What Is an APN?

Back to Blog

How an APN Works

Every cellular data SIM is provisioned with one or more APNs. When the modem attaches to the network and requests a data session, it names an APN. The carrier's core network uses that name to pick the packet gateway (the PGW in LTE, or GGSN on older networks) that handles the session - assigning an IP address and defining what the device can reach. In effect the APN is the door the SIM's traffic walks through to leave the cellular network.

A public APN drops the device onto the open internet, usually behind carrier-grade NAT with a dynamic, private-range IP. A private APN routes the SIM's traffic instead into a dedicated network - reached over a VPN, MPLS, or direct interconnect to your data center - so the field devices never touch the public internet.

Why Oil and Gas Uses Private APNs

For a fleet of remote RTUs and flow computers, a private APN is a common design. It keeps telemetry traffic on a network the operator controls, gives every SIM a predictable IP range (which simplifies polling and firewalling), and can make devices addressable from the head end without exposing them to the internet. It also lets the operator apply a single security policy across the whole fleet rather than trusting each site's local firewall.

That said, a private APN is not a substitute for encryption or authentication - it controls routing, not the confidentiality of the payload. Many operators pair a private APN with an outbound-only, encrypted connection so the two layers reinforce each other. Merobix reads the field devices behind either arrangement over Modbus, DNP3, or MQTT, whichever the site provides.

Setting Up an APN on a SCADA Gateway

Getting a new SIM online is mostly a matter of matching three things: what the carrier provisioned on the SIM, what you type into the gateway, and what the head end expects to see once the session is up. The APN string itself is unforgiving - it must match exactly, including case and punctuation, because the carrier's core treats it as a lookup key, not a suggestion. Before touching the gateway, get the exact APN name, the authentication type (PAP or CHAP, if any), and any username and password from whoever manages the SIM contract.

A clean commissioning sequence looks like this:

1. Confirm with the carrier or SIM manager that the SIM is provisioned for the APN you intend to use - a private APN only works if the SIM was added to it on the carrier side.
2. Enter the APN, authentication type, and credentials in the gateway's cellular WAN settings, and disable any automatic-APN feature so the modem cannot silently fall back to a carrier default.
3. Force the modem to detach and reattach, or power-cycle the gateway, so it requests a fresh data session.
4. Check that the modem reports both network registration and an active data session, then note the IP address it was assigned.
5. Verify the assigned IP falls in the range you expect for that APN, and test reachability from the polling host, not just from the gateway outward.

The last step matters because it catches the classic silent failure: the modem attaches on a default public APN, gets an internet IP behind carrier NAT, and everything looks healthy from the site while the head end cannot reach the device at all. A structured check like the one in verifying private APN connectivity on a SCADA SIM confirms the session landed on the right network, not just on a network.

Troubleshooting APN Failures in the Field

APN faults sort into a few recognizable patterns. If the modem shows good signal and network registration but no data session, the request for the APN is being rejected - usually a typo in the APN string, wrong authentication settings, or a SIM that was never provisioned for that APN. If a data session comes up but the head end cannot reach the device, the session probably landed on the wrong APN, or the addressing does not match the firewall rules at the interconnect. And if the link works but drops after periods of quiet, look at idle timeouts on the carrier side and add a keepalive from the gateway.

Two details trip people repeatedly. First, signal strength has nothing to do with APN problems - a strong-signal site with a wrong APN string will register and still move no data, so treat registration and session establishment as separate tests. Second, when a SIM is moved between gateways, the APN configuration does not travel with it; the replacement gateway must be configured with the same APN, authentication type, and credentials before the site comes back.

Design Decisions That Hang Off the APN Choice

The APN decision ripples into the rest of the telemetry design. On a private APN you can assign each SIM a fixed address from your own plan, which lets the head end poll outward to devices and keeps firewall rules simple; on a public APN with carrier NAT, connections must originate at the site, which pushes the design toward outbound publishing patterns like MQTT. The trade-offs between the two arrangements are covered in more depth in private APN vs public cellular for SCADA.

The APN is also only one of several ways to build a controlled path from field to host. Some operators run a VPN over a public APN instead of paying for a private one, and some high-security sites layer both. Where the link sits in that spectrum, and how it compares with stronger isolation options, is the subject of VPN vs private APN vs data diode. Whichever you choose, document the APN, credentials, and expected IP range with the site records, because the next technician to touch the gateway will need all three.

Frequently Asked Questions