A private network gives a group of SIM cards static IP addresses on a gateway dedicated to your account. Every Simbase private network now runs on its own gateway, in a POP you choose, with a connector you choose. This article covers the new architecture, how to connect with WireGuard, and how to migrate an existing private network onto it.

What does a Private Network get you

• A dedicated gateway, just for you. Your private network runs on its own isolated gateway, not a box shared with other customers. No noisy neighbours, no cross-customer outages.

• Static IPs assigned at the carrier. Each SIM gets an IP from your own range directly from the carrier. There's no dynamic-to-static NAT step in the middle.

• Your choice of connector, configurable per network:

  • WireGuard, recommended for most setups, see below.

  • IPsec, a two-way site-to-site tunnel into your own network, see IPsec.

  • NAT, the gateway gives SIMs a public-facing IP without running a VPN tunnel.

• Your choice of POP. Frankfurt (EU) or Virginia (US).

For background on what a VPN does and when one is worth setting up, see VPN for IoT.

Deploying a Private Network

Deploying and assigning SIMs to a Private Network is easy :

1. Navigate to Private Networks, in your Simbase dashboard.

2. Click Create Network.

3. Name your network, select the Breakout location and SIM Profile.

4. Deploy the network.

To assign SIMs to your network:

1. Access the newly created Private Network.

2. Go to SIM Cards .

3. Click on Assign SIMs.

4. Lookup the SIMs you wish added to the Private Network and click on Assign Selected.

Connect with WireGuard

Getting connected is copy-paste: Simbase generates a ready-made config for your private network. Install the client, create an empty tunnel, paste the config, and activate.

A config looks something like this:

[Interface]
PrivateKey = <generated for you>
Address    = 10.215.8.50/32
​
[Peer]
PublicKey  = <your gateway key>
Endpoint   = your-gateway.simbase.com:51820
AllowedIPs = 10.215.8.0/24
PersistentKeepalive = 25

1. Download your config files

Your network's email contains five Bitwarden Send links and one password. Each link gives you one ready-to-use WireGuard config as a .txt file, one per device or client you want to connect.

For each link:

1. Open the email and copy the password shown in it.

2. Click the Bitwarden Send link. It opens a Bitwarden page in your browser.

3. Paste the password into the password field and click Continue.

4. Click Download. A .txt file is saved to your computer, for example wireguard_profile_1.txt.

5. Repeat for the remaining links.

Open one of the downloaded files in a text editor to confirm it looks like a config, with an [Interface] section and a [Peer] section.

2. Install the WireGuard app

• Windows, macOS, or Linux: wireguard.com/install

• iPhone or iPad: the App Store

• Android: Google Play

Open the app once it's installed.

3. Add a tunnel (desktop)

1. Open one of your downloaded .txt files in a text editor (Notepad on Windows, TextEdit on macOS).

2. Select everything and copy it.

3. In the WireGuard app, click Add Tunnel and choose Add empty tunnel.

4. Delete everything in the new editor that opens.

5. Paste your config.

6. Give it a recognisable name, for example Simbase private network 1.

7. Click Save.

8. Select the tunnel in the list and click Activate.

Within a few seconds the status turns Active, and you'll see a "Latest handshake" time and bytes sent and received. That means you're connected.

4. Add a tunnel (mobile)

Save the .txt file to your phone, open the WireGuard app, tap +, choose Create from file or archive, and select the file. Then tap the tunnel to turn it on.

If your phone won't let you pick a .txt file, rename it so it ends in .conf first.

5. Check it's working

• In the app, confirm you see a recent handshake and that bytes are transferring.

• Try reaching a device or IP inside your private network, for example by pinging an IP from your per-SIM list.

• A few things to know before you migrate:

• Your SIMs keep working throughout. Migration is per SIM and on your schedule, and only affects the private network connection, not the SIM's normal data connection.

• For existing networks, pricing is unchanged.

• You get a new network ID and new static IPs. Your SIMs get new IPs on the new network, listed in the spreadsheet Simbase emails you.

• Miss the deadline and you lose remote access. SIMs keep their data connection, but reaching them over the old private network stops once the old infrastructure is retired on 18 June 2026, 20:00 UTC.

Teltonika routers, by SMS

Teltonika routers accept remote APN changes by SMS, so you don't need physical access or a VPN session:

<router_password> mobilecfg apn1 fixedip.eu

• Replace <router_password> with the router's SMS password

• Set under Services → Mobile Utilities → SMS Utilities,

• Use fixedip.us instead of fixedip.eu if your network is in the US POP.

• Send the SMS to the SIM through the dashboard. The router applies the change and reconnects automatically.

Other vendors

Most cellular routers and modules support remote APN updates through their management platform, for example Cradlepoint NetCloud, Sierra Wireless AirLink, Robustel RCMS, or InHand iManager. If you use a fleet management tool, push the APN change there first and test on a small group before rolling out to the full fleet.

For embedded modules (Quectel, Telit, Sierra, u-blox), use an AT command over your existing serial or MQTT control channel:

AT+CGDCONT=1,"IP","fixedip.eu"

Common questions

Related

• IPsec, set up or migrate a two-way IPsec tunnel

• VPN for IoT, when a VPN is worth the added complexity

• Public IPs, for inbound reachability to a single SIM without a private network

• Network Address Translation (NAT) and what it means for IoT

• Check your device is compatible before you deploy