01
Registration on the radio network
A SIM or eSIM in the device attaches to the operator network like any other service SIM.
How it works
The packet asks for your APN. A foreign SIM and the internet stay outside.
A private APN is a subnet the operator builds for one organisation. Traffic has no route to the public internet until you deliberately lead it out through the firewall at headquarters. Tunnel encryption is a separate layer: IPsec on the path to the site.
Request a proposal APN types and connection types +48 698 355 667
Checks, in order
02
Request for a named APN
The device asks for the access point created for your organisation, not for a public internet gateway.
03
The SIM list is checked
The network compares the SIM with the list allowed into this APN. A SIM that is not listed gets no session. That is the first access control, before any address exists.
04
An address from a private pool
For the session, or permanently bound to that SIM. We use a fixed binding where a system must recognise a terminal, meter, camera or controller. We confirm it in the design.
05
No route to the internet
The default layout has no exit to the public network. The device is not a scan target and does not attract traffic you did not ask for.
06
Tunnel to headquarters
When company systems must see the devices, packets go to your router. Most often that is IPsec. GRE and private links also exist, depending on the operator and the edge. The tunnel can be duplicated.
07
A rule on the firewall
Your side decides which servers, control rooms and payment hosts are reachable. RADIUS can be added when the APN variant and your server allow it.
Complete solution
SIM + private APN + MDM + hardware (Peplink) + support
The packet path above starts only after the device is enrolled and has a profile. The SIM has no second route: the operator’s private APN, then the tunnel. The management console sits behind the same firewall as headquarters.
The public internet and a private APN
On the left the device is a target. On the right it is a client of your network.
Two endings, and a third only on purpose
A network of devices only
SIMs share addressing, or they do not see each other at all if inter-device traffic is removed. You reach them only as that variant allows — without a tunnel to headquarters when none is needed.
Devices and headquarters
The common layout: POS, SCADA, CCTV, water, parking, backup. The tunnel ends on a router at the office, the plant or the data centre.
An exit you control
If an application must reach the internet, traffic leaves through the firewall at headquarters, under your policy. We do not add a quiet route beside it.