set wwan0 down
    sleep 5
    ip link set wwan0 up
fi
```

4. Add it to cron:
```bash
set system task-scheduler task wwan-monitor interval 5m
set system task-scheduler task wwan-monitor executable path /config/scripts/wwan-monitor.sh
```

### Problem: DHCP Does Not Obtain an IP Address

**Symptoms**: The interface is up but has no IP address

**Solution**:

1. Check the status of the DHCP client:
```bash
sudo journalctl -u dhclient | grep wwan0
```

2. Try renewing the DHCP lease:
```bash
sudo dhclient -r wwan0
sudo dhclient wwan0
```

3. Check the DHCP settings:
```bash
show interfaces wwan wwan0 dhcp-options
```

4. Use a static IP if the operator provides one:
```bash
delete interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 address '10.xxx.xxx.xxx/32'
commit
```

### Problem: DNS Does Not Work over WWAN

**Symptoms**: Ping by IP works, but domain names do not resolve

**Solution**:

1. Check the DNS servers you received:
```bash
show dns forwarding
cat /etc/resolv.conf
```

2. Configure static DNS:
```bash
set system name-server 8.8.8.8
set system name-server 8.8.4.4
commit
```

3. Test DNS through a specific server:
```bash
nslookup google.com 8.8.8.8
```

### Problem: SIM Card Not Recognized

**Symptoms**: The modem works but does not detect the SIM card

**Solution**:

1. Check the SIM card status:
```bash
sudo qmicli -d /dev/cdc-wdm0 --uim-get-card-status
```

2. Check the PIN code (if set):
```bash
sudo qmicli -d /dev/cdc-wdm0 --uim-verify-pin=PIN,<pin-code>
```

3. Check the physical condition of the SIM card (contacts, size)

4. Try a different SIM card to rule out modem problems

### Problem: Modem Works Only After a Reboot

**Symptoms**: After applying the configuration the modem does not work and a reboot is required

**Solution**:

1. Add a delay during initialization:
```bash
# In /config/scripts/vyos-postconfig-bootup.script
sleep 30
```

2. Check the module load order:
```bash
lsmod | grep qmi
sudo modprobe -r qmi_wwan
sudo modprobe qmi_wwan
```

3. Update the modem firmware

### Problem: High Ping over LTE

**Symptoms**: The latency is very high

**Solution**:

1. Check the baseline ping to the operator's gateway:
```bash
ping -I wwan0 <operator-gateway>
```

2. LTE has an inherent latency of 20-50ms, which is normal

3. Check the channel load:
```bash
# Usage monitoring
watch -n 1 'ifstat -i wwan0'
```

4. Use QoS to prioritize traffic:
```bash
set traffic-policy shaper WWAN-QOS bandwidth '50mbit'
set traffic-policy shaper WWAN-QOS class 10 match VOIP ip protocol udp
set traffic-policy shaper WWAN-QOS class 10 match VOIP ip destination port 5060
set traffic-policy shaper WWAN-QOS class 10 bandwidth '10mbit'
set traffic-policy shaper WWAN-QOS class 10 priority 1

set interfaces wwan wwan0 traffic-policy out WWAN-QOS
```

## Monitoring and Logging

### Configuring syslog for WWAN Events

```bash
set system syslog global facility local7 level debug
set system syslog file wwan facility local7 level debug
```

### Monitoring Traffic Usage

```bash
# Viewing interface statistics
show interfaces wwan wwan0 statistics

# Real-time monitoring
monitor interfaces wwan wwan0 traffic
```

### SNMP Monitoring

```bash
set service snmp community public authorization ro
set service snmp community public network 192.168.1.0/24
set service snmp listen-address 192.168.1.1
```

Monitoring the WWAN interface via SNMP:
```bash
snmpwalk -v2c -c public 192.168.1.1 IF-MIB::ifDescr
snmpwalk -v2c -c public 192.168.1.1 IF-MIB::ifInOctets
```

## Performance Optimization

### TCP Optimization for High Latency

```bash
set system sysctl parameter net.ipv4.tcp_congestion_control value 'bbr'
set system sysctl parameter net.core.rmem_max value '134217728'
set system sysctl parameter net.core.wmem_max value '134217728'
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 67108864'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 67108864'
```

### Configuring the MTU for LTE

The optimal MTU for LTE is usually 1430 bytes:

```bash
set interfaces wwan wwan0 mtu 1430
```

### Traffic Shaping

Limiting outbound traffic to prevent congestion:

```bash
set traffic-policy shaper WWAN-OUT bandwidth '40mbit'
set traffic-policy shaper WWAN-OUT default bandwidth '40mbit'
set traffic-policy shaper WWAN-OUT default ceiling '40mbit'
set traffic-policy shaper WWAN-OUT default priority 7

set interfaces wwan wwan0 traffic-policy out WWAN-OUT
```

## Security

### WWAN Security Recommendations

1. **Always use a firewall** on the WWAN interface
2. **Disable unnecessary services** on the WAN interface
3. **Use a VPN** to encrypt traffic
4. **Monitor for suspicious activity**
5. **Regularly update the modem firmware**
6. **Use strong passwords** for VyOS
7. **Restrict access to management** from the WWAN interface

### Disabling Management from WWAN

```bash
set firewall ipv4 name WWAN-LOCAL rule 100 action drop
set firewall ipv4 name WWAN-LOCAL rule 100 destination port 22,80,443
set firewall ipv4 name WWAN-LOCAL rule 100 protocol tcp
set firewall ipv4 name WWAN-LOCAL rule 100 description 'Block management from WWAN'
```

## Integration with Cloud Services

### Yandex Cloud

WWAN interfaces can be used in Yandex Cloud for backup communication channels between the cloud and on-premise infrastructure.

```bash
# Configuration for a VPN tunnel to Yandex Cloud
set interfaces wwan wwan0 apn 'internet.mts.ru'
set interfaces wwan wwan0 address dhcp

# WireGuard VPN to Yandex Cloud
set interfaces wireguard wg0 address '10.128.0.2/24'
set interfaces wireguard wg0 peer YC address '<yandex-cloud-public-ip>'
set interfaces wireguard wg0 peer YC allowed-ips '10.128.0.0/24'
set interfaces wireguard wg0 peer YC port 51820
set interfaces wireguard wg0 peer YC public-key '<cloud-public-key>'

# Routing to the cloud over the VPN
set protocols static route 10.128.0.0/16 interface wg0
```

## Automation Scripts

### Automatic SIM Card Switching

A script to switch between SIM cards when connection problems occur:

```bash
#!/bin/vbash
# /config/scripts/sim-switch.sh

source /opt/vyatta/etc/functions/script-template

# Connection check
if ! ping -I wwan0 -c 3 8.8.8.8 > /dev/null 2>&1; then
    logger "WWAN: Primary SIM failed, switching to secondary"

    # SIM switching (command depends on the modem)
    sudo qmicli -d /dev/cdc-wdm0 --uim-switch-slot=2

    sleep 10

    # Restarting the interface
    ip link set wwan0 down
    sleep 5
    ip link set wwan0 up

    logger "WWAN: Switched to secondary SIM"
fi
```

### Monitoring Traffic Limits

```bash
#!/bin/vbash
# /config/scripts/data-limit-monitor.sh

source /opt/vyatta/etc/functions/script-template

LIMIT=10737418240  # 10 GB in bytes
CURRENT=$(cat /sys/class/net/wwan0/statistics/rx_bytes)
TX=$(cat /sys/class/net/wwan0/statistics/tx_bytes)
TOTAL=$((CURRENT + TX))

if [ $TOTAL -gt $LIMIT ]; then
    logger "WWAN: Data limit exceeded ($TOTAL bytes), shutting down interface"
    configure
    set interfaces wwan wwan0 disable
    commit
    exit
fi
```

## Additional Resources

### Official Documentation

- [VyOS Documentation - WWAN](https://docs.vyos.io/en/latest/configuration/interfaces/wwan.html)
- [ModemManager Documentation](https://www.freedesktop.org/wiki/Software/ModemManager/)
- [QMI Protocol Documentation](https://osmocom.org/projects/quectel-modems/wiki/QMI)

### Useful Linux Commands for Debugging

```bash
# ModemManager
mmcli -L                          # List of modems
mmcli -m 0                        # Modem information
mmcli -m 0 --simple-status        # Simple status

# USB device information
lsusb -t                          # USB device tree
lsusb -v -d <vendor>:<product>    # Detailed information

# Checking drivers
dmesg | grep -i usb
dmesg | grep -i qmi
dmesg | grep -i cdc
```

### Speed Testing

```bash
# Installing speedtest-cli
sudo apt install speedtest-cli

# Speed test through the WWAN interface
speedtest-cli --source wwan0

# iPerf testing
iperf3 -c <server> -B <wwan0-ip>
```

## Conclusion

WWAN interfaces in VyOS provide flexible capabilities for building reliable network solutions using cellular networks. Proper configuration, monitoring, and maintenance ensure stable operation both as a primary and as a backup communication channel.

Key advantages of using WWAN in VyOS:

- Fast deployment without the need for wired links
- High reliability with support for automatic failover
- Flexible integration with existing network infrastructure
- The ability to use many Russian and international operators
- Full integration with firewall, VPN, NAT, and other VyOS features

When planning to use WWAN, consider:

- Coverage and signal quality at the installation site
- Operators' pricing plans and traffic limits
- Speed and latency requirements for your applications
- The need for redundancy and failover mechanisms
- Data security and encryption considerations