IPsec over the internet
The usual termination: a tunnel from the operator network or from the edge router to the firewall at headquarters. It encrypts the segment. It does not replace firewall rules.
Technologies
APN types, connection types and radio — without promises that are not in the contract.
Below is the map of terms we use in a design. Which variant can actually be turned up depends on the operator’s offer and on your edge. We are not an operator and we do not publish the operator’s network parameters.
Request a proposal APN types and connection types +48 698 355 667
The usual termination: a tunnel from the operator network or from the edge router to the firewall at headquarters. It encrypts the segment. It does not replace firewall rules.
When the operator’s offer includes a private circuit or an L2/L3 VPN between the APN and the site. We take what is in the contract, not a line from a brochure.
Another tunnel termination seen at operators. The choice follows the edge you already have.
The tunnel can end in the customer’s data centre or cloud, on a firewall you run there. The cloud is not then “the device’s public internet”.
A second tunnel when the edge and the operator can carry it. On site, a Peplink router adds a second SIM or a second link.
APN types
| Type | What the device gets | When it fits |
|---|---|---|
| Public APN | A path to the internet, usually behind the operator’s NAT | Ordinary human work. For a controller or a terminal — needless exposure. |
| Dedicated private APN | A separate gateway and pool for one organisation | A fleet that should stay on the company network. |
| Private addressing, static or pooled IP | A private address per session or pinned to the SIM | When headquarters must recognise a specific device. |
| Closed, no internet | No route to the public network | The layout we deploy by default. |
| Internet only through the customer firewall | A path exists, but behind your policy | When an application truly must exit, and the branch must not have its own hole. |
| Multi-operator / multi-SIM | A separate APN per network, shared addressing at the customer | Coverage, and no dependency on a single operator. |
| PAP/CHAP authentication, RADIUS | An extra session check, if the operator’s variant has it | When you already run RADIUS or policy requires it. We do not promise it on every network. |
How the APN meets the customer network
Pick a type. The diagram highlights the path. The table below stays when animation is off.
Dedicated circuit, MPLS, L2/L3
When the operator’s offer includes a private circuit or an L2/L3 VPN between the APN and the site. We take what is in the contract, not a line from a brochure.
GRE / L2TP
Another tunnel termination seen at operators. The choice follows the edge you already have.
Handoff to cloud
The tunnel can end in the customer’s data centre or cloud, on a firewall you run there. The cloud is not then “the device’s public internet”.
Paired tunnels
A second tunnel when the edge and the operator can carry it. On site, a Peplink router adds a second SIM or a second link.
Radio
| Technology | What we use it for |
|---|---|
| 2G / 3G | The networks are being switched off. We do not base a new design on them. |
| LTE | Routers, POS, CCTV, branch backup — where the SIM and the coverage are LTE. |
| LTE-M | Meters and sensors, when the device and the operator have that profile. |
| NB-IoT | Infrequent, short meter and sensor transmissions. Not for a video stream. |
| 5G NSA / SA | Where the contract, the SIM and the coverage allow it. SA is not a promise at every site. |
| eSIM / iSIM | A profile in the device instead of a plastic SIM, if the hardware and the operator support it. |
| Multi-IMSI | A SIM that can join more than one network. We use it when coverage requires it — addressing still meets at your edge. |
Device → headquarters
A reading, a transaction, an alarm, a stream. The default direction.
Headquarters → device
Remote service and a command. Entry is from the tunnel, not from the internet.
Device → device
Can be left open or cut. A meter does not have to see a terminal.
Four APNs, one firewall
Play, Orange, T-Mobile and Plus. Each private APN on its own IPsec tunnel or dedicated circuit. One address plan, one policy, one place to watch. Starlink can be a fifth path, bonded on Peplink. Fiber stays the primary link beside that design.
Starlink as a complement
We deploy Starlink kits only for companies and institutions. The satellite subscription is on Starlink’s terms — we are not the Starlink operator. At the edge a Peplink router bonds Starlink with LTE/5G (SpeedFusion: bonding and Hot Failover). Traffic still ends in a tunnel on the customer firewall. We do not publish speeds or our own failover time.
SpeedFusion bonds WAN links — satellite, 5G, LTE, and fiber where it exists — into one tunnel. Packets of a single session can cross those links at once. The manufacturer describes Hot Failover as moving traffic to a working link without dropping the active session. InControl 2 is for viewing and configuring the routers. We do not claim Peplink partner status.
blueforces.pl/peplink blueforces.pl/starlink Operators Fiber Data
Central internet breakout
When an application must reach the public network, the firewall at headquarters does it: filter, IPS, log. A branch on backup does not get its own NAT. A fully closed APN, with no internet at all, remains an option.