# Private APN and VPN

https://www.datasim.com/technical/private-apn-vpn/

Quick answer. A private APN is a gateway configuration in the mobile network set up for one customer, with its own IP addressing, routing and access rules. Its traffic can be kept off the public internet and delivered to the customer's network over an IPsec VPN or a direct link. A VPN can also run in the device itself, which encrypts data all the way to the customer.

## Simple

Every mobile data connection goes through a gateway in the operator's network, chosen by the [APN](/technical/apn/) the device asks for. A public APN leads to the internet. A private APN leads to a gateway set up for one customer, with its own addresses, routes and rules.

### What a private APN gives you

With a private APN, your devices can sit on a private network that you control. Their traffic can be kept off the public internet and delivered straight to your own systems. Your servers can reach the devices by their own addresses, which is hard to do when devices share public addresses behind [carrier-grade NAT](/technical/cgnat-static-ip/).

The operator can also check each device as it connects, for example against a list of SIMs or a username and password held on your own server, before giving it an address.

### How traffic reaches your network

The private APN gateway is in the operator's network, and your systems are somewhere else. Something has to join the two. The usual choice is an encrypted VPN tunnel between the operator and your firewall or cloud network. Larger customers sometimes use a direct link instead.

### VPN in the device or in the network

There are two places a VPN can start.

- **In the device.** The device runs VPN software itself and builds a tunnel to your server over an ordinary internet connection. It works on any APN, but it uses the device's battery, memory and data allowance, and it adds bytes to every message.
- **In the network.** The device connects normally to the private APN, and the tunnel runs between the operator and you. The device does nothing extra. The radio part of the journey is normally ciphered by the mobile network.

Some designs use both.

### Things to plan for

Your devices can be set up to reach your private network only, or both your network and the internet. When a device roams, its data usually travels back to its home network before reaching you, which adds delay. And the addresses you choose for the devices must not clash with addresses already used in your own network.

## Advanced

### What a private APN is

An APN (TS 23.003 clause 9) names the packet data network a device wants to reach. In LTE the MME uses it to select a PDN Gateway, and the PDN connection terminates there (TS 23.401). In 5G the same role is played by the Data Network Name, which TS 23.501 defines as equivalent to an APN, and the session terminates on a UPF chosen by the SMF.

A private APN is an APN whose gateway configuration belongs to one customer. It has its own:

- **addressing**, usually a private range from RFC 1918 (10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16), allocated by the gateway or by the customer's own RADIUS or DHCP server;
- **routing**, so traffic leaves the gateway towards the customer's network instead of the internet;
- **policy**, such as which SIMs may use the APN, whether devices may reach each other, and firewall rules.

Nothing in the device changes apart from the APN name it requests.

### Authentication on the APN

TS 29.061 describes how the gateway can use RADIUS (RFC 2865) on the SGi interface. When a device opens a PDN connection, the gateway can send an Access-Request carrying the IMSI, MSISDN, IMEI and any username and password the device supplied in its Protocol Configuration Options. The customer's RADIUS server accepts or rejects it and can return the IP address to use. RADIUS accounting messages give the customer a record of each session start and stop. This is a second check on top of SIM authentication, which the network always performs.

### Getting traffic to the customer

The gateway is in the operator's core, so traffic must be carried from it to the customer. The common options are:

| Method | What it is | Typical use |
|---|---|---|
| IPsec site-to-site | An IPsec tunnel (RFC 4301) set up with IKEv2 (RFC 7296) between the operator and the customer's firewall or cloud VPN gateway | Most deployments |
| Other tunnels | GRE, L2TP or similar, sometimes inside IPsec | Where the customer's equipment needs them |
| Direct interconnect | A private circuit or cloud interconnect to the customer | High volumes or strict latency needs |

With a site-to-site tunnel, the device addresses and the customer's internal ranges must not overlap, or routing fails. Agree the ranges before the first SIM is deployed, and leave room to grow.

### Device-side and network-side VPN

A device-side VPN runs in the device: IPsec, OpenVPN or WireGuard, connecting to a server the customer runs. It needs no special APN, and the traffic is encrypted all the way from the device to the customer. The costs are in the device. Each packet carries tunnel headers, which matters on metered or narrowband links. Keepalives keep NAT bindings and tunnel state open, which works against power saving with [PSM and eDRX](/technical/psm-edrx/). The device also needs keys, software and updates.

A network-side VPN starts at the operator. The device sends plain IP packets over the radio, normally ciphered there by the network, and the operator's gateway sends them into the tunnel to the customer. The device does no extra work. Inside the operator's core, and between operators when roaming, the packets travel in GTP tunnels that are not encrypted by the private APN itself.

Where the data must be protected end to end, use TLS or a device-side VPN, over a private APN if the addressing and routing benefits are also wanted.

### Split routing

A device may need both the customer's network and the internet. There are three common ways to do it.

- **Two PDN connections.** TS 23.401 lets a device hold PDN connections to more than one APN at once, for example a private APN and an internet APN. The device's routing table decides which traffic uses which. Not every module or network supports this well.
- **Routing at the gateway.** The private APN sends the customer's ranges to the tunnel and everything else to the internet, through NAT.
- **Routing at the customer.** All traffic goes to the customer, whose own firewall sends internet traffic on. This gives one point of control at the cost of extra traffic and latency.

### Roaming and latency

When a device roams, its PDN connection is usually home routed: the visited network carries the traffic back to the home network's gateway (TS 23.401 supports both home routing and local breakout). The private APN gateway is in the home network, so a device on another continent sends every packet there before it reaches the customer. Add the round trip from the gateway to the customer's endpoint as well. Place customer endpoints near the home gateway, and allow for the extra delay in timeouts. See [roaming](/technical/roaming/) for more on how roaming works.

### Private APN and network slicing

A network slice is a 5G standalone feature (TS 23.501 clause 5.15). The device asks for a slice by its S-NSSAI, and the network can give that slice its own core functions and radio resources. A private APN or DNN is a routing and policy arrangement at the gateway. It can be used inside a slice, but it does not reserve radio capacity or create a slice on its own, and it is used on 4G networks as well as 5G.

## Myths

- **Myth.** A private APN is a network slice.
  **Fact.** Network slicing is a 5G standalone feature defined in TS 23.501, where the network can give a slice its own core functions and radio resources. A private APN is a routing and policy setup at the gateway. It reserves no radio capacity and is used on 4G networks too.
- **Myth.** Traffic on a private APN is encrypted end to end.
  **Fact.** The radio link is ciphered and the link from the operator to the customer is usually an IPsec tunnel. Inside the operator's core, and between operators when roaming, the private APN adds no encryption. For end-to-end protection, use TLS or a VPN that runs in the device.
- **Myth.** A private APN makes roaming devices faster.
  **Fact.** Roaming data is usually carried back to the home network's gateway before it reaches the customer. A private APN does not change that path, so a device far from its home network still sees the extra delay.

## Sources

1. [GPRS enhancements for E-UTRAN access (PDN connections, multiple PDN connections, home routing)](https://www.3gpp.org/DynaReport/23401.htm), 3GPP, TS 23.401
2. [System architecture for the 5G System (DNN, network slicing)](https://www.3gpp.org/DynaReport/23501.htm), 3GPP, TS 23.501
3. [Numbering, addressing and identification (Access Point Name)](https://www.3gpp.org/DynaReport/23003.htm), 3GPP, TS 23.003
4. [Interworking between the PLMN and packet data networks (RADIUS on SGi)](https://www.3gpp.org/DynaReport/29061.htm), 3GPP, TS 29.061
5. [Security Architecture for the Internet Protocol](https://www.rfc-editor.org/rfc/rfc4301), IETF, RFC 4301
6. [Internet Key Exchange Protocol Version 2 (IKEv2)](https://www.rfc-editor.org/rfc/rfc7296), IETF, RFC 7296
7. [Remote Authentication Dial In User Service (RADIUS)](https://www.rfc-editor.org/rfc/rfc2865), IETF, RFC 2865
8. [Address Allocation for Private Internets](https://www.rfc-editor.org/rfc/rfc1918), IETF, RFC 1918

Checked 30 October 2026.