Private APN vs public APN vs VPN for IoT
Updated
A public APN connects devices to the internet through a gateway shared with other customers; a private APN is reserved for one customer and connects devices only to that customer’s network, with addresses from its own range; a VPN is software on the device that encrypts its traffic but does not, by itself, take the device off the internet. For fleets that must not be reachable from the internet, a private APN is the network-level answer; a VPN is the device-level one.
Key takeaways
- APN = the name a device sends to choose its data network. 3GPP defines it in TS 23.003.
- Public APN: shared, internet access, quick to use, devices exposed if they have a public IP.
- Private APN: dedicated, private addressing (RFC 1918 ranges or yours), traffic delivered only to your network, nothing to install on the device.
- VPN on the device: encryption end to end, but costs CPU, battery and about 60 bytes per packet.
Side by side
| Public APN | Private APN | VPN on the device | |
|---|---|---|---|
| Who uses it | Many customers | One customer | One device |
| Device address | Shared or public IP | Private IP from your range | Whatever the APN gives, plus a tunnel address |
| Reachable from the internet | Yes, if public IP | No | Yes, unless the APN prevents it |
| Where traffic goes | Internet | Your cloud or datacenter only | Your VPN server, over the internet |
| Software on the device | None | None | VPN client |
| Extra data per packet | 0 | 0 | about 60 bytes |
| Works on NB-IoT / LTE-M sensors | Yes | Yes | Often impractical |
| Typical cost | Included in the data price | Set-up and monthly fee per APN and per destination | Server and maintenance |
Why “about 60 bytes” matters
A WireGuard packet over IPv4 carries an outer IP header (20 bytes), a UDP header (8 bytes), a WireGuard data header (16 bytes) and an authentication tag (16 bytes): 60 bytes added to every packet. IPsec in tunnel mode adds a similar amount. A sensor that sends 100-byte messages therefore uses 60 percent more data with a VPN, and its modem stays awake longer, which costs battery. A private APN adds nothing on the device: the separation is done in the mobile core network.
When to choose which
- Prototype, a few consumer devices, no sensitive data: public APN; protect the server with TLS.
- Fleet that must be unreachable from the internet (cameras, PLCs, payment terminals, medical devices): private APN, delivered into your cloud or datacenter. See private delivery.
- Data that must stay encrypted end to end, whatever the network: keep TLS (or a VPN on capable devices) on top of the private APN. The two are complementary.
Limits
- A private APN protects the path, not the device itself: firmware updates and credentials still need care.
- An IPsec tunnel between the APN and your site is encrypted but crosses the internet; a cloud interconnect or a cross-connect does not. See the delivery options.
Related
Frequently asked questions
What is an APN?
An APN (Access Point Name) is the name a cellular device uses to tell the mobile network which packet data network it wants to reach. 3GPP defines its format in technical specification TS 23.003.
What is the difference between a public APN and a private APN?
A public APN is shared by many customers and leads to the internet. A private APN is dedicated to one customer: its devices get addresses from the customer's own range and their traffic goes only to the customer's network.
Is a private APN more secure than a VPN?
They protect different things. A private APN keeps devices off the internet entirely; a VPN encrypts traffic from the device but the device may still have an internet-facing address. Many fleets use a private APN and keep TLS between device and server.
How much data does a VPN add on a cellular IoT device?
Around 60 bytes per packet. A WireGuard packet over IPv4 adds 20 bytes of outer IP header, 8 of UDP, 16 of WireGuard header and a 16-byte authentication tag. On a 100-byte sensor message, that is 60 percent more data.