In this chapter
The connection in ordinary language
The SIM is the phone's membership card, with a secret used to prove that it belongs. The eNodeB is the radio the phone hears. The core checks membership and creates a data session. The packet gateway connects that session to an outside network. DNS turns a name such as a website address into the numeric address a computer can reach.
Radio signal and Internet access are different things. A phone may see the network but fail authentication. It may authenticate but have no route to the Internet. It may reach an IP address but fail to resolve names. Tests later in the guide separate these cases.
The core functions you will meet
| Name | Plain English job | Where it lives in this first build |
|---|---|---|
| MME | Manages the phone joining, moving and becoming reachable again. | Open5GS on the PC. |
| HSS | Holds subscriptions and supplies authentication information. | Open5GS with a local MongoDB database. |
| SGW-C and SGW-U | Arrange and carry the radio-side data tunnel. | Open5GS on the same PC. |
| SMF and UPF acting as PGW | Provide the LTE packet gateway and the phone address pool. | Open5GS on the same PC. |
| PCRF | Provides policy and subscription-related decisions. | Open5GS on the PC. |
| SEGW | Authenticates remote radio sites and encrypts backhaul. | Needed when a site crosses an untrusted network. |
| IMS | Registers compatible phones for native mobile calls and messages. | A later service layer, separate from basic data. |
The example address plan
| Part | Example | Why it is separate |
|---|---|---|
| Home router | 192.168.50.1/24 | Existing broadband and administrator LAN. |
| PC management interface | DHCP reservation 192.168.50.10 on enp1s0 | Updates, SSH and Internet exit. Reserve this address in your router. |
| PC radio interface | 192.168.200.1/24 on enp2s0 | Private physical link to the base station. No default gateway here. |
| Base station management and S1 | 192.168.200.10/24, gateway 192.168.200.1 | The only trusted radio in this initial lab. |
| Phone addresses | 10.45.0.0/16, gateway 10.45.0.1 on ogstun | Separate from administration and the radio management LAN. |
| Core internal traffic | Packaged 127.0.0.x loopback addresses | Functions on the same PC talk locally. Do not publish these. |
| Public address | Your existing router supplies normal outbound NAT | No ASN, leased public block or BGP is needed for this first build. |
If your home already uses one of these ranges, choose unused private ranges before continuing and change every matching example. Your phone pool must not overlap any home, VPN or site subnet. The /24 describes a range of 256 addresses. Devices on that range commonly use addresses ending 1 to 254. A gateway is the next device used to reach destinations outside the local range.
The radio port is dedicated. Do not plug it into an untrusted shared building network. The initial design deliberately keeps the radio and core in one room on private Ethernet. If the eNodeB uses separate management and S1 interfaces, map both using its model-specific manual.
Write a settings sheet
| Setting | First build value | Where it must agree |
|---|---|---|
| MCC and MNC | 999 and 99, with a two-digit MNC | SIM IMSI prefix, eNodeB PLMN, MME GUMMEI and TAI. |
| Tracking area code | 1, decimal | eNodeB and MME. Some radio menus display hexadecimal. |
| APN | internet | Phone APN and HSS subscription. |
| MME S1 address | 192.168.200.1 | MME bind address and radio MME field. |
| SGW-U S1 address | 192.168.200.1 | SGW-U bind address, reachable by the radio. |
| Subscriber authentication | Unique supplier-provided IMSI, K and OPc | USIM and HSS. The values are private. |
| Radio channel | Only the frequency and bandwidth on the licence | eNodeB settings and installed equipment. |
| Time synchronisation | NTP for server time, approved GNSS/PTP source for radio timing | Do not substitute NTP for TDD phase synchronisation. |
999/99 is a private network example, not a unique public identity or a roaming agreement. Another private network can use the same numbers. Choose a coordinated identity for your context and do not broadcast another operator's PLMN. The ITU E.212 recommendation explains private network identifiers.
Draw two security boundaries
First, administration must be reachable only by you. SSH, subscriber editing, databases, monitoring and the radio web interface do not belong on the public Internet. Second, a connected phone is a user device, not an administrator. It must not reach the core's management services, home devices or the base station's web interface.
A SIM proves access rights to the mobile network. It does not make every application trustworthy or every device safe. LTE encryption covers the radio link, an IPsec tunnel covers remote backhaul and HTTPS covers an application connection. Those protections cover different sections of the path.
Choose one core branch for a build. Do not run competing MMEs on the same radio-facing address. The VectorCore chapter gives its own three-host address plan and explains where Open5GS packet gateways remain part of that option. Keep the first network IPv4 only. IPv6 is valuable, but adding it requires a real routed prefix, firewall rules, DNS and return routing. Documentation prefixes such as 2001:db8::/32 cannot provide Internet IPv6. Add that work as a deliberate later change.
Checkpoint
You should be able to point to the phone, radio, core and broadband router on your drawing, explain which address belongs to each and identify where credentials are stored. Keep an ordinary independent way to contact help. This experimental network is not your emergency communications plan.