MAVLink over VPN: operate a drone through 4G, 5G or satellite

Why 4G/5G is appealing: flying beyond radio range

A classic radio controller establishes a point-to-point link between the transmitter and the drone. It is responsive and independent of any infrastructure, but its range is bounded by the permitted transmission power and by line of sight: terrain, a building or simply distance always end up cutting the link. For linear-asset inspection, wide-area surveillance or delivery, that limit becomes the sizing factor of the whole mission.

Going through the cellular network changes the nature of the link: the range is no longer that of an onboard transmitter, but that of the operator’s coverage. The drone carries a 4G/5G modem, the ground station uses its own Internet connection, and the two talk across the public network — at ten kilometres as at a hundred. In exchange, the drone becomes an Internet-connected machine like any other, with every network problem that entails.

Why it is hard: two CGNATs face to face

The first instinct — “the drone has an Internet connection, I will just connect to it” — almost always fails. On a mobile access, the public IP address is shared among many subscribers by the operator’s CGNAT (Carrier-Grade NAT): no inbound connection ever reaches the SIM card, and there is no port to open, because the NAT belongs to the operator, not to you. Hosting a server on board the drone is simply impossible.

A classic star-shaped VPN only half helps: you must host and expose a concentrator on the Internet, all traffic detours through it, and the tunnel’s own session generally does not survive an address change — a cell handover is still an outage. The problem calls for an approach where neither end needs to be reachable and where the session does not depend on addresses.

What the mesh brings: a stable link despite CGNAT

VIGIL-MESH does not require any machine to be reachable. The node embedded on the drone and the ground station each establish a single outbound connection on 443 UDP — which every CGNAT lets through, since it is the behaviour of an ordinary web client. A blind relay (the vigie) puts the two in touch immediately; in parallel, NAT traversal looks for a direct path, and the session migrates to it without interruption if one is found. In every case, the link is a QUIC/TLS 1.3 session encrypted end to end between the drone and the station.

• Stable addresses despite CGNAT — the drone keeps the same address on the mesh (100.64.0.0/10 range) and the same MagicDNS name, whatever the cell, the operator or the public address of the moment. The ground station always aims at the same target.
• A session that survives network changes — the session is not bound to a pair of IP addresses: when the link changes cell or network, it migrates without a new handshake. Telemetry and video carry on instead of reconnecting.
• Real-time UDP inside the tunnel — datagrams (telemetry, commands, UDP video streams) traverse end to end with strict priority over service streams: a background transfer does not delay a telemetry frame that is ready to go.
• Encryption that does not depend on the path — relayed or direct, traffic stays encrypted end to end, with a hybrid post-quantum X25519 + ML-KEM key exchange. Neither the mobile operator nor the relay sees the content.

Typical architecture of a drone link

The most common architecture rests on an embedded companion computer: a small Linux machine — often an NVIDIA Jetson when there is onboard vision — wired to the autopilot on one side and to the 4G/5G modem on the other. It is the one that joins the mesh, like any other machine on the network.

This separation of roles is enforced by the access policy, not by the goodwill of the software: by default, nobody reaches anybody, and each flow — who commands, who watches — is explicitly allowed in the console. Revoking a supervisor removes their access immediately, without touching the drone.

MAVLink over VPN: telemetry, commands, missions and video

MAVLink is a lightweight message protocol between vehicles, ground stations and onboard components. It carries GPS, battery and attitude state as well as parameters, missions, commands, camera and gimbal operations. A MAVLink router commonly bridges the autopilot’s serial link to a UDP endpoint on the Linux companion.

ROS 2 and DDS have a dedicated guide. DroneCAN, CAN, SBUS, CRSF/ExpressLRS and motor-control loops normally stay onboard. Carry high-level telemetry and commands over the WAN, not hard real-time control that must survive locally.

4G/5G, Starlink and COMSAT: match the link to the workload

MAVLink HIGH_LATENCY2 exists for slow or expensive satellite channels: it condenses essential vehicle state at low rate. Such a link can support tracking, health and supervised missions without becoming suitable for reactive manual control or real-time video.

What Ukraine demonstrates about connected drones

The war in Ukraine has made two general facts visible: drones are nodes in larger information systems, supporting reconnaissance, mapping, relays, rescue and logistics; and every radio or satellite link can be jammed, degraded, geofenced or lost. That does not make a civilian VPN a military solution. It shows why the vehicle must tolerate network loss and avoid one point of failure.

• Keep failsafes, return-to-home and flight boundaries onboard.
• Give commands, video and telemetry separate priorities and bandwidth budgets.
• Multiple carriers reduce one dependency but never guarantee availability.
• Use ACLs to separate pilot, observer, maintenance and automation roles.
• Test on the ground and in authorized environments with logs, loss thresholds and fallback procedures.

Technical and regulatory sources

• Official MAVLink guide and microservices
• MAVLink routing between systems, components and transports
• MAVLink 2 message signing
• PX4 companion computers, LTE and NAT constraints
• ArduPilot companion-computer architecture
• MAVLink HIGH_LATENCY2 for satellite links
• EASA on BVLOS operations and the specific category

The limits, stated honestly

A mesh solves the addressing, session-continuity and encryption problems. It does not solve everything, and it would be dishonest to suggest otherwise.

• Cellular coverage is still cellular coverage — in a coverage gap, no software moves packets. Mobile networks are also designed for use on the ground; link quality at altitude varies from site to site and has to be verified in the field.
• 4G/5G latency is 4G/5G latency — it varies with cell load and radio conditions. On a direct path, VIGIL-MESH adds only an encryption layer to the journey: it does not worsen the network’s latency, but it cannot improve it either.
• Double symmetric CGNAT means the relay stays — the link works, encrypted end to end, but over a longer path. A self-hosted private vigie at least lets you choose where that path runs.
• A data link, not a certified control link — VIGIL-MESH carries telemetry, commands and video over IP; it does not replace backup links or the autopilot’s safety mechanisms (failsafe, return to home), which must remain operational whatever happens to the network.

Setting up the link, step by step

1. 1
   Create your workspaceAn account is enough to get started — personal use is free, with unlimited direct traffic.
2. 2
   Install the client on the machinesOn the embedded companion (Linux or Jetson), on the ground station and on the supervisors’ machines.
3. 3
   Enroll each machineIn the console, Networks → Machines → “Add a machine”: a single-use key enrolls the companion like any other node.
4. 4
   Verify the linkWith the drone on the ground and connected over 4G, check its stable address, its MagicDNS name and a ping from the ground station.
5. 5
   Point your software at the drone's nameGround station and supervision tools target the embedded machine’s address or name, as if local — then the ACLs restrict who commands and who observes.

Frequently asked questions