> For the complete documentation index, see [llms.txt](https://support.simbase.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.simbase.com/private-networks.md).

# Private Networks

A private network is a fundament for our advanced network services. When you deploy a private network and assign SIM cards to it, you are creating an isolated subnet that allows you to control network access.

Every private network runs on its own dedicated gateway in one of our two POPs, Frankfurt (EU) or Virginia (US). Nothing is shared with other customers.

## Private network basics

When you create a private network, you must specify a subnet size of IPv4 addresses for the VPN in the form of a Classless Inter-Domain Routing (CIDR) block. For example, /24 (256 hosts). A random subnet in the 10.0.x.x IP space will be assigned to your private network. Read more on CIDR blocks [here](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) and [here](https://www.davidc.net/sites/default/subnets/subnets.html).

Each SIM you assign receives a static IP from that range, assigned at the carrier. There is no NAT between your device and your gateway, so the IP you see in the dashboard is the IP your device actually uses.

Set the APN on your device to `fixedip.eu` or `fixedip.us`, matching the POP your network runs in. See [How do I set up the APN?](/getting-started/how-do-i-set-up-the-apn.md) for the per-device steps.

## Connectors

You reach your SIMs through a connector on the network. Configure one or more per network from the dashboard.

| Connector     | Use it for                                                                                                                        |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **WireGuard** | Remote access from a laptop or a server. The configuration is generated for you. See [WireGuard](/private-networks/wireguard.md). |
| **IPSec**     | A site-to-site tunnel between your private network and your corporate or cloud network. See [IPSec](/private-networks/ipsec.md).  |
| **NAT**       | Outbound internet access for your SIM cards, via the public IP of your gateway.                                                   |

{% hint style="info" %}
OpenVPN is no longer offered. WireGuard replaces it: a much smaller codebase, modern fixed crypto, in-kernel performance and a configuration of a few lines. See [WireGuard](/private-networks/wireguard.md).
{% endhint %}

## Specifications and limitations

* An IPv4 subnet is randomly assigned to your account, depending on the required subnet size. It is not possible to choose a custom subnet.
* Once a private network is deployed, it is not possible to increase or decrease the subnet size of the private network.
* [Contact our support team](https://www.simbase.com/support-request) if you require a subnet larger than size /22 (1022 hosts).
* There is a daily fee per private network, that depends on the size of your private network.
* There is **no minimum term** for a private network. You can terminate anytime
* You can deploy as many private networks as you need. So you can create individual networks per customer, business division, etc.
* Once the private network is deployed, you can assign individual SIM cards to your private network. Each assigned SIM card will receive a static IP that can be obtained via our dashboard or API.
* Each network runs on its own dedicated gateway, in the POP you select: Frankfurt (EU) or Virginia (US).
* Connectors are configured per network and can be combined. A network can run WireGuard and IPSec at the same time.
* Optionally, you can disable internet access for your SIM cards.

## Deploy a private network

To deploy a private network, please see the video above or the steps below:

* Log in to our dashboard (user rights owner or admin are required).
* Navigate to **'Private Network'**
* Click **'Create New Private Network'**
* Give your network a friendly name, select the required subnet size, disable Internet access or leave it to enabled.
* Click **'Deploy Private Network'.**
* Once all resources are deployed, click **'See details'.** Your network is now ready.

## Assign a SIM to a Private Network

To add a SIM to a private network, please see the video above or the steps below:

* Navigate to **'SIM cards'** and select the checkbox of the card(s) you want to add to a subnet.
* Click **'Assign to Private Network'** in the blue bar that appears.
* Select the correct network in the popup that appears and click 'Assign'.
* Set the APN on the device to `fixedip.eu` or `fixedip.us`, matching your POP.
* Reboot your hardware for changes to take effect.

## Connect to your device

Add a WireGuard connector to your network and import the generated configuration. See [WireGuard](/private-networks/wireguard.md) for the full walkthrough. For a permanent site-to-site link to your own network, use [IPSec](/private-networks/ipsec.md) instead.

## Terminate a Private Network

If you would like to terminate your private network, click 'Network settings' on the private network details page, and click delete network.

## Architecture

For those users interested in the details of the setup behind a private network:

* Your network runs on a **dedicated gateway**, deployed in the POP you select: Frankfurt (EU) or Virginia (US). It is yours alone.
* SIM IPs are **assigned at the carrier**, from the subnet of your network. There is no shared NAT translating a dynamic IP to a static one in between.
* The gateway terminates your connectors. WireGuard and IPSec tunnels land here, and if NAT is enabled it also provides outbound internet access from the public IP of the gateway.
* Because every network sits on its own gateway, the traffic, load or downtime of another customer cannot reach yours.
* There are many details to this setup that we are happy to explain to you. Please consult your account manager for further assistance.