# APN and private access

An access point name (APN) is the string a device sends to select the gateway its data session uses. A public APN exits to the internet through the operator's gateway; a private APN exits to a network the customer controls. The APN chooses the path, not the security level.

- The APN selects the gateway and, with it, the address pool and policy for a data session.

- A device can attach to the network and still carry no data if the APN is wrong or the session is rejected.

- A private APN keeps traffic off the public internet from the gateway inward; it is not encryption by itself.

- An IPsec tunnel over a public APN encrypts traffic but still uses the operator's public gateway.

## The APN selects the data exit

An access point name is a short string, usually a domain-like name, that the device sends when it asks for a data session. The network resolves it to a gateway and a set of policies: which address pool to use, which services are allowed and where the traffic leaves. The APN is the choice of exit.
A public APN exits to the internet through the operator's gateway. It is the default on most consumer and IoT subscriptions. Many devices use the same exit, but each session still gets its own address and policy. Sharing an exit is not the same as sharing a subscription.
The APN does not authenticate the user and does not encrypt traffic. Authentication belongs to the subscription and the core; encryption belongs to the application or a tunnel above the IP layer. Treat the APN as a routing instruction, not as a security control.

### Device, core, APN, gateway, internet

The device reaches the radio, the core selects the gateway named by the APN, and the gateway exits to the internet or to a private network. The APN names the exit; it is not a security level.

Alt: A path from device to radio access to mobile core to APN to gateway to the public internet, with the APN marked as the selected exit.

The device attaches through the radio access network. The core authenticates the subscription and reads the APN from the session request. The APN selects a gateway and its policy, and the gateway assigns an address and forwards the traffic. A public APN exits to the internet; a private APN exits to a network the customer controls.

| Item | Value | Note |
| --- | --- | --- |
| First state · 1 | Device |  |
| First state · 2 | Radio access (RAN) |  |
| First state · 3 | Mobile core |  |
| First state · 4 | APN |  |
| First state · 5 | Gateway |  |
| First state · 6 | Public internet |  |

Source: 3GPP TS 23.401 and TS 23.060: the APN selects a PDN gateway (https://www.3gpp.org/ftp/Specs/archive/23_series/23.401/)

## What a private APN changes

A private APN exits to a network the customer controls, usually through a dedicated gateway and a connection back to the enterprise. The operator still carries the radio and the core. The enterprise sees the traffic at its own edge and can apply its own addressing, allowlists and inspection.
What the private APN buys is separation from the public internet from the gateway inward. It does not encrypt the radio path, and it does not prove who sent a packet. Those are separate controls. A private APN can also add operational work: a second gateway, a routing agreement, a pool of addresses and a plan for what happens when the link fails.
A private APN is common for payment terminals, vehicles, remote equipment and industrial gateways. The reason is usually a fixed address, a private address range or a policy that must not depend on the public internet. Ask for the address plan and the failover path before you order.

### Public APN and private APN

The toggle shows a public APN exiting to the internet and a private APN exiting to a private network. The radio and the core are the same in both states.

Alt: Two path diagrams. Public APN: device, core, gateway, public internet. Private APN: device, core, gateway, private network.

In the public state, the device uses the operator's gateway and reaches the internet. In the private state, the same device and core reach a gateway that connects to a private network. The subscription and the radio do not change; the exit does. An IPsec tunnel over the public state would encrypt the traffic but would still use the public gateway.

| Item | Value | Note |
| --- | --- | --- |
| Public APN · 1 | Device |  |
| Public APN · 2 | Mobile core |  |
| Public APN · 3 | Gateway |  |
| Public APN · 4 | Public internet |  |
| Private APN · 1 | Device |  |
| Private APN · 2 | Mobile core |  |
| Private APN · 3 | Gateway |  |
| Private APN · 4 | Private network |  |

Source: 3GPP TS 23.401: PDN connection and gateway selection (https://www.3gpp.org/ftp/Specs/archive/23_series/23.401/)

## When an encrypted tunnel fits

An IPsec tunnel over a public APN is a third option. The device still uses the operator's public gateway, but it builds an encrypted tunnel to the enterprise edge before it sends application traffic. The tunnel protects confidentiality and integrity across the public path; it does not change the gateway the operator selected.
Choose the tunnel when the requirement is confidentiality over a shared path and the device has the CPU headroom and throughput for the tunnel's overhead. Choose the private APN when the requirement is a private address, a controlled exit or a policy that must sit in the operator's core. Many deployments use both.
The tunnel has its own failure mode. If the tunnel endpoint is unreachable, the device may attach and still carry nothing. Test the tunnel and the APN separately, so the first failure does not hide the second.

## The device attaches but cannot reach the server

Start with the APN string. A typo or a trailing space is enough to select the wrong gateway or no gateway. APN names follow the DNS name syntax (3GPP TS 23.003 §9.1), so case alone should not change the gateway; a device or modem that mishandles case can still fail. Compare the value in the device with the value in the order, character by character.
Then check the credentials and the IP type. A session that needs a username and password fails if the device sends none. An APN that offers IPv4 only will not complete an IPv6-only request. Then check that data service is enabled on the subscription, and whether the device sets the APN automatically or uses a manual profile that is now stale.
If the device attaches and gets an address but cannot reach the server, the APN is probably right and the route is wrong. Check the address pool, the return route and the policy on the gateway. A private APN that works from one site and fails from another is usually a routing or firewall question, not a radio question. The [roaming explainer](/en/resources/learn/home-routing-vs-local-breakout/) shows why the exit point changes the path.

A generic example. Replace it with the value from your own SIM provider.

[Open the tool](/en/tools/apn-gen/?src=learn-what-is-an-apn&scenario=private-apn&apn=apn.example&auth=none)

### Check your understanding

**The device attaches but cannot reach the server: what do you check first?**

The APN string and the session state. Confirm the device selected the intended APN, then check the address, the credentials and the IP type before you test the radio.

**What does a private APN provide, and what does it not?**

It keeps traffic off the public internet from the gateway inward and can give a private address and a controlled exit. It does not encrypt the path or prove who sent a packet.

**When is an encrypted tunnel over a public APN the better fit?**

When confidentiality over a shared path is the main requirement and the device can carry the tunnel. A private APN fits better when you need a private address or a policy in the operator's core.

## FAQ

**Is an APN a security control?**

No. It selects the gateway and the policy attached to it. Encryption and authentication are separate.

**Can a private APN work while roaming?**

It depends on the roaming agreement and the visited network. Ask whether the private gateway is reachable from the visited core, and test it.

**Do I need one APN per customer?**

Not always. One APN can serve many customers if the addressing and policy allow it. A separate APN is an operational choice, not a requirement.

## Sources

- [3GPP TS 23.401: GPRS enhancements for E-UTRAN access](https://www.3gpp.org/ftp/Specs/archive/23_series/23.401/) — Accessed: 2026-10-19
- [3GPP TS 23.060: General Packet Radio Service description](https://www.3gpp.org/ftp/Specs/archive/23_series/23.060/) — Accessed: 2026-10-19
- [3GPP TS 23.003 §9.1: APN structure and the DNS name syntax](https://www.3gpp.org/ftp/Specs/archive/23_series/23.003/) — Accessed: 2026-10-19
- [3GPP TS 27.007: AT command set for user equipment](https://www.3gpp.org/ftp/Specs/archive/27_series/27.007/) — Accessed: 2026-10-19
- [APN, AT command and nmcli configuration generator: method note](https://unicomam.com/en/tools/apn-gen/) — Accessed: 2026-10-19

Updated: 2026-10-19