A private network gives a group of SIM cards static IP addresses on a gateway dedicated to your account. Every Simbase private network runs on its own private gateway, in a POP you choose, with a connector you choose. This article covers the new architecture of the Simbase Private Networks and how to connect with WireGuard.

What does a Private Network get you?

• A dedicated gateway, just for you. Your private network runs on its own isolated gateway, not a box shared with other customers. No noisy neighbors, no cross-customer outages.

• Static IPs assigned at the carrier. Each SIM gets an IP from your own range directly from the carrier. There's no dynamic-to-static NAT step in the middle.

• Your choice of connector, configurable per network:

  • WireGuard, recommended for most setups, see below

  • IPsec, a two-way site-to-site tunnel into your own network, see IPsec

  • NAT, the gateway gives SIMs a public-facing IP without running a VPN tunnel

• Your choice of POP. Frankfurt (EU) or Virginia (US)

For background on what a VPN does and when one is worth setting up, see VPN for IoT.

Deploying a Private Network

Deploying and assigning SIMs to a Private network is easy:

1. Navigate to Private Networks, in your Simbase dashboard

2. Click Create Network

3. Name your network, select the Breakout location and SIM Profile

4. Deploy the network

To assign SIMs to your network:

1. Access the newly created Private network

2. Go to SIM cards

3. Click on Assign SIMs

4. Look up the SIMs you want to add to the Private network and click on Assign Selected

Connect with WireGuard

Getting connected is copy-paste: Simbase generates a ready-made config for your private network. Install the client, create an empty tunnel, paste the config, and activate.

A config looks something like this:

[Interface]
PrivateKey = <generated for you>
Address    = 10.215.8.50/32
​
[Peer]
PublicKey  = <your gateway key>
Endpoint   = your-gateway.simbase.com:51820
AllowedIPs = 10.215.8.0/24
PersistentKeepalive = 25

1. Download your config files

Your network's email contains five Bitwarden Send links and one password. Each link gives you one ready-to-use WireGuard config as a .txt file, one per device or client you want to connect.

For each link:

1. Open the email and copy the password shown in it

2. Click the Bitwarden Send link. It opens a Bitwarden page in your browser

3. Paste the password into the password field and click Continue

4. Click Download. A .txt file is saved to your computer, for example wireguard_profile_1.txt

5. Repeat for the remaining links

Open one of the downloaded files in a text editor to confirm it looks like a config, with an [Interface] section and a [Peer] section.

2. Install the WireGuard app

• Windows, macOS, or Linux: wireguard.com/install

• iPhone or iPad: the App Store

• Android: Google Play

Open the app once it's installed.

3. Add a tunnel (desktop)

1. Open one of your downloaded .txt files in a text editor (Notepad on Windows, TextEdit on macOS)

2. Select everything and copy it

3. In the WireGuard app, click Add Tunnel and choose Add empty tunnel

4. Delete everything in the new editor that opens

5. Paste your config

6. Give it a recognizable name, for example Simbase private network 1

7. Click Save

8. Select the tunnel in the list and click Activate

Within a few seconds the status turns Active, and you'll see a "Latest handshake" time and bytes sent and received. That means you're connected.

4. Add a tunnel (mobile)

Save the .txt file to your phone, open the WireGuard app, tap +, choose Create from file or archive, and select the file. Then tap the tunnel to turn it on.

If your phone won't let you pick a .txt file, rename it so it ends in .conf first.

5. Check it's working

1. In the WireGuard app, confirm the tunnel shows Active, with a recent Latest handshake and bytes sent and received both climbing.

2. With the tunnel up, ping one of your SIMs on its static IP, taken from the per-SIM list Simbase sent you.

3. Then try the service you actually need, such as SSH or the device's web interface. Some devices don't answer ping even when they're reachable.

If a SIM doesn't respond:

• Check the SIM is Enabled and has attached to the network since you changed the APN. A device that hasn't reconnected is still using the old one. See SIM state.

• Confirm the device is set to fixedip.eu or fixedip.us, matching the POP your gateway runs in.

• Check the device's own firewall. The tunnel can be up and healthy while the device itself drops the traffic.

Teltonika routers, by SMS

Teltonika routers accept remote APN changes by SMS, so you don't need physical access or a VPN session:

<router_password> mobilecfg apn1 fixedip.eu

• Replace <router_password> with the router's SMS password

• Set under Services → Mobile Utilities → SMS Utilities

• Use fixedip.us instead of fixedip.eu if your network is in the US POP

• Send the SMS to the SIM through the dashboard. The router applies the change and reconnects automatically.

Other vendors

Most cellular routers and modules support remote APN updates through their management platform, for example Cradlepoint NetCloud, Sierra Wireless AirLink, Robustel RCMS, or InHand iManager. If you use a fleet management tool, push the APN change there first and test on a small group before rolling out to the full fleet.

For embedded modules (Quectel, Telit, Sierra, u-blox), use an AT command over your existing serial or MQTT control channel:

AT+CGDCONT=1,"IP","fixedip.eu"

Common questions

Related

• IPsec — set up or migrate a two-way IPsec tunnel

• VPN for IoT — when a VPN is worth the added complexity

• Public IPs — for inbound reachability to a single SIM without a private network

• Network Address Translation (NAT) — what it means for IoT

• Compatibility check — ensure your device is compatible before deployment