Public fixed IP vs private APN: which is more secure for a bank?
Public fixed IP vs private APN: which is more secure for a bank?
What is the difference between a public APN and a private APN?
An APN (Access Point Name) is the door your SIM uses to leave the mobile network and reach the internet or your company network.
- A public APN is a shared door used by millions of phones. You get a shared, hidden address.
- A private APN is a door built for one business. Its devices get fixed addresses, and their traffic goes straight into that business's own network.
Think of it like a block of flats. A public APN is one front door and one postbox for everyone. A public fixed IP is your own front door on the street. A private APN is a locked tunnel from your flat straight into your office, with no street door at all.
The technical detail your network team will ask about
- 4G and 5G gateways. In 4G LTE the APN ends at the PGW (Packet Gateway). In 5G it is called a DNN (Data Network Name), handled by the SMF and UPF. Same idea, new names.
- Public APN (default on most SIMs). Your SIM gets a private address, often from the shared range 100.64.0.0/10 (RFC 6598). The operator then squeezes thousands of SIMs onto a small pool of public IPv4 addresses. This is called CGNAT (Carrier-Grade NAT).
- Public fixed IP SIM. The SIM gets one routable public IPv4 address that never changes. No CGNAT. Your router can accept inbound connections and act as a VPN end point.
- Private APN. SIMs authenticate through RADIUS and get a static IP, often from your own RFC 1918 range (10.x, 172.16.x or 192.168.x). Traffic is handed to your data centre over a secure interconnect such as IPsec. Internet access is off, or forced through your own firewall.
What is CGNAT and why is it bad for business VPNs?
CGNAT is fine for watching videos on your phone. For business systems, it causes four big problems:
- No inbound connections. Nobody can reach your router from outside. It cannot be a VPN responder, a remote desktop target or a monitoring end point.
- A shared exit address. Your traffic leaves from the same IP as hundreds of strangers. If your bank allow lists that address, it has allow listed all of them too. That is a security hole, not a fix.
- Changing ports and mappings. NAT sessions time out and change, so long-lived VPN tunnels drop and have to re-key.
- Double NAT. Your home router does NAT, then the carrier does it again. Many VPN, VoIP and remote desktop tools struggle with this.
GleeSim builds bespoke connectivity without CGNAT, so every SIM gets a real, fixed public IPv4 address that belongs to you.
Which ports does IPsec need on a mobile SIM? (UDP 500 and 4500)
IPsec needs UDP 500 for the IKE handshake and UDP 4500 for NAT traversal. On a non-NAT path it also uses ESP (IP protocol 50). If the mobile network filters any of these, or the SIM sits behind CGNAT, your tunnel fails or keeps dropping.
In simple words: a VPN tunnel is a secret phone call between two buildings. Both sides need a phone number that works, and the line must not be cut. CGNAT takes away your number. Port filtering cuts the line.
| Protocol / port | What it does | What breaks without it |
|---|---|---|
| UDP 500 (IKE / IKEv2) | Both ends agree keys and prove who they are | Phase 1 never completes, so no tunnel |
| UDP 4500 (NAT-T) | Wraps ESP in UDP when NAT is in the path | Tunnel builds then drops, or passes no traffic |
| ESP (IP protocol 50) | Carries the encrypted data with no NAT | Data cannot flow on a clean public path |
Can I run a site-to-site VPN over a 5G fixed IP SIM?
Yes. GleeSim's bespoke solution can be enabled to establish a site-to-site IPsec VPN tunnel into your network, with no restrictions or filtering on inbound and outbound VPN traffic, including UDP 500 and UDP 4500. Because there is no CGNAT, you get:
- A stable peer address. Put the SIM's fixed IPv4 in your remote peer field and firewall allow list once. It never changes.
- Either side can start the tunnel. Your data centre can initiate, not only the remote router. That helps always-on links recover after Dead Peer Detection.
- Clean IKE identities. Peers can identify by IP address, with nothing rewriting it in the middle.
- Native ESP or NAT-T, whichever the path needs, with nothing in the carrier network blocking either.
Engineer's tip: keep NAT-T switched on even with a public IP, because home routers often add their own NAT. For a bank-grade policy, use IKEv2, AES-256-GCM, a strong DH group (19, 20 or 21) and certificates rather than pre-shared keys. Business routers such as Teltonika and Peplink support all of these.
Need a site-to-site VPN that just works? Tell us your peer, your routers and your sites, and GleeSim will design it with you. Send us your requirements →
Public fixed IP vs private APN: which is more secure for a banking Sector?
For banks the real question is not "which is faster?" It is "which gives attackers the least to aim at, and which can we prove to an auditor?" Here is how the three SIM types compare on cyber security.
| What matters | Standard SIM (public APN, CGNAT) | Public fixed IPv4 SIM | Private APN SIM |
|---|---|---|---|
| Your own address? | No, shared with strangers | Yes, one fixed public IPv4 | Yes, one fixed private IP |
| Visible on the internet? | Hidden, but shares an exit | Yes, so firewall rules matter | No, invisible to internet scans |
| Inbound connections | Blocked | Allowed, filtered by your rules | Only from your own network |
| IP allow listing at the bank | Unsafe: allow lists everyone on that exit | Strong: one address, one device | Strongest: arrives on a private link |
| IPsec / site-to-site VPN | Unreliable, no inbound | Reliable, UDP 500/4500 open | Link is private; IPsec optional on top |
| Attack surface | Shared, outside your control | Small: one IP, locked down | Smallest: no public route in |
| Port scans and DDoS | No control | Mitigated by closed ports and rules | Practically none from the internet |
| Logging and control | Operator only | Your router and firewall | Your firewall, DNS and logs, end to end |
| Best for | Browsing and email | Home workers, engineers, developers, site-to-site VPN | Branches, ATMs, kiosks, payment kit |
A public fixed IP is your own front door with a very good lock. A private APN means there is no front door on the street at all.
So which should a bank choose?
- Public fixed IPv4 SIM when people need to reach systems that already allow list by IP: VPN concentrators, jump hosts, admin portals and SaaS tools. Quick to deploy, works with the VPN kit you already run.
- Private APN when devices should never be reachable from the internet, or every packet must pass your own firewall first.
- Both together for the strongest design: private APN for the device estate, fixed public IP for staff remote access, each in its own security zone.
GleeSim's EE Unlimited 5G Fixed IP SIM includes a public static IPv4 address, private APN and firewall rule management from a simple online portal, so you decide exactly what gets in.
Does a bank need a fixed IP SIM for operational resilience?
UK regulators expect firms to keep important business services running through disruption. Under the FCA's operational resilience rules, firms had to be able to stay within their impact tolerances by 31 March 2025. A remote access path that dies when a home broadband line fails is exactly the weak link an auditor will spot.
Security guidance points the same way. The NCSC's zero trust principles ask you to know every device and check every connection. A fixed IP or private APN gives every remote device a known, fixed identity at the network edge, which makes that far easier to enforce.
In simple words: banks look after other people's money and secrets. They must know exactly who is knocking at the door, every single time, and they must keep working when something breaks.
Who needs a static IP SIM: remote workers, engineers, developers and IT technicians
| Remote role | What they connect to | Best GleeSim setup |
|---|---|---|
| Home-based staff (operations, compliance, contact centre) | Core banking apps through a VPN that allowlists by IP | Public fixed IPv4 SIM in a 5G router |
| Network and infrastructure engineers | Out-of-band access to firewalls, switches and console servers when the main WAN is down | Fixed IP SIM in the OOB router, site-to-site IPsec |
| Developers and DevOps | Staging servers, Git and cloud consoles that only accept allowlisted IPs | Public fixed IPv4 SIM, same address every day |
| IT technicians and field engineers | Branches, ATMs and kiosks on site, UK and abroad | Multi-network fixed IP SIM (UK, EU, USA) |
| Branch, ATM and payment estate | Always-on links that must never face the internet | Private APN into your data centre |
| Business continuity | Failover when a fixed line fails | Unlimited fixed IP SIM as 5G backup WAN |
Can one SIM use Three, O2 and Vodafone with the same fixed IP?
Yes. GleeSim supplies fixed IP connectivity on a single network or on one multi-network SIM that can use Three, O2 and Vodafone in the UK. The same tariff can cover the whole EU and the USA, so travelling engineers keep the same fixed IP abroad and your allowlist never changes.
In simple words: a single-network SIM talks to one family of phone masts. A multi-network SIM can talk to three, so if one is weak where you are, it uses another.
Choose the data size that fits the job:
- 2GB for out-of-band management, alarms and light admin access
- 20GB for a daily VPN user doing email, remote desktop and admin tools
- 40GB for heavier remote work, video calls and file transfers
- Unlimited for full-time home workers, developers and backup WAN links
How much does a fixed IP 5G SIM cost in the UK?
Our most popular plan is the EE Unlimited 5G Fixed IP SIM. Prices exclude VAT.
| Term | Price per month (excl. VAT) |
|---|---|
| 24 months | £89.99 |
| 12 months | £99.99 |
| 3 months (90-day rolling, 30 days' notice) | £110.00 |
Includes unlimited 5G data on EE, a public fixed IPv4 address, private APN and firewall rule management. A 500GB a month fair usage policy applies.
Order the EE Unlimited 5G Fixed IP SIM →
Bespoke tariffs for banks and mission-critical teams
For banks and mission-critical users, GleeSim designs bespoke solutions that are not listed on our website. These can include:
- Fixed public IPv4 with no CGNAT
- Site-to-site IPsec VPN into your network, with no filtering of inbound or outbound VPN traffic, including UDP 500 and 4500
- Multi-network SIMs on Three, O2 and Vodafone, covering the UK, EU and USA on one tariff
- Private APN options
As an example, a bespoke multi-network fixed IP tariff ranges from £135 to £145 a month. Prices exclude VAT, delivery and processing charges. Your final price depends on data size, number of SIMs, networks and term.
Why UK businesses choose GleeSim for fixed IP connectivity
GleeSim is a UK connectivity provider based in Livingston, Scotland, trading as GleeSim Connect (Premier Mobile Solutions GB Ltd). The GleeSim family started in 2009 and the team brings 30 years of combined telecoms experience.
| "But..." | The GleeSim answer |
|---|---|
| "We don't want to be locked into a long contract." | Choose 3, 12 or 24 months. Most suppliers lock you in for years. We would rather earn your loyalty with service. |
| "Will it work where our people live?" | Send us their postcodes. We check which network is strongest at each one before you buy. |
| "Our engineers travel." | Multi-network SIMs cover the UK, EU and USA on the same tariff, with the same fixed IP. |
| "Our VPN is fussy." | No CGNAT, no filtering on UDP 500 or 4500. Your tunnel sees a clean public address. |
| "Big networks won't build what we need." | That is exactly what we do. Small enough to care, big enough to deliver. |
How to get a fixed IP SIM for your bank in 5 steps
- Map your users. List who needs remote access (home staff, engineers, developers, technicians, devices) and what each one connects to.
- Pick the path. Public fixed IPv4 for people reaching allow listed systems. Private APN for devices that must stay off the internet. Or both.
- Choose network and data. EE single network, or multi-network across Three, O2 and Vodafone. Then 2GB, 20GB, 40GB or unlimited.
- Set up the tunnel. Add the SIM's fixed IP to your VPN peer config and firewall allow list. Allow UDP 500, UDP 4500 and ESP. Test failover.
- Go live and scale. Start with one SIM on a 3-month term, prove it works, then roll out across your team.
Frequently asked questions
Is a private APN safer than a public fixed IP?
A private APN has a smaller attack surface because devices have no public route from the internet. A public fixed IP is still very secure when firewall rules allow only your known addresses. Many banks use both: private APN for devices and public fixed IP for staff remote access.
Does a fixed IP SIM work with IPsec VPN?
Yes. A fixed IP SIM without CGNAT gives your router a stable public address that can start or answer IPsec tunnels. GleeSim's bespoke solution leaves UDP 500 and UDP 4500 unfiltered, inbound and outbound, so IKE and NAT-T work as designed.
Why does my VPN keep dropping on a normal 4G or 5G SIM?
Normal SIMs sit behind CGNAT, which shares one public address between many users and changes port mappings over time. VPN tunnels lose their session when those mappings change. A fixed IP SIM removes CGNAT, so the tunnel stays up.
Can I get a fixed IP SIM without CGNAT in the UK?
Yes. GleeSim supplies fixed IP SIMs with a real public IPv4 address and no CGNAT, on EE as a single network or on multi-network SIMs using Three, O2 and Vodafone. Bespoke builds are available for banks and mission-critical teams.
Can one SIM work in the UK, EU and USA with the same fixed IP?
Yes. GleeSim's multi-network fixed IP SIMs use Three, O2 and Vodafone in the UK and can cover the whole EU and the USA on the same tariff. Your fixed IP stays the same, so your allow list does not change when engineers travel.
What contract lengths does GleeSim offer for fixed IP SIMs?
GleeSim offers 3, 12 and 24 month terms. The EE Unlimited 5G Fixed IP SIM costs £89.99 a month on 24 months, £99.99 on 12 months and £110.00 on the 3-month rolling plan, all excluding VAT.
Stop sharing your address with strangers. Own yours.
A normal SIM hides you behind a shared address. That is fine for browsing, but not for a bank. A fixed IP 5G SIM without CGNAT gives your remote staff and engineers one known address, clean IPsec tunnels and a firewall you control. A private APN keeps your devices off the internet altogether.
GleeSim gives you both, on a single network or across Three, O2 and Vodafone, covering the UK, EU and USA, on 3, 12 or 24 month terms.