Hubbry Logo
Access Point NameAccess Point NameMain
Open search
Access Point Name
Community hub
Access Point Name
logo
7 pages, 0 posts
0 subscribers
Be the first to start a discussion here.
Be the first to start a discussion here.
Access Point Name
Access Point Name
from Wikipedia

An Access Point Name (APN) is the name of a gateway[1] between a mobile network (GSM, GPRS, 3G, 4G and 5G) and another computer network, frequently the public Internet.[2]

A mobile device making a data connection must be configured with an APN to present to the carrier. The carrier will then examine this identifier to determine what type of network connection should be created, for example: which IP addresses should be assigned to the wireless device, which security methods should be used, and how, or if, the device should be connected to some private customer network.[3] APN settings connect the device to the internet via mobile carrier’s cellular network. These settings include IP addresses, gateways, and other technical details that enable the device to access the internet and send MMS.

More specifically, the APN identifies the packet data network (PDN) that a mobile data user wants to communicate with. In addition to identifying a PDN, an Access Point Name may also be used to define the type of service(s), (e.g. connection to a Wireless Application Protocol (WAP) server and access to Multimedia Messaging Service (MMS)) that is provided by the packet data network. APN is used in 3GPP data access networks, e.g. General Packet Radio Service (GPRS) and evolved by packet core (EPC).

Typically, APN settings are configured automatically when SIM is inserted or eSIM is activated.[4]

APN terms

[edit]

Below are some terms of the APN settings, explaining what each setting stands for:

APN
The APN address of your (mobile network operator) MNOs.
MMSC
The MMS message link.
Proxy
A proxy server’s address. Often, this area is left blank.
MCC (Mobile Country Code)
A three-digit code that is used for the country’s identity.
MNC (Mobile Network Code)
The mobile network operator is represented by a number code.

Structure of an APN

[edit]
Access Point Name structure

A structured APN consists of two parts[5] as shown in the accompanying figure.

  • Network Identifier: Defines the external network to which the Gateway GPRS Support Node (GGSN) is connected. Optionally, it may also include the service requested by the user. This part of the APN is mandatory
  • Operator Identifier: Defines the specific operator's packet domain network in which the GGSN is located. This part of the APN is optional. The MCC is the mobile country code and the MNC is the mobile network code which together uniquely identify a mobile network operator.

Examples of APN are:

  • three.co.uk (Note: This example APN uses a domain name from the DNS, three.co.uk, that belongs to the operator)
  • internet.t-mobile
  • internet.mnc012.mcc345.gprs
  • rcomnet.mnc015.mcc405.gprs
  • internet (Note: This APN example does not contain an operator)
  • NXTGENPHONE (Note: Does not contain an operator, however in practice it is AT&T Mobility's LTE APN)
  • VZWINTERNET (Note: No operator, but the APN name clearly identifies Verizon)
  • mobitel (Note: APN name clearly identifies the operator SLTMobitel)
  • jionet (Note: APN name clearly identifies the operator Jio)
  • tethering.dish.com (Tethering service by Dish Network)

LTE networks use APN-FQDN format, which differs from the 2G/3G format described above as follows. "apn.epc." is inserted before "mnc⟨MNC⟩", and the ".gprs" at the end becomes ".3gppnetwork.org" [6]

For example: the 2G/3G internet.mnc012.mcc345.gprs becomes internet.apn.epc.mnc012.mcc345.3gppnetwork.org .

KPN Incident

[edit]

In 2023, an incident was discovered where choosing the advancedinternet APN from the Dutch ISP KPN drained the battery of smartphones significantly faster. This APN was designed to give internet access without a firewall and public IP addresses.[7]

References

[edit]
[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia
from Grokipedia
An Access Point Name (APN) is a configurable label that identifies a gateway—such as a Gateway GPRS Support Node (GGSN) in GPRS/ networks or a Packet Data Network Gateway (PGW) in LTE (and non-standalone ) systems—between a mobile network and an external packet data network; in standalone , the equivalent is the Data Network Name (DNN) identifying gateways like the Session Management Function (SMF) and User Plane Function (UPF), enabling (UE) to establish packet data protocol (PDP) contexts in 2G/ networks, packet data network (PDN) connections in , or protocol data unit (PDU) sessions in for services like or multimedia messaging. The APN structure follows domain naming conventions, consisting of a mandatory Network Identifier (APN-NI) that specifies the external network or service (e.g., "") and an optional Operator Identifier (APN-OI) that denotes the (PLMN) in the format "mnc.mcc.gprs", ensuring global uniqueness and facilitating DNS-based resolution to the gateway's for inter-operator . This design supports restricted labels to avoid conflicts (e.g., no starting with "rac" or ending with ".gprs" in the NI) and allows for special cases like wildcard APNs ("*") for flexible access or emergency APNs for IMS-based calls. In standalone networks, APN is superseded by the Data Network Name (DNN), which serves a similar purpose in establishing PDU sessions. In practice, APNs are provisioned by mobile network operators and configured manually or automatically on devices via settings menus—such as under "Mobile Networks > Access Point Names" on Android or "Cellular > Cellular Data Options" on —to define parameters like type, assignment, and proxy details, determining the type of connectivity (e.g., public internet, private VPN, or MMS). Defined in specifications since Release 1999, APNs are essential for packet-switched services across to networks, with the concept evolving to DNN in and ongoing updates to accommodate non-3GPP access and enhanced .

Introduction

Definition and Purpose

An Access Point Name (APN) serves as a configurable gateway that connects a mobile network—such as those based on , GPRS, , (EPS), or —to external packet data networks (PDNs), including the public . In this role, the APN acts as a logical reference to a gateway node, such as the Gateway GPRS Support Node (GGSN) in GPRS or the Packet Data Network Gateway (P-GW) in the Evolved Packet System (EPS), enabling (UE) like smartphones or IoT devices to establish data sessions. This gateway functionality is resolved via DNS translation from the APN to the actual of the gateway, supporting seamless connectivity across different network generations. The primary purpose of an APN is to specify critical parameters for data connectivity, including IP address allocation (IPv4 or ), security protocols for authentication and encryption, and the type of connection established for the UE. By defining these elements, the APN ensures that data traffic is routed appropriately to the intended PDN, while also facilitating features like inter-PLMN and services. In 3GPP standards, the APN functions as a logical identifier for a PDN, distinct from physical gateways, allowing operators to manage multiple virtual connections over shared infrastructure without altering hardware. APNs enable a range of services by directing UE to specific PDNs tailored to the . For instance, a general APN, such as "", connects users to the public web with standard IP allocation and basic security. Specialized APNs support (MMS) for sending rich media over cellular networks or corporate VPNs for secure, private access to enterprise resources, each with customized mechanisms and connection profiles.

Historical Development

The Access Point Name (APN) originated in the late 1990s as a key component of the General Packet Radio Service (GPRS), which extended the Global System for Mobile Communications (GSM) to support packet-switched data services. Introduced to enable mobile devices to connect to external packet data networks via the Gateway GPRS Support Node (GGSN), the APN served as a logical identifier for routing user data from the Serving GPRS Support Node (SGSN) to specific external networks or services. This enhancement addressed the limitations of circuit-switched GSM by facilitating always-on data connectivity, with the APN allowing differentiation of access points for services like internet or corporate intranets. Standardization of the APN began under the 3rd Generation Partnership Project () with Release 97 in 1998, where it was defined in specifications such as TS 09.60 for interfaces. The APN was formalized as a reference to the GGSN in the GPRS backbone, comprising a network identifier for the external network and an optional operator identifier for the (PLMN), with a maximum length of 100 octets following DNS label syntax. Subsequent releases built on this foundation: Release 99 (1999) integrated APN support into Universal Mobile Telecommunications System () for , enhancing it for higher-speed packet data; Release 8 (2008) adapted it for Long-Term Evolution (LTE) and the Evolved Packet Core (EPC), where APN selection influenced Packet Data Network Gateway (PGW) routing. A pivotal milestone was the inclusion of APN in TS 23.003, which standardized numbering and identification, including APN as a core element for network selection across generations. In LTE and beyond, the APN evolved from a simple string identifier to support (FQDN) resolution for improved DNS-based selection of core network elements like the PGW, as specified in TS 23.003 subclause 19.4.3, using formats such as .apn.epc.mnc.mcc.3gppnetwork.org to enable efficient inter-operator roaming and load balancing. With the advent of New Radio (NR) in Release 15 (2018), the conceptual successor to APN—the Data Network Name (DNN)—emerged in the 5G System (5GS) to reference data networks and support features like network slicing via the Session Management Function (SMF) and User Plane Function (UPF). However, APN was retained for , allowing EPS (Evolved Packet System) devices to interoperate with 5GS through mapping DNN to APN equivalents, ensuring seamless evolution without disrupting legacy deployments.

Technical Specifications

Structure and Format

The Access Point Name (APN) is structured as a (FQDN)-like string, comprising a mandatory APN Network Identifier (APN-NI) optionally followed by an APN Operator Identifier (APN-OI), with components separated by dots. The APN-NI specifies the external packet data network (PDN) or service, such as "" for general , while the APN-OI identifies the operator's network using the (MCC) and Mobile Network Code (MNC) in the format "mnc.mcc.gprs", for example "mnc012.mcc345.gprs" where MNC 12 is padded to three digits. Each within the APN string adheres to conventions, consisting of alphanumeric characters (A-Z, a-z, 0-9) and hyphens (-), with a maximum of 63 octets per label; labels must begin and end with an alphanumeric character and comply with IETF RFC 2181 for clarification on syntax, as well as RFC 1035 and RFC 1123 for encoding. The overall APN is encoded as a sequence of one-octet length fields followed by the corresponding ASCII characters for each label, without zero-length termination, and the total length is limited to 100 octets. Validation rules for APN strings enforce syntactic integrity and prevent conflicts with network elements: the APN-NI cannot start with reserved prefixes like "rac", "lac", "sgsn", "rnc", or "nri"; cannot end in ".gprs"; and must not include wildcards such as "*", except in the special wildcard APN case; additionally, the full APN is case-insensitive. In LTE and 5G networks, the APN is mapped to an APN Fully Qualified Domain Name (APN-FQDN) for internal DNS procedures, following the format ".apn.epc.mnc.mcc.3gppnetwork.org", such as "internet.apn.epc.mnc012.mcc345.3gppnetwork.org", which replaces the ".gprs" suffix with ".3gppnetwork.org" and inserts "apn.epc." to facilitate gateway selection in the Evolved Packet Core (EPC) or 5G Core.
ComponentDescriptionExampleConstraints
APN-NINetwork Identifier for PDN/service"internet"1+ labels, max 63 octets; alphanumeric + hyphens; no reserved prefixes/suffixes
APN-OIOperator Identifier for PLMN"mnc012.mcc345.gprs"Fixed format with 3-digit padded MNC/MCC; optional
Full APNCombined string"internet.mnc012.mcc345.gprs"Max 100 octets total; case-insensitive; no wildcards
Several key terms are integral to the configuration and operation of Access Point Names (APNs) in mobile networks. The serves as the central network element in MMS APNs, responsible for receiving, storing, and forwarding multimedia messages between and external networks, ensuring reliable delivery of content like images and videos. The proxy parameter in APN settings specifies the of the (WAP) gateway, which acts as an intermediary to convert mobile data requests into HTTP-compatible formats for accessing WAP services over packet-switched connections. The Mobile Country Code (MCC) is a three-digit numeric identifier, aligned with the standard, that uniquely denotes the country of origin for a mobile subscription or (PLMN). Complementing this, the Mobile Network Code (MNC) consists of two or three digits to specify the individual within the country indicated by the MCC, forming the PLMN identifier used in APN formats for network selection and support. As noted in APN structure, the operator identifier incorporates the MCC and MNC to reference the serving network. In APN deployments, the Packet Data Network (PDN) Gateway (PGW) functions as the core network endpoint in (EPS) systems, anchoring user plane traffic and interfacing with external data networks to fulfill the connectivity defined by the APN. In systems, the Session Management Function (SMF) assumes this endpoint role, managing (PDU) sessions— the equivalent of PDP contexts—while allocating IP addresses, enforcing policies, and selecting user plane functions for APN-mapped Data Network Names (DNNs). APN profiles encapsulate subscriber-specific configurations for (QoS) parameters, such as aggregate maximum bit rates (AMBR) and bearer-level guarantees, alongside charging rules that enable flow-based billing and policy enforcement within the Policy and Charging Control (PCC) architecture. APNs are categorized into public APNs, which grant broad access to the public for general services, and private or corporate APNs, which restrict connectivity to dedicated enterprise networks or intranets, often incorporating dedicated IP addressing and enhanced for business applications.

Configuration and Usage

On Mobile Devices

On mobile devices, users can manually configure the Access Point Name (APN) to establish packet connectivity, particularly when automatic setup fails or for custom network access. This involves entering the APN string provided by the carrier, along with optional username and password credentials if is required beyond SIM-based methods. APN types, such as default for general or supplementary for services like multimedia messaging (MMS), are specified during setup to route traffic appropriately. For Android devices, users navigate to Settings > Network & > Mobile Network > Advanced > Access Point Names, tap the "+" icon to add a new entry, and input details like the APN (e.g., "" for many carriers), bearer type (e.g., LTE), and type (none, PAP, or CHAP); for many carriers, the username and password fields should be left empty unless otherwise required by the carrier. On iOS devices, the process requires going to Settings > Cellular > Cellular Network (or Mobile > Mobile Options > Network), where fields for APN, username, and password under sections like Cellular or MMS appear if the carrier permits ; changes save automatically upon exit. Automatic provisioning simplifies APN setup by delivering configurations over-the-air (OTA) without user intervention. This can occur via the SIM toolkit, where the SIM card pushes settings upon insertion, or through carrier-specific profiles downloaded during device activation. For eSIM-enabled devices, profiles containing APN details are remotely provisioned and installed, often via QR code scanning or app-based downloads, enabling seamless switching between carriers. The Open Mobile Alliance Device Management (OMA-DM) protocol facilitates remote APN updates by allowing servers to modify connectivity settings in the device's management tree, such as adding or replacing APN entries under nodes like ./settings/wap_settings, typically with user confirmation for security. In iOS 16 and later, carriers supporting auto-configuration populate APN fields automatically upon SIM or eSIM detection. Troubleshooting APN issues begins with verifying settings against official carrier lists, available on provider websites or support portals, to ensure the APN string, protocol (e.g., IPv4 or ), and other parameters match exactly. Incorrect configurations often result in failed data access, such as no connectivity or inability to send MMS, as the device cannot establish a Packet Data Protocol (PDP) context or PDN connection with the network's gateway. Resetting to default APN via device menus (e.g., Android's three-dot menu in Access Point Names or iOS's Reset Settings option) and restarting the device can resolve mismatches, but persistent problems may require contacting the carrier for updated profiles. Modern smartphones handle APN configurations to support IPv4/IPv6 dual-stack connectivity, allowing devices to request both address types in a single PDN connection for backward compatibility and future-proofing. According to 3GPP specifications, the UE requests a PDP type of "IPv4v6" during context activation, enabling the network to allocate an IPv4 address and an prefix if supported by the APN; this dual-stack bearer ensures seamless traffic routing without separate connections. Device variations arise in implementation: Android uses CarrierConfig to prioritize dual-stack based on carrier XML updates, while iOS defaults to dual-stack if the carrier profile specifies it, falling back to IPv4-only if IPv6 is unavailable.

By Network Operators

Network operators are responsible for defining and maintaining Access Point Name (APN) profiles within their core network infrastructure, primarily through the Home Subscriber Server (HSS), which stores subscriber-specific including subscribed APNs, authentication parameters, and associated services. The HSS provides this information to mobility management entities like the Mobility Management Entity (MME) or Serving GPRS Support Node (SGSN) during attachment, enabling selection of appropriate APNs for packet network (PDN) connectivity. For authentication, especially in non- access scenarios, the 3GPP Authentication, Authorization, and Accounting (AAA) server interacts with the HSS via the SWx interface to retrieve and validate APN-related subscription , ensuring only authorized APNs are permitted. Operators also assign pools per APN in the Packet Data Network Gateway (PGW) or Gateway GPRS Support Node (GGSN), allocating addresses dynamically from these pools upon PDN connection establishment to support subscriber traffic routing. Policies such as bandwidth limits, Quality of Service (QoS) profiles, and access restrictions are configured per APN, often enforced through the Policy and Charging Rules Function (PCRF) to differentiate services like general from enterprise VPNs. In deployment, operators support multiple APNs per subscriber to enable simultaneous or selective PDN connections tailored to specific use cases, such as one APN for internet access and another for IP Multimedia Subsystem (IMS) services like voice over LTE. This is achieved by integrating APNs with core network elements: in 3G networks, the SGSN uses the APN to select and route to the appropriate GGSN, which connects to external networks like the internet or corporate intranets; in 4G/LTE, the Serving Gateway (SGW) forwards the request to the PGW based on the APN for IP-CAN bearer establishment. The APN-Oi (Operator Identifier) ensures routing to the home operator's gateway in roaming scenarios, preventing unauthorized external PDN connections. For example, major operators deploy public APNs like "internet" for general data access, while AT&T uses "phone" or "NXTGENPHONE" for its broadband services, allowing subscribers to connect to distinct IP domains with predefined policies. In 5G networks, the APN concept evolves into the Data Network Name (DNN), which operators associate with network slices via Single Network Slice Selection Assistance Information (S-NSSAI), enabling customized resource allocation for applications like ultra-reliable low-latency communications. Operators manage APN-based operations using standardized interfaces, notably the Gx reference point defined in 3GPP TS 29.212, which allows the PCRF to provision dynamic charging and policy rules to the PGW/GGSN based on the APN. This interface supports APN-specific charging through Accounting-Request messages in Diameter protocol, tracking session usage for billing while enforcing rules like data volume limits or priority levels. Although 3GPP TS 29.061 primarily addresses Gi/Sgi interworking for GPRS, it references Gx for policy control extensions, ensuring consistent APN handling across generations. These tools enable operators to monitor and adjust APN deployments in real-time, optimizing network efficiency and subscriber experience without manual reconfiguration.

Security and Privacy

Authentication Mechanisms

Authentication mechanisms for Access Point Name (APN) access primarily rely on protocols that verify subscriber identity and authorize network connectivity, ensuring secure attachment to specific data networks in 3GPP systems. In earlier generations like GPRS/, simple authentication methods such as (PAP) and (CHAP) are used during Packet Data Protocol (PDP) context activation, where the terminal equipment (TE) authenticates to the mobile termination (MT) over the AT interface. These methods transmit credentials in a straightforward manner (PAP) or via a challenge-response (CHAP) to prevent unauthorized APN access, though they are typically supplemented by subscriber profile checks. For more robust SIM-based authentication in 3G/4G networks, (EAP) variants like EAP-AKA and EAP-SIM are employed, particularly in interworking scenarios with non-3GPP accesses such as WLAN. EAP-AKA leverages the Authentication and Key Agreement (AKA) procedure using the Universal Subscriber Identity Module (USIM) to mutually authenticate the (UE) and network, deriving session keys for . EAP-SIM, similarly, uses the Subscriber Identity Module (SIM) for GSM-based authentication, enabling key distribution while binding the identity to the APN. In the Evolved Packet System (EPS) of LTE, the primary mechanism is EPS-AKA, an evolution of AKA, which establishes an EPS security context with keys like K_ASME derived from cipher key (CK) and integrity key (IK) for NAS and access stratum protection. The APN plays a critical role in by mapping to the subscriber's profile stored in the Home Location Register (HLR) or Home Subscriber Server (HSS), where the network verifies access rights for the requested APN during PDP or EPS bearer activation. This includes checking allowed APNs against the subscription data retrieved via or MAP protocols. The APN Operator Identifier (APN-OI), a mandatory component in full APN formats, enables operator-specific verification by distinguishing the home network's realm, ensuring the request aligns with the subscriber's home public land mobile network (HPLMN). For enhanced security in non-3GPP accesses, tunnels secure the connection over the S2b interface to the evolved Packet Data Gateway (ePDG), while TLS may protect secondary exchanges. In systems, where the Data Network Name (DNN) succeeds the APN, authentication enhancements integrate the Subscription Concealed Identifier (SUCI) to preserve during procedures. SUCI conceals the Subscription Permanent Identifier (SUPI) using integrated encryption scheme (ECIES) or similar, preventing exposure in initial registration and PDU session requests that include the DNN. Primary employs -AKA or EAP-AKA', deriving anchor keys like K_SEAF via the Authentication Server Function (AUSF) and Unified Data Management (UDM), with the DNN influencing session-specific authorization while SUCI ensures concealed identity transmission. These mechanisms are detailed in TS 33.401 for EPS security, including key derivation processes that support APN-mapped contexts.

Vulnerabilities and Risks

One significant vulnerability in APN usage involves spoofing attacks, where malicious actors trick users into altering their device's APN settings via , often through messages containing deceptive configuration profiles. This enables man-in-the-middle (MITM) attacks by redirecting traffic through an attacker-controlled proxy, allowing interception of sensitive data such as emails or credentials without the user's awareness. Default public APNs, commonly used for general , typically assign dynamic private IP addresses behind (CGNAT), sharing public IPs among multiple devices, without dedicated firewalls per device, still increasing susceptibility to unauthorized access, scanning of shared IPs, or exploitation by external threats. In contrast, private APNs provide isolation through dedicated IP assignments and operator-managed , mitigating such exposures. Privacy risks arise from the assignment of IP addresses via APNs, which can inadvertently reveal approximate user locations through geolocation , as mobile IPs are often tied to regional gateways or cell tower proximity. Additionally, mobile operators maintain logs of APN connections in their , including timestamps, data volumes, and associated subscriber identifiers, facilitating potential tracking of user behavior across sessions if accessed by authorities or breached. Legacy APNs in older network generations, such as and , often lack , relying on weak or clear-text protocols that enable and data interception, even as and systems inherit some compatibility risks. scenarios amplify these issues, as devices connect to foreign APNs with varying standards, potentially exposing traffic to untrusted networks prone to via signaling protocols. Unsecured APNs can lead to battery drain through denial-of-service (DoS) attacks, where malformed configurations or excessive signaling force devices into repeated reconnection attempts, consuming power without productive data transfer. In 5G environments, where APNs evolve into Data Network Names (DNNs) integrated with network slicing, misconfigurations may allow cross-slice interference, enabling unauthorized access or resource exhaustion across virtual networks.

Notable Incidents

KPN Battery Drain Incident

Starting in 2022, Dutch telecommunications provider faced user reports of excessive battery drain on mobile devices associated with the "advancedinternet" Access Point Name (APN), among users seeking enhanced connectivity options like public IP addresses. This APN was designed to offer direct without the limitations of the standard "internet" APN, but it inadvertently exposed devices to unsolicited network traffic due to the absence of protective measures. The issue was identified through investigations by the online community. The root cause stemmed from the "advancedinternet" APN's configuration, which eliminated (CGNAT) to assign public IP addresses directly to devices, bypassing KPN's carrier firewall. Without this filtering, smartphones received constant inbound probes and packets from the open , forcing them to handle increased network activity even in idle states. This led to heightened CPU usage, accelerated data consumption, and rapid battery depletion—users on devices like the FE noted battery life dropping to around 6 hours. KPN responded promptly to complaints by recommending users revert to the "internet" APN, which reinstates CGNAT and firewall protections to mitigate the issue. The provider issued guidance through its community forums and support channels, emphasizing the trade-offs of the advanced option. Sometime after mid-2023, KPN discontinued the "advancedinternet" APN for new subscriptions while preserving it for certain legacy subscriptions; as of 2025, it remains available for select older accounts. The event served as a case study in APN-related operational challenges, illustrating how configuration changes prioritizing performance can introduce unintended security gaps without user awareness. It prompted and peer operators to reassess APN deployments, reinforcing the need for transparent notifications, robust default protections, and testing for compatibility across device ecosystems before rollout.

References

Add your contribution
Related Hubs
User Avatar
No comments yet.