Private APN for IoT: What It Is, How It Works and When You Need One
Private APN, private IP, fixed IP and VPN are often bundled together in sales conversations as if they are the same thing. They are not. This guide follows the data from the SIM to your network and explains what a private APN really changes.
A private APN gives an IoT SIM a controlled route into a private network rather than treating it as an ordinary internet connection. It is useful when devices need predictable addressing, controlled inbound access, isolation from the public internet, or direct connectivity back to a company network or cloud environment. It does not automatically mean encrypted, fixed IP or completely isolated. Those are separate parts of the design.
That little APN box in the router matters more than it looks
Anyone who has configured a 4G or 5G router has seen the APN field. It is usually one of those settings you type in once and forget about. On a consumer SIM it might simply be internet. On an IoT SIM it may be a provider-specific name.
The APN, or Access Point Name, tells the mobile network which data service the SIM is trying to use and how that session should be handled. The GSMA describes an APN as the gateway between an LTE network and another network. That other network might be the public internet, but it does not have to be.
That is where the private APN comes in.
Instead of sending the SIM out through the normal public internet path, the provider can place it into a private address space and route its traffic towards infrastructure that you control.
Why this gets confusing so quickly
The problem is not really the technology. It is the language around it. Ask five people for a “fixed IP SIM” and you may get five slightly different answers.
A fixed IP only tells you that the address does not change. It does not tell you whether that address is public or private. A private IP tells you that the address is not publicly routable. It does not tell you how you are going to reach it. A VPN tells you something about the route or tunnel between networks, but it does not mean the SIM itself is using a private APN.
| Term | What it actually tells you | What it does not tell you |
|---|---|---|
| Private APN | The SIM uses a controlled private data service and routing policy. | Whether the IP is static, whether traffic is encrypted, or whether SIMs can talk to each other. |
| Private IP | The SIM has an address from private address space. | How somebody outside that private network can reach it. |
| Fixed / static IP | The SIM keeps the same IP address. | Whether that address is public or private. |
| Public IP | The address is routable over the public internet. | Whether the device is safe to expose. |
| VPN | There is a defined tunnel or private route between endpoints or networks. | That the mobile service itself uses a private APN. |
This is why the useful question is rarely “Do I need a fixed IP SIM?” The better question is: what needs to talk to what, who needs to initiate the connection, and where should that traffic be allowed to travel?
For the addressing side of this, our Private vs Public IP for Cellular IoT guide goes into more detail. We also have a separate Fixed IP SIM explainer.
What happens on a normal IoT SIM?
For a huge number of IoT applications, nothing special is required. The router or device gets an IP address, usually a private one, and starts an outbound connection to a cloud service. MQTT telemetry, HTTPS APIs, software updates and remote management platforms can all work perfectly well like this.
The important bit is direction. The device starts the conversation. If the device sits behind carrier-grade NAT, somebody on the internet cannot simply open a browser and connect back to it.
For a temperature sensor reporting every ten minutes, that is probably exactly what you want. There is no prize for adding a private APN to a simple outbound-only application.
When a private APN starts to make sense
Now change the application. Instead of a temperature sensor, imagine 250 remote cabinets. Each contains a router, a PLC and an energy meter. The control centre needs to poll the PLCs. Engineers occasionally need to reach the router web interface. A central monitoring server needs predictable routes to the sites.
You could put every router on a public fixed IP. It works, and it is still used. But you have now made 250 field devices directly addressable from the internet, so firewalling, patching, access control and monitoring become critical.
A private APN gives you another option. The SIMs can sit on private addresses, and the control centre reaches those addresses through a VPN or private interconnect into the provider network.
Example: a fleet of remote pumping stations
Each station has a cellular router connected to a PLC. The SIM receives a fixed private address. The operator’s SCADA network has a private connection into the connectivity provider. SCADA can poll each site by its known private address, but the router is not sitting openly on the public internet.
That is the sort of job private APNs are good at. It is not about making the SIM more exotic. It is about creating a network that behaves more like a managed WAN.
Private APN does not automatically mean fixed IP
This is worth separating because the two are commonly sold together.
A provider can run a private APN and still assign addresses dynamically. That is fine if every device starts its own outbound sessions and nobody needs to connect back to a known address.
If a SCADA server, engineer or application needs to initiate a connection towards a particular SIM, fixed private IP addressing becomes much more useful. The combination of private APN, fixed private IP and a controlled route back to the customer is common in industrial IoT because it is easy to understand and easy to support.
Can devices on the private APN talk to each other?
Do not assume they can.
Some private APNs allow traffic between SIMs. Others deliberately block it. That can be a good security decision because a compromised device at one site cannot immediately start probing every other device in the estate.
There are applications where SIM-to-SIM communication is genuinely needed, but it should be a deliberate requirement rather than something discovered during commissioning.
Is SIM-to-SIM traffic allowed, blocked or configurable? It sounds like a small detail until an application depends on it.
Does a private APN still have internet access?
It can. Private APN does not necessarily mean “no internet”.
Wireless Logic, for example, states in its current service documentation that internet access can still be available through a private APN unless otherwise agreed. Other providers may offer private-only routing, restricted internet breakout, customer-side breakout, or a mixture of these.
This matters because an industrial router may need private inbound management while also reaching public services for DNS, NTP, firmware updates, maps, APIs or a cloud platform.
So ask where internet traffic breaks out, not simply whether the APN is private.
Is a private APN encrypted?
Not necessarily, and this is one of the easiest assumptions to get wrong.
A private APN can keep traffic away from ordinary public internet routing and restrict which devices or networks can reach each other. That is useful. But privacy of routing and encryption of data are different things.
The GSMA recommends private APNs as one way to restrict which authenticated endpoints can reach IoT service infrastructure. Where traffic crosses less trusted networks, VPN technologies such as IPsec are commonly used alongside the APN.
Treat the private APN as part of your network design, not as the whole security design. Device hardening, firewall rules, authentication, access control, patching and encryption where required still matter.
Private APN or VPN in the router?
There is another perfectly valid way to solve remote access. Instead of asking the mobile provider for a private APN, the router can establish its own outbound VPN tunnel over a standard SIM.
A Teltonika, Robustel, Milesight or similar industrial router can run WireGuard, IPsec or OpenVPN back to a central server or management platform. Because the router starts the tunnel, CGNAT is not necessarily a problem.
| Private APN model | Router VPN model | |
|---|---|---|
| Where the private network is built | In the connectivity provider’s mobile core and routing environment. | As an overlay from the router to your VPN endpoint. |
| Addressing | Often centrally managed private addressing, sometimes fixed. | VPN addressing is controlled by your VPN design. |
| Device configuration | Can be simple at the router once the service is provisioned. | Each router needs the VPN configuration or central provisioning. |
| Provider dependency | Higher, because the private network is part of the connectivity service. | Lower, because the tunnel can often work across different SIM providers. |
| Good fit | Large managed estates, SCADA, enterprise WAN, regulated or tightly controlled deployments. | Smaller fleets, mixed connectivity, sites where the router already handles secure remote access. |
Neither approach wins automatically. A private APN can be wonderfully clean at scale. A router-built VPN can be more portable and avoids tying too much of the network architecture to one SIM provider. In some deployments you will use both.
What about public fixed IP SIMs?
They still have a place. Sometimes the requirement really is to reach a device directly from anywhere on the internet. CCTV and legacy remote-access applications are common examples.
The trade-off is exposure. A public IP is reachable, which means it can also be scanned and attacked. If you choose that model, firewall rules should be restrictive and management services should not simply be left open because “nobody knows the IP address”. Internet scanners do not need to know it in advance.
Our Public IP SIM guide covers this in more depth.
The roaming question
Private APNs are particularly useful in multi-network and roaming IoT because the device can retain the same service model even when the visited radio network changes. The local mobile network provides the radio access, while the IoT connectivity provider still controls the APN, addressing and onward routing.
That can make a geographically scattered deployment much easier to operate. The device may attach to different partner networks in different places, but the application still sees a consistent private connectivity architecture.
This is one reason private APNs have become such a familiar part of managed IoT connectivity rather than something limited to traditional corporate mobile data.
The 5G version is called a DNN
There is one modern terminology wrinkle worth knowing. In 5G core networks the equivalent concept is the Data Network Name, or DNN. The GSMA describes the DNN as the 5G counterpart of the APN, identifying the data network for a network slice.
In the real world you will still hear “APN” constantly, particularly because many IoT estates span LTE and 5G and because APN is deeply embedded in router configuration and commercial language. But if a 5G standalone document suddenly starts talking about a DNN, it has not invented a completely different problem.
What should you ask a connectivity provider?
The easiest way to avoid buying the wrong service is to describe the application first and the product name second.
- Are the SIM IP addresses public or private?
- Are they fixed or dynamically assigned?
- How do our engineers or servers reach the SIM estate?
- Is the customer connection IPsec, OpenVPN, private circuit, cloud interconnect or something else?
- Can SIMs communicate with each other?
- Does the APN allow internet breakout?
- If it does, where does that breakout happen?
- Can destinations, ports or protocols be restricted?
- How does the design work when the SIM is roaming?
- What happens if we later change connectivity provider?
That last question is easy to forget. A private APN can solve an operational problem very neatly, but it also becomes part of your network architecture. The more addressing, routing and access control you build around one provider, the more work there may be in moving later.
Do you actually need one?
| Application | Likely approach |
|---|---|
| Sensor sends MQTT telemetry to a cloud platform | Standard outbound IoT data is often enough. |
| Engineer needs secure access to a handful of routers | Router VPN or a secure remote-management platform may be simpler. |
| SCADA head-end polls hundreds of field sites | Private APN with fixed private IPs and a controlled route is a strong fit. |
| CCTV device must be directly reachable from arbitrary internet locations | Public fixed IP may still be appropriate, with strict firewalling. |
| Large multi-country device fleet needs consistent private addressing | Managed private APN / private mobile network architecture is worth considering. |
| Device only needs outbound HTTPS | Do not add complexity without a reason. |
Private APN is not a badge of quality. It is a networking tool. If it solves a routing, security or management requirement, it can be exactly the right tool. If it does not, you are simply paying for another layer to manage.
- What it is
- A controlled mobile data service that routes SIM traffic into a private network context.
- Common pairing
- Fixed private IP addresses plus a VPN or private interconnect.
- Public internet required?
- No, although some private APN services can also provide internet breakout.
- Encrypted by default?
- Do not assume so. Confirm the end-to-end security design.
- Best suited to
- Managed fleets, SCADA, industrial remote access and enterprise IoT networks.
- Always necessary?
- No. Outbound-only IoT often works perfectly well without one.
Frequently asked questions
What does APN stand for?
APN stands for Access Point Name. It identifies the mobile data service and helps determine how a device’s data session is routed.
Is a private APN the same as a private IP?
No. A private APN is part of the mobile network and routing design. A private IP is simply an address that is not publicly routable. Private APN services often use private IP addressing, but the terms describe different things.
Does a private APN give me a fixed IP?
Not automatically. The provider can assign static or dynamic addresses on a private APN. If you need a central system to initiate connections to specific devices, fixed private addressing is usually easier to operate.
Can I remotely access a router on a private APN?
Yes, if your network has an authorised route into the private APN and the device firewall allows the traffic. The usual route is through a VPN, private interconnect or provider remote-access service.
Is a private APN more secure than a public IP SIM?
It can reduce internet exposure because the device does not need to be directly reachable from the public internet. That is useful, but it does not remove the need for proper authentication, firewalling, patching and encryption where required.
Can a private APN still access the internet?
Yes, depending on how the service is configured. Some private APNs include controlled internet breakout, while others are private-only. Confirm this with the provider rather than assuming either way.
Do I need a private APN for MQTT?
Usually not simply because you use MQTT. If the device initiates an outbound MQTT connection to a broker, standard IoT connectivity can be enough. A private APN becomes relevant when you need private routing, controlled inbound access or a wider enterprise network design.
Related reading
Sources and further reading: GSMA IoT Security Guidelines and current GSMA 5G terminology; Wireless Logic APN glossary and private APN service documentation; EMnify documentation on private cellular networking and OpenVPN. IoTPortal has used these sources to check terminology and architecture, while the explanations and deployment examples above are our own.
