Definition
Subnet refers to a network segment created by logically or physically dividing an IP network. The address range is defined by a subnet mask (e.g., 255.255.255.0). Subnets are used for device grouping, security isolation, traffic management, and routing optimization. In IoT scenarios, different services (such as charging stations, meters, trackers) can be allocated to different subnets, facilitating Device Management Platform group management and permission control.
The APN assigned by the operator for IoT SIM cards can correspond to a dedicated subnet. When devices access through VPN or private network, subnet division can isolate them from the public network and other services. In cross-border scenarios, devices deployed in multiple countries may connect to different operator subnets, requiring unified internal network or data synchronization to achieve inter-subnet communication.
Technical Features and Architecture
The subnet architecture includes: Address planning — CIDR notation, subnet mask, number of available hosts; Routing — inter-subnet routing, default gateway; Isolation — VLAN, firewall, ACLs to implement inter-subnet access control; DHCP — address allocation within the subnet. The IoT platform can assign different subnets or IP ranges to devices in different groups , and combine data pool sharing to implement subnet-based billing or speed limits. Combined with virtualization , multiple logical subnets can be virtualized on a single physical network.
In cross-border scenarios, subnet planning needs to consider multiple regions, multiple operators, and multi-country with one card IP allocation and routing consistency during roaming.
Application in IoT and cross-border scenarios
Subnets are widely applied in: Charging stations — dividing devices in the charging station (EV charging stations, monitoring, gates) into independent subnets; Industrial IoT — segmenting production line devices and office networks; Logistics — grouping warehouse, vehicles, logistics tracking devices; Multi-tenant — providing isolated subnets for different customers on SaaS platforms. Cross-border charging networks, global factories, and multi-country logistics scenarios all rely on subnets for device grouping and security isolation.
SimtoLink provides IoT devices with private networks, VPN , and subnet planning support to facilitate secure networking in cross-border scenarios.
A subnet divides an address range, not a coverage map
In international IoT, a subnet is a contiguous address space. The prefix length says which addresses share a broadcast domain and a routing policy. Putting a device in a subnet means its address, gateway, and access control follow that block. It does not mean the device is in the same country. After roaming, the visited network may give the device an entirely different address. The old prefix does not travel with the SIM. If the platform uses the address prefix to decide "this is a charger or a camera," a network change moves the prefix and the grouping and permissions move with it.
A private network or a tunnel can place devices from many countries back into a planned address block. Only then is the subnet a stable policy boundary again. Without that return path, a public address is a temporary identifier, not an organizational structure.
When an address plan still works across operators
A subnet policy works across a border only if the enterprise assigns the addresses, or at least rewrites them inside the tunnel into the enterprise plan. The mask, gateway, and remote route on the device must agree. A mask that is too long sends a neighbor that should be local to the default gateway. A mask that is too short treats devices from different services as one segment, and access control stops working. If a roaming SIM has both a cellular address and a tunnel address, the application should bind to the tunnel address, not to the cellular address that can change at any time.
Leave spare space in the address pool by country or by project. Pressing every device in the world into a prefix that is too small forces later roaming countries onto address translation, and translation breaks rules that identify a device by source address. Plan prefixes from simultaneous online count and from sites first, and talk about the firewall after that.
Inferring that a device is still at home from a home address
Once a tunnel pins the address at home, geography and address ownership are no longer the same fact. Judging that a device has not left the country because the address looks domestic misses devices that are already working on a visited network. The reverse is also wrong: a public address that belongs to a foreign operator does not prove the business data has landed in that country. The address may only be the exit operator's pool. Another mistake is to keep caching the old address after a roaming reconnect. Downlink commands go to an address that has already been reclaimed. The platform shows a successful send, and the device never responds.
Check the current cellular address, the address inside the tunnel, and the operator of the latest attach together. Match policy on a stable device identity and the tunnel address. Use the cellular address only to see the current exit. Do not write all three into one "online address" field.
An address-plan change also has to avoid sessions that are roaming right now. After a prefix is shrunk or a gateway is moved, devices that are already connected keep the old route until they reconnect. If the old prefix is deleted before that reconnect, devices at the border match neither the new policy nor the old gateway for a while, and they look randomly offline. Put the change in a window that can accept a collective reconnect, and keep the old prefix until the online count has moved.