Two Approaches to Securing Industrial Mobile Connectivity
When a controller, sensor, or IoT gateway connects via a 4G SIM card, its data travels through the operator’s mobile network. The security question then is: What path does this data take, and is it protected against interception?
Two technologies address this issue in complementary ways: private APN and industrial VPN.
Understanding Private APN
The APN (Access Point Name) is the identifier of the data network to which a SIM card routes its IP traffic. By default, consumer SIM cards—and even most M2M SIM cards—use a public APN: your data leaves the carrier’s mobile network and enters the public Internet.
A private APN changes this behavior: the carrier creates an APN dedicated to your organization, and all associated SIM cards have their traffic routed directly to your corporate network (via MPLS or carrier fiber)—without ever passing through the Internet.
Advantages of a private APN:
- Complete isolation of traffic at the carrier level
- Fixed private IP address for each SIM (simplifies firewall rules)
- Compliance with security policies that prohibit access to the public Internet
- No dependence on the quality of the public Internet
Limitations of private APN:
- High cost (dedicated carrier contract, MPLS link)
- Does not work for international roaming
- Does not encrypt data (network isolation ≠ encryption)
- Less flexible for small fleets
Understanding Industrial VPNs (OpenVPN / IPSec)
An industrial VPN (Virtual Private Network) establishes an encrypted tunnel between the field router and a VPN concentrator (on-premises or in the cloud). The data travels over the public Internet but is encapsulated in an AES-256-encrypted tunnel—making it unreadable even if intercepted.
Benefits of an industrial VPN:
- End-to-end encryption (AES-256, TLS 1.3)
- Works anywhere: public Internet, international roaming, fiber
- Significantly lower cost than a private APN
- Compatible with all SIM cards (M2M, standard plans)
- Strong authentication supported (certificates, MFA)
Limitations of Industrial VPNs:
- Slight bandwidth overhead (tunnel headers)
- Dependent on the quality and availability of the public Internet
- Requires a VPN concentrator (key and certificate management)
Comparison of Private APNs vs. Industrial VPNs
| Criterion | Private APN | OpenVPN/IPSec VPN |
|---|---|---|
| Network security | Carrier isolation (no Internet) | Encrypted tunnel over the Internet |
| Data encryption | No (network isolation only) | Yes (AES-256, TLS 1.3) |
| Cost | High (carrier contract + MPLS) | Low (built into the router) |
| Deployment | Complex (contract, operator configuration) | Simple (router configuration) |
| International portability | Lost when roaming | Works everywhere |
| IT integration | Requires a dedicated link to the IT system | Tunnel to any server |
| Fixed IP addressing | Yes (native) | Possible (with a concentrator) |
| ISO 27001 compliance | Facilitated | Facilitated if strong encryption is used |
The Eziwan Approach: Private APN + VPN for Double Security
For sensitive industrial applications, Eziwan recommends and supports a combined approach:
Layer 1 — Private APN: Traffic from your M2M SIM cards never touches the public Internet. It arrives directly in your corporate network via a dedicated carrier tunnel.
Layer 2 — OpenVPN/IPSec VPN: In addition to network isolation, all data is encrypted end-to-end within an AES-256 tunnel. Even if someone were to gain access to the operator’s network, the data would be unreadable.
Layer 3 — Zero-Trust: Remote access via the Eziwan platform follows zero-trust principles—MFA authentication, granular access by device, and comprehensive session logging.
This three-layer architecture is recommended for mission-critical applications: OT infrastructure in the energy, water, and transportation sectors, or any facility subject to the NIS2 Directive.
For customers whose budget does not allow for a private carrier-grade VPN, a VPN alone (Layer 2 + Layer 3) provides a very high level of security for the vast majority of industrial applications.
Use Cases: Which Solution Should You Choose?
Use the private APN if: your CISO policy prohibits any Internet traffic, you have 50 or more M2M SIM cards, you manage critical infrastructure (energy, water, transportation) subject to NIS2, or you already have a carrier-provided MPLS infrastructure.
Use the VPN on its own if: you manage a network of 5 to 50 sites, your equipment is used internationally, your budget doesn’t allow for a private APN, or you’re starting a project and want a solution that can be deployed quickly.
Use both if: you manage critical OT infrastructure containing sensitive data, you are subject to NIS2 or industry-specific requirements, or your security policy mandates defense in depth.
See also: Traditional VPN vs. Industrial Remote Access · Industrial 4G vs. 5G Router · Industrial Remote Access