control layers before a packet reaches a system at headquarters
A private network for infrastructure that cannot sit on the internet
Device traffic never touches the public internet.
An isolated private APN for companies and institutions. A terminal, meter, camera and router get a private address, not a public one. Only allow-listed SIMs join — and, where the operator’s platform can do it, SIMs bound to an IMEI. From there, an encrypted IPsec tunnel to the firewall at headquarters, segmentation and a log. A measure toward NIS2 and KSC, not a certificate of compliance.
Integrator · Play partner · B2B only · we are not an operator
no route to the internet Tunnel SIM / IMEI
- Isolation
- no route to the internet
- Address
- private, no public IP
- Entry
- SIM list, IMEI binding
- Tunnel
- IPsec to the central firewall
Packet path
From the SIM to headquarters. The internet stays behind the shield.
The packet crosses the operator’s radio network into the private APN, then an encrypted tunnel. An attempt from the public internet has nowhere to land.
operator networks can share one addressing plan
firewall policy — including on the backup link
Complete solution
SIM + private APN + MDM + hardware (Peplink) + support
We sell one layout, not a SIM with internet and a console from another shelf. Without MDM the phone can drop onto foreign Wi-Fi. Without a private APN the console leaves traffic on the public network.
Protection
Six layers before anyone can see the device.
SIM list, no public address, segmentation, tunnel, firewall, log. The statute stays with the audit.
01
SIM list and IMEI binding
Only an allow-listed SIM joins the APN. Where the operator’s platform can bind it to an IMEI, a SIM moved to another device does not keep the session.
02
No public IP
The address is private. The internet cannot address a packet to it. This is not a hidden NAT with a hole on demand.
03
Segmentation
A meter does not have to see a camera. Traffic between SIMs is cut where the APN variant and the firewall allow it.
04
IPsec / VPN tunnel
The path to headquarters is encrypted. Isolation removes the route. The tunnel protects the payload in transit. It is not application encryption.
05
Customer firewall
The rule for which systems at headquarters may see the device stays with you. Internet breakout goes this way, or not at all.
06
Logs
The trace of the session and of the decision sits on the firewall and in the tools you already run. An APN does not replace a SIEM or incident handling.
Several networks, one policy
APNs from Play, Orange, T-Mobile and Plus meet on your firewall.
Each operator terminates its own private APN on a separate tunnel. The address plan, the rules and the log are shared. A Peplink router with several SIMs moves a site when one network loses coverage. Fiber stays primary. The APN and Starlink stay backup. The operator provides the APN. We integrate it.
Primary link and backup
When fiber fails, the branch returns to the same private network.
Backup traffic uses a private APN (LTE/5G, and Starlink on Peplink where coverage is weak) back to headquarters. The internet, if it is needed at all, breaks out only behind the firewall. The branch has no local exposure.
Use cases
Each scenario has its own page.
The layouts below are illustrative examples, not client references. On the temperature page we also supply the loggers themselves.
POS terminals
Example: 50 shops. A counter terminal with no life on the internet.
Energy meters
AMI, heat, gas, substations, renewables. Energy in the NIS2 conversation.
Water meters
Water meters, pumping stations, treatment, pressure and leaks.
Telemetry
Scattered measurement points. Not the utilities-meter page and not general IoT.
Industrial SCADA
Example: field RTUs and a supervisory system in the control room.
CCTV and ANPR
Example: plate cameras on a car park. Video needs bandwidth.
Fleet
Example: 120 vehicles on one addressing plan.
GPS trackers
Separate from the fleet page: tracker, CAN, tachograph, theft alarm.
Backup link
Fiber fails. LTE/5G and Starlink return to headquarters.
IoT devices
Vending, EV chargers, BMS, controllers. Beside telemetry, not instead of it.
Temperature
We supply LTE loggers plus the APN, installation and support.
Notification
Site alarms with no public IP. CerberSOS calls people by voice and SMS.
Use cases
Where a SIM must not sit on the public internet
A private APN keeps the device off the public internet: it gets a private address and its traffic runs through a tunnel to your central site. The technical effect is a smaller attack surface, segmentation and traffic control at the central firewall — a means of isolation and risk reduction, not a compliance certification. Below are the device categories we most often connect this way (M2M / IoT).
Telemetry and remote metering
Electricity meters (AMI)
Remote reading into the billing system; SIM on private addressing, no public IP.
Water meters
Telemetry and reads, SIM allow-list, segmentation and traffic logging.
Gas meters
Reads from concentrators and modems, private addressing, firewall at HQ.
Heat meters
Billing-grade heat reads through a tunnel, never exposed to the internet.
Flow meters (water / sewage)
Continuous flow reads; the device is visible only to the reading system.
Tank levels (fuel / water / sewage)
Level probes report to HQ over a private channel, not a public one.
Cold chain and temperature
Medical refrigerators
Pharmacies, hospitals, labs, vaccination points — continuous temperature monitoring to HQ.
Food cold storage and cold chain
Temperature reads and alarms with no public IP on the device.
Transport refrigeration (reefer trailers)
Reefer telemetry on the road over LTE/5G, tunneled to the system.
Server rooms (temp / humidity)
Environmental sensors report to HQ on private addressing.
Warehouses and public spaces
Distributed climate sensors joined by one private APN.
Air quality / environmental sensors
Readings to HQ over a private channel, no network exposure.
Transport and fleet
Fleet GPS and telematics
Vehicle location and data to the fleet system via a tunnel, not public.
Ambulances
Location and medical equipment on an isolated network, stream to dispatch.
Tachographs / recorders
Remote data pulls with the device out of reach of the public internet.
Municipal vehicles
Telematics and body sensors joined by a private APN.
EV charging stations
Chargers talk to the backend through a tunnel, no panel exposed online.
Shared bikes / scooters
Shared-vehicle fleet on private SIM addressing.
Retail and vending
Coffee machines
Telemetry and remote service of machines with no public IP.
Vending machines
Stock, payments and alarms to HQ over a private channel.
POS terminals without fixed line
Payments over LTE/5G on private addressing, traffic only to the payment/central site.
Parking / ticket machines
Settlement and status to HQ via tunnel, device invisible from the internet.
Parcel lockers
Pickup terminals on an isolated network to the logistics system.
DOOH advertising screens
Remote content management without opening screens to the public internet.
Infrastructure, industry and security
PLC / SCADA controllers
Pumping stations, water treatment — control and reads on a closed network, firewall at HQ.
Transformer / switching stations
Grid telemetry and protection on private addressing.
Street lighting (smart lighting)
Lamp controllers report to HQ over a private channel.
Photovoltaics / inverters
Production monitoring and remote service with no public IP on the inverter.
CCTV / ANPR cameras and video surveillance
Site surveillance: cameras on private addressing, stream to HQ/NVR over an IPsec tunnel — the recorder and cameras are not exposed to the public internet.
Barriers, access control, alarms, lifts
Access control, alarm systems and lift telemetry on an isolated network to HQ.
These are categories of use, not named references. Named real-world deployments are shown only as [to be confirmed]. The network is provided by the operator — we design and integrate the private APN and the tunnel; we are not an operator.
06 — NIS2 and KSC
A smaller attack surface for organisations the act already covers — or that still need to check.
A private APN shrinks exposure and gives a backup path into the network you already control. It does not decide whether the statute applies to you.
We do not decide whether an organisation is an essential or important entity, and we do not issue an attestation. Classification and audit belong with cybersecurity specialists.
Related solutions
The same company
07 — Questions
Short answers before you send an enquiry.
Does traffic from the SIMs reach the internet?
In the layout we deploy by default, no. The device stays on private addressing. An internet exit is added only when an application needs it, and it is sent through the firewall at headquarters.
How is this different from a VPN on a laptop?
A laptop VPN protects a person’s session that already uses the internet. A private APN changes the path of the SIM: a terminal, meter or controller is not given a route onto the public network.
Is World Support Service an operator?
We do not run a radio network. The mobile service is provided by the operator. We are a Play partner and an integrator: design, choice of SIMs and devices, the tunnel to headquarters, commissioning.
Does the SIM get a fixed private address?
That is how we set devices headquarters must recognise by address: terminals, meters, cameras, controllers. We confirm it in the design. We do not guess it from a tariff name.