What is a Private Wireless Gateway?

Telnyx’s Private Wireless Gateway service provides a secure, private connection between your network and Telnyx’s network. With our service, you can connect your offices, remote workers, and other devices to the internet with ease.

A Private Wireless Gateway (PWG) is a tool available via the Telnyx portal and APIs that allows you to deploy physical devices, like an IoT device or a handset, to the edge of your corporate network in a highly secure and accessible manner.

This means that you can treat these physical devices similar to any other device that’s connected to your corporate network, like a virtual machine in the cloud or a router in your data center.

This is relevant from a security standpoint because your devices are no longer directly connected to the public internet. While the public internet does not lower the quality of communications from IoT devices, it does make them more vulnerable. Security is the most important obstacle to overcome for any IoT deployment, and huge fleets of SIMs deployed onto the public internet are a major attack vector for bad actors.

Furthermore, because devices connected via a Private Wireless Gateway sit inside your own private IP address space, they are directly accessible. This means that you have more control, as all traffic to and from your SIM can now be passed through your own firewall or data loss prevention (DLP) platform.

Private Wireless Gateways architecture

Private Wireless Gateways are a dedicated piece of infrastructure that you can create via the Telnyx API or portal to ensure that the request flow of your data is entirely siloed from all other customers. PWGs connect to a virtual routing and forwarding (VRF) defined network on top of our MPLS backbone, which allows the SIM to connect directly to a variety of network interfaces. You can think of the VRF-defined network as a sliver of Telnyx’s private IP network.

Virtual Cross Connects (VXC) or Wireguard Interface (Cloud VPNs) can also be connected to your VRF-defined network on top of our MPLS backbone to your corporate network and cloud infrastructure. All interfaces on the same VRF-defined network can see each other allowing traffic to flow from PWGs to Cloud VPNs and/or VXCs which bridge the Telnyx network to your corporate network.

In an upcoming feature release, Public Internet Gateways will enable public internet access on SIMs connected to your VRF-defined network.

The diagram below illustrates how these components fit together to deploy devices to the edge of your corporate network:

Managing Private Wireless Gateways

Private Wireless Gateways can be managed in the Wireless section of the Mission Control Portal.

Each Private Wireless Gateway must be associated with a Network. Networks can be created and managed in the Networking section of the Portal.

To create a Private Wireless Gateway select the Create PWG button, enter the name of your PWG and associate it with one of your Networks.

APN-based IP assignment

Private Wireless Gateways assign IP addresses based on which APN the connected device uses. The two supported APNs and their behavior are:

APN	IP assignment	Description
data.net	Static IP	The SIM retains the same IP address across sessions
data00.telnyx	Dynamic IP	The SIM receives a dynamically assigned IP address each session

To use a static IP address, your device must be configured to connect using the data.net APN. Devices using data00.telnyx will receive a dynamic IP address.

Static IP benefits

Static IP assignment through the data.net APN provides several advantages for Private Wireless Gateway deployments:

• Consistent addressing — devices maintain the same IP across reconnections, simplifying monitoring and asset tracking
• Firewall simplification — static IPs can be added to allowlists and access control rules without frequent updates
• Policy enforcement — network policies can be applied per-device based on stable IP assignments

Migration behavior

If you have active data sessions on the data00.telnyx APN that were previously assigned a static IP, those sessions will automatically reconnect with a dynamic IP. No action is required, but be aware that the IP address may change after reconnection.

Session-level visibility

For active device-initiated data sessions, the Get SIM Card API now returns the APN in use and the assigned IP address. This allows you to programmatically determine which APN a device is connected through and its current IP.

IMS and SIM-level service sessions are excluded from the session data returned by the API. The API enhancement is fully backward compatible with existing integrations.

Beta limitations and upcoming features

Private Wireless Gateway regions

Private Wireless Gateways are currently only available in Ashburn, VA. Additional regions will allow you to create a PWG closer to your SIM deployments, reducing latency when egressing to both the internet and your corporate network. More regions will be available soon.

Customized IP ranges for Private Wireless Gateways

By default, a PWG will get assigned a private IP range of 100.64.199.0/24, allowing you to add 254 concurrently active SIMs to this gateway. This range applies to both static (data.net) and dynamic (data00.telnyx) IP assignments. The ability to customize this IP range is coming soon.

Public Internet Gateways and Private Wireless Gateways

By default, a Private Wireless Gateway does not have any access to the internet. Opening your VRF-defined network out to the internet can be done manually at the moment. Just reach out to our support team using the chat function in the Mission Control Portal. In the future, a Public Internet Gateway interface can be added to your Network to provide public internet access.