One line, from the company's install page.
Run in the router's shell. It fetches the signed binary, verifies the checksum, installs the service and connects. Run it again any time; it never overwrites the machine's identity.
wget -O - https://hub.[yourdomain]/install/inst_…/openwrt.sh | sh
Outbound 443 to the hub only. No inbound rule, no VPN, no SNMP community.
what the agent watches on Teltonika · OpenWrtCellularRSSI, RSRP, RSRQ, SINR, operator, network type, SIM state, bands, temperature and byte counters, from the router's own API.procd servicesEnabled services that are not running, restart proposed and approved.Loglogread on demand, capped.ReachabilityPing the carrier gateway, the VPN peer, head office.Survives sysupgradePaths are added to the upgrade keep-list; the service comes back on its own.Not for 16 MB flashRUT2xx and RUT9xx do not have room for the 6 MB binary; RUTX and larger do.