Definition
Intranet refers to an isolated architecture that confines IoT devices and business systems within a private network (Intranet), separated from the public network or secured via security gateways, VPN, subnets to achieve data security and compliance. Intranets are commonly used in industrial control systems, enterprise IoT, Device Management Platforms, and other scenarios, ensuring that sensitive data stays within the domain and meeting IEC 62443 compliance requirements. Intranets can include wired LANs, private wireless networks, and cellular private networks (APN), among others.
Technical Features and Architecture
The internal network technical architecture includes: Network isolation — dividing internal network boundaries through physical separation, VLANs, subnets , and firewalls; Access control — dedicated APN, VPN , whitelists, strong authentication , etc.; Data flow — internal network devices communicate only with internal platforms or the public network via gateways, data backhaul can be through dedicated lines or encrypted tunnels; Cross-border extension — the internal networks of cross-border enterprises can connect to branches in multiple countries via SD-WAN or VPN, and IoT devices access the internal network via local APNs. Combined with platform integration , the internal network platform can interface with public network business systems in isolation.
In industrial control scenarios, the internal network forms the basis of IEC 62443 zones and conduit models, ensuring the separation of industrial control systems from office networks and the Internet.
Application in IoT and cross-border scenarios
Internal networks are widely applied to: Industrial control systems — isolating internal networks of industrial control devices in substations, microgrids , charging stations ; Enterprise IoT — private deployment of device management systems and logistics platforms ; Cross-border branches — interconnecting internal networks of multinational enterprise branches in different countries, with IoT devices accessing via local networks; Data compliance — meeting GDPR and data localization requirements, sensitive data restricted within the internal network. Cross-border industrial control and cross-border enterprise IoT both rely on the internal network architecture to achieve security isolation and compliance.
SimtoLink provides dedicated APN, VPN, and other capabilities for internal IoT devices, helping secure cross-border internal network connections.
A private access network and the office LAN are not the same network
In international IoT, an intranet is a private connectivity domain with a boundary. Device addresses are not exposed directly on the public network, and business systems accept only traffic the boundary allows. It may be built with a private access point, an encrypted tunnel, a site-to-site line, or a combination. Address planning, name resolution, and the direction of access inside the boundary belong to the intranet design. Whether cellular attach succeeded is a fact on the operator side. A SIM that can register on a foreign network has only obtained a radio bearer. It has not entered the enterprise intranet.
When the network is extended to a branch abroad, set the address ranges, the country of the exit, and the allowed destination ports first. Field devices should reach the collection service in their own domain, rather than each resolving to a public address in a different country. A tunnel can cross intermediate operators, but routing at both ends should keep office internet traffic and device reporting traffic out of the same policy. An industrial zone and an office zone may both be called an intranet in a broad sense, and they should still be segmented. Otherwise a maintenance PC can reach controllers at will. If the SIM can lock the access-point name, write that name when the SIM is opened, so the terminal does not switch itself to a public access point after it roams.
Private addresses colliding inside a cross-border tunnel
Both ends using a common private address range is the typical failure when an intranet is built across a border. The tunnel comes up, and the device reaches a different host at the same address on the far side, or the route oscillates. It looks like intermittent dropout. A capture shows replies from the wrong subnet. Another failure is encryption without direction control: an overseas terminal can open a connection into the domestic management network, and domestic staff can reach the site back from any exit. Encryption is not isolation.
Some teams also treat a whitelist of the terminal's public address as an intranet. After roaming changes the address, the whitelist fails, and someone temporarily opens it to allow all. Use a stable tunnel identity or private-network access instead of chasing public addresses in the firewall. When troubleshooting, separate radio attach, tunnel negotiation, and intranet routing. If a backup link is prepared, that path must enter the same address and access policy. It must not fall back to a direct public connection when the primary fails. When a SIM must be stopped in a hurry, a remote lock only cuts the radio. It does not automatically tear down a tunnel session that is already up. Both ends have to handle that.
Before turn-up, draw an address table that states the site subnet, the tunnel subnet, the exit country, and the service ports that may be reached. If the table shows overlapping addresses, change the plan before connecting devices. After go-live, sample one terminal's actual route and confirm that reports are not sent out the office network's public exit. When the firewall changes, update the table in the same change, so nobody later has to guess which rule was written for the cross-border devices. After the table is updated, have one overseas terminal reach the intended destination and confirm the traffic does not loop back onto the public network.