> For the complete documentation index, see [llms.txt](https://support.simbase.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.simbase.com/migrating-to-your-new-private-network.md).

# Migrating to your new Private Network

We're moving all Private Networks to our new platform. Instead of a shared VPN box, every customer now gets their **own dedicated private gateway** in one of our two POPs, with static IPs assigned at the carrier and your choice of connectors: IPSec, WireGuard or NAT. No shared NAT, no noisy-neighbours, no cross-customer outages.

This page explains how the migration works, what changes, and the two things that need a little attention: OpenVPN is being retired in favor of WireGuard, and IPSec tunnels need to be rebuilt against the new network.

{% hint style="warning" %}
**Deadline: 18 June 2026, 20:00 UTC.** This is the new date we communicated on Friday. The old private-network infrastructure is retired after this point, so please migrate before then to avoid losing remote access to your devices.
{% endhint %}

## **What's changing**

* **A dedicated gateway, just for you:** Your own isolated gateway, not a shared box.
* **Static IPs at the carrier:** Each SIM gets an IP from your own range; no more dynamic-to-static NAT in the middle.
* **Your choice of connector:** IPSec, WireGuard or NAT, configurable per network. And more to come.
* **Pick your POP:** Frankfurt (EU) or Virginia (US).
* **OpenVPN is retired** and replaced by WireGuard (see below).

## **How the migration works**

We do the heavy lifting first, then you move SIMs one at a time on your own schedule.

1. **We build your new private network** on the new infrastructure, modelled on your current setup, in one of our two POPs.
2. **You receive an email** once it's ready, with everything you need:
   * the **POP** your network runs in
   * the **APN** to set (`fixedip.eu` or `fixedip.us`)
   * whether **NAT** is enabled and the public IP of the gateway
   * your **IPSec** details, if you use IPSec
   * your **WireGuard** configuration(s)
   * the **ID of your new network** (e.g. `N178050181163427`)
   * an **Excel** listing the IP assigned to each SIM
3. **Migrate per SIM in the dashboard.** A **Migrate** button appears on the SIM details page. Click it, confirm you've changed the APN on the device, and click **Migrate**.
4. **That SIM moves to the new network.** Because it's per-SIM, migrate one low-stakes device first to validate, then roll out the rest.

{% hint style="info" %}
The APN change is the trigger for the move. Nothing happens to a SIM until you click **Migrate** for it, so mixed old/new SIMs are fine during the rollout.
{% endhint %}

## **OpenVPN is being retired: Meet WireGuard**

We're no longer supporting **OpenVPN** on the new platform. It's showing its age: it runs in userspace, is effectively single-threaded per tunnel, and carries a large, complex codebase and a sprawling configuration surface. In practice that means higher CPU overhead, lower throughput, more latency, and more ways to misconfigure or to have to keep patched. It's not the foundation we want to build the next years of Private Networks on.

In its place we use **WireGuard**, a modern VPN that's built into the Linux kernel:

* **Tiny and auditable:** A few thousand lines of code, versus hundreds of thousands for OpenVPN. Far less to go wrong.
* **State-of-the-art, fixed crypto:** Curve25519, ChaCha20-Poly1305, BLAKE2s. No cipher negotiation, no weak-cipher footguns.
* **Fast and low-latency:** Runs in-kernel, with near-instant (re)connection and seamless roaming when your IP or network changes.
* **A trivial config:** A handful of lines that we generate for you.

**Getting connected is copy-paste.** We email you a ready-made WireGuard configuration for your new private network. Install the client, create an empty tunnel, paste the config (or import the file), and activate — it just works. A config looks like this:

```
[Interface]
PrivateKey = <generated for you>
Address    = 10.215.8.50/32

[Peer]
PublicKey  = <your gateway key>
Endpoint   = your-gateway.simbase.com:51820
AllowedIPs = 10.215.8.0/24
PersistentKeepalive = 25
```

**Download the WireGuard client:** [wireguard.com/install](https://www.wireguard.com/install/) for Windows, macOS and Linux, or the **App Store** (iOS) and **Google Play** (Android).

## **Setting up WireGuard, step by step**

Everything is pre-generated for you and you never create keys or edit anything. The flow is: download your config files from the email, import them into the WireGuard app, and activate.

**1. Download your config files**

Your migration email contains **5 Bitwarden Send links** and **one password**. Each link gives you one ready-to-use WireGuard config as a `.txt` file (one per device or client you want to connect, use as many as you need). If you're reading this page, you've already received them.

{% hint style="info" %}
Two limits to know about: **each link can be downloaded only once**, and **all links expire 7 days** after the email was sent. Download all five now and store them somewhere safe. If a link has expired or was already used, reply to the email and we'll re-issue it.
{% endhint %}

For each of the five links:

1. Open the migration email and **copy the password** shown in it.
2. **Click the first Bitwarden Send link.** It opens a Bitwarden page in your browser.
3. **Paste the password** into the password field and click **Continue**.
4. Click **Download**. A `.txt` file is saved to your computer (e.g. `wireguard_profile_1.txt`).
5. Repeat for the remaining four links.

Open one of the downloaded `.txt` files in any text editor to confirm it looks like a config (`[Interface]` … `[Peer]` …).

**2. Install the WireGuard app**

* **Windows / macOS / Linux:** [wireguard.com/install](https://www.wireguard.com/install/)
* **iPhone / iPad:** the App Store
* **Android:** Google Play

Open the app once it's installed.

**3. Add a tunnel (desktop)**

1. Open one of your downloaded `.txt` files in a text editor (Notepad on Windows, TextEdit on macOS).
2. Select everything (**Ctrl + A** / **⌘ + A**) and copy it (**Ctrl + C** / **⌘ + C**).
3. In the WireGuard app, click **Add Tunnel ▾** (bottom-left) and choose **Add empty tunnel…**.
4. A new editor opens with some pre-filled text. **Delete everything** in the box.
5. **Paste** your config (**Ctrl + V** / **⌘ + V**).
6. Give it a recognisable **Name** at the top, e.g. `Simbase private network 1`.
7. Click **Save**.
8. Select the tunnel in the list and click **Activate**.

Within a few seconds the status turns **Active** and you'll see a "Latest handshake" time and bytes sent/received. That means you're connected.

**On iPhone / Android:** save the `.txt` file to your phone, open the WireGuard app, tap **+**, choose **Create from file or archive**, and select the file. Then tap the tunnel to turn it on. (If your phone won't let you pick a `.txt`, rename it to end in `.conf` first.)

**4. Check it's working**

* In the app, confirm you see a recent **handshake** and that **bytes are transferring**.
* Try reaching a device or IP inside your private network (for example, ping an IP from the per-SIM Excel).
* No handshake? Make sure the SIM has been migrated and is online, and that the whole config was pasted without anything cut off. Toggle the tunnel off and on to retry.

Repeat steps 3–4 with the other config files for any additional devices.

## **If you use IPSec today**

Your existing IPSec tunnel points at your old private network, so it needs to be rebuilt against the new one. The steps:

1. **Build a new IPSec tunnel** to your new private network, using the details in your migration email (peer IP, Phase 1 / Phase 2 settings, PSK, traffic selectors).
2. **Verify it's up** and carrying traffic alongside the old tunnel.
3. **Once the new tunnel is confirmed, safely remove the old one.**

You can run both side by side during the switch-over, so there's no hard cut. Full tunnel details come by email.

**Things to know before you migrate**

* **Your SIMs keep working throughout.** Migration is per-SIM and on your schedule.
* **For existing networks the pricing is unchanged.**
* **New network ID and new static IPs.** Your SIMs get new IPs on the new network. The per-SIM list is in the Excel we email you.
* **Miss the deadline and you lose remote access.** SIMs keep their data connection, but reaching them over the old private network stops once the old infrastructure is retired. Migrate before 18 June 2026, 20:00 UTC.

## Tips for changing the APN

The APN change is the only operational lift in this migration. Here's how to make it easier depending on your hardware.

**Teltonika routers: change APN by SMS**

Teltonika routers accept remote APN changes via SMS, which means you don't need physical access or a VPN session. The command format:

```
 <router_password> mobilecfg apn1 fixedip.eu
```

Replace `<router_password>` with the router's SMS password (set under **Services → Mobile Utilities → SMS Utilities**) and swap `fixedip.eu` for `fixedip.us` if you chose the US region. Send the SMS to the SIM's though the dashboard. The router applies the change and reconnects automatically.

**Other vendors**

Most cellular routers and modules support remote APN updates over their management platform (e.g. Cradlepoint NetCloud, Sierra Wireless AirLink, Robustel RCMS, InHand iManager). If you have a fleet management tool, push the APN change there first and roll it out to a test group before the full fleet.

For embedded modules (Quectel, Telit, Sierra, u-blox), AT commands work over your existing serial or MQTT control channel:

```
AT+CGDCONT=1,"IP","fixedip.eu"
```

**Doing it at scale**

If you have hundreds or thousands of devices in the field, our recommendation:

1. Migrate a handful of SIMs in the dashboard first and update those devices manually to confirm your APN command works end-to-end.
2. Roll out to the rest in batches via your fleet management or SMS automation.
3. Use the dashboard to track which SIMs have come online on the new APN.

## **Questions?**

Reach out to support and we'll help you plan the rollout. If you have a large fleet and want us to phase the migration with you, just say so.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://support.simbase.com/migrating-to-your-new-private-network.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.