IP Passthrough & Bridge Mode

Connect your Quectel modem to enterprise firewalls (pfSense, OPNsense, Ubiquiti UniFi, MikroTik) while avoiding double-NAT issues.

What is IP Passthrough?#

In standard mode, the modem acts as a router/NAT gateway. In IP Passthrough (Bridge Mode):

• The modem assigns the actual cellular WAN IP address directly to your downstream router's WAN port via DHCP.
• The modem transparently forwards all inbound and outbound packets without NAT address translation.
• QManager's web management interface remains accessible via a virtual management IP.

The 3-Tier IPPT Architecture (DMZ vs QMAP MPDN)#

Upstream research by Cameron Thompson (Cellular Modem Wiki) categorized cellular passthrough implementations into three functional tiers:

1. Pseudo-Bridge (DMZ Host)#

The modem retains full NAT ownership, but automatically forwards all unsolicited inbound TCP/UDP ports to the downstream router's static LAN IP. While simple, double NAT still exists, which can disrupt VPNs, VoIP, and gaming protocols.

2. Full QMAP MPDN Hardware Passthrough#

The modem baseband bypasses internal NAT entirely, bridging the public cellular WAN lease directly to the Ethernet PHY:

AT+QMAP="MPDN_rule",0,1,0,1,1,"<MAC_ADDRESS>"

• 0: Profile rule ID.
• 1: Context ID (PDP 1).
• 0: VLAN tagging (0 = disabled).
• 1: IP Passthrough mode enabled (1 = enabled, 0 = NAT).
• 1: Target hardware interface (1 = eth0 / RGMII).
• <MAC_ADDRESS>: Physical MAC address of downstream router WAN interface.

3. Full Bridge with DNS Proxy Bypass#

By default, the modem's internal DHCP daemon forces its own IP address as the DNS server for connected clients. To disable this interception and forward genuine upstream carrier DNS or custom DNS servers directly:

AT+QMAP="DHCPV4DNS","disable"

How IP Passthrough Works#

QManager binds the cellular rmnet_data0 interface to the Ethernet PHY using ARP-proxying or raw IP bridging. The downstream router receives the carrier lease directly.

DNS Proxy Bypass & Carrier DNS Pass-Through#

When IP Passthrough is enabled without disabling DNS proxying, DNS queries from your downstream router still hit the modem's internal resolver, increasing latency and potentially leaking queries.

QManager's IPPT toggle automatically executes:

AT+QMAP="DHCPV4DNS","disable"

This ensures the downstream enterprise firewall receives the upstream cellular DNS server addresses (or your configured custom DNS resolvers) directly in its DHCP ACK option 6.

RM551E Target MAC Requirement Quirk#

Enabling IP Passthrough in QManager#

1. Navigate to Network > IP Passthrough.
2. Toggle Enable IP Passthrough to ON.
3. Select or enter your Target Client MAC Address (the MAC address of your firewall's WAN port).
4. Specify a Fallback Management IP (e.g., 192.168.224.1 on RM551E or 192.168.225.1 on RM520N) so you can still reach QManager.
5. Click Save & Apply.

Screens in QManager#