APN and private access
An access point name chooses the data exit. Here is what a public APN, a private APN and an IPsec tunnel over a public APN each change.
An access point name (APN) is the string a device sends to select the gateway its data session uses. A public APN exits to the internet through the operator's gateway; a private APN exits to a network the customer controls. The APN chooses the path, not the security level.
Key facts
- The APN selects the gateway and, with it, the address pool and policy for a data session.
- A device can attach to the network and still carry no data if the APN is wrong or the session is rejected.
- A private APN keeps traffic off the public internet from the gateway inward; it is not encryption by itself.
- An IPsec tunnel over a public APN encrypts traffic but still uses the operator's public gateway.
After this module you can
- Explain what an APN selects and what it does not.
- Choose between a public APN, a private APN and an IPsec tunnel over a public APN.
- Diagnose a device that attaches but cannot reach the server.
On this page
The APN selects the data exit
An access point name is a short string, usually a domain-like name, that the device sends when it asks for a data session. The network resolves it to a gateway and a set of policies: which address pool to use, which services are allowed and where the traffic leaves. The APN is the choice of exit.
A public APN exits to the internet through the operator's gateway. It is the default on most consumer and IoT subscriptions. Many devices use the same exit, but each session still gets its own address and policy. Sharing an exit is not the same as sharing a subscription.
The APN does not authenticate the user and does not encrypt traffic. Authentication belongs to the subscription and the core; encryption belongs to the application or a tunnel above the IP layer. Treat the APN as a routing instruction, not as a security control.
Device, core, APN, gateway, internet
- Device
- Radio access (RAN)
- Mobile core
- APN
- Gateway
- Public internet
Text description
The device attaches through the radio access network. The core authenticates the subscription and reads the APN from the session request. The APN selects a gateway and its policy, and the gateway assigns an address and forwards the traffic. A public APN exits to the internet; a private APN exits to a network the customer controls.
What a private APN changes
A private APN exits to a network the customer controls, usually through a dedicated gateway and a connection back to the enterprise. The operator still carries the radio and the core. The enterprise sees the traffic at its own edge and can apply its own addressing, allowlists and inspection.
What the private APN buys is separation from the public internet from the gateway inward. It does not encrypt the radio path, and it does not prove who sent a packet. Those are separate controls. A private APN can also add operational work: a second gateway, a routing agreement, a pool of addresses and a plan for what happens when the link fails.
A private APN is common for payment terminals, vehicles, remote equipment and industrial gateways. The reason is usually a fixed address, a private address range or a policy that must not depend on the public internet. Ask for the address plan and the failover path before you order.
Public APN and private APN
Public APN
- Device
- Mobile core
- Gateway
- Public internet
- Device
- Mobile core
- Gateway
- Private network
Text description
In the public state, the device uses the operator's gateway and reaches the internet. In the private state, the same device and core reach a gateway that connects to a private network. The subscription and the radio do not change; the exit does. An IPsec tunnel over the public state would encrypt the traffic but would still use the public gateway.
When an encrypted tunnel fits
An IPsec tunnel over a public APN is a third option. The device still uses the operator's public gateway, but it builds an encrypted tunnel to the enterprise edge before it sends application traffic. The tunnel protects confidentiality and integrity across the public path; it does not change the gateway the operator selected.
Choose the tunnel when the requirement is confidentiality over a shared path and the device has the CPU headroom and throughput for the tunnel's overhead. Choose the private APN when the requirement is a private address, a controlled exit or a policy that must sit in the operator's core. Many deployments use both.
The tunnel has its own failure mode. If the tunnel endpoint is unreachable, the device may attach and still carry nothing. Test the tunnel and the APN separately, so the first failure does not hide the second.
The device attaches but cannot reach the server
Start with the APN string. A typo or a trailing space is enough to select the wrong gateway or no gateway. APN names follow the DNS name syntax (3GPP TS 23.003 §9.1), so case alone should not change the gateway; a device or modem that mishandles case can still fail. Compare the value in the device with the value in the order, character by character.
Then check the credentials and the IP type. A session that needs a username and password fails if the device sends none. An APN that offers IPv4 only will not complete an IPv6-only request. Then check that data service is enabled on the subscription, and whether the device sets the APN automatically or uses a manual profile that is now stale.
If the device attaches and gets an address but cannot reach the server, the APN is probably right and the route is wrong. Check the address pool, the return route and the policy on the gateway. A private APN that works from one site and fails from another is usually a routing or firewall question, not a radio question. The roaming explainer shows why the exit point changes the path.
Check your understanding
-
The device attaches but cannot reach the server: what do you check first?
The APN string and the session state. Confirm the device selected the intended APN, then check the address, the credentials and the IP type before you test the radio.
-
What does a private APN provide, and what does it not?
It keeps traffic off the public internet from the gateway inward and can give a private address and a controlled exit. It does not encrypt the path or prove who sent a packet.
-
When is an encrypted tunnel over a public APN the better fit?
When confidentiality over a shared path is the main requirement and the device can carry the tunnel. A private APN fits better when you need a private address or a policy in the operator's core.
Answers are revealed on request. Nothing is scored, stored or sent.
FAQ
Is an APN a security control?
Can a private APN work while roaming?
Do I need one APN per customer?
Terms you'll meet
Related
- Permanent roaming, country by country
How long a foreign SIM may roam before it needs a local profile, for Brazil, Mexico and Colombia, with the decision path to the right product.
- SGP.32 for IoT devices
What SGP.32 changes for IoT fleets, which devices qualify, and why SGP.02 devices cannot be upgraded over the air.
- eUICC identifier (EID)
The eUICC identifier, separate from the subscription.
Related products
Put this to work
Tell us the traffic, the destination and the measurement you need; we reply with the next step.