Build your own secure mobile network

You are welcome here

You do not need to arrive knowing telecoms. This guide starts with an ordinary computer and explains the new words as they appear. Take one chapter at a time. Keep a notebook, save a working configuration before changing it and treat each test result as a clue. Asking a basic question is part of learning.

The first build is a private LTE network. LTE is the technology commonly called 4G. Your own radio connects a phone to software on your Ubuntu PC. Your own SIM credentials decide who can join. Your existing broadband supplies the Internet connection. You are building a small mobile network, rather than a Wi-Fi access point.

What you will build

1. Plan an isolated network with separate management, radio and phone addresses.
2. Choose equipment that supports the exact licensed UK frequency and power.
3. Install Ubuntu and a public Open5GS mobile core.
4. Keep administration private and allow only the traffic the network needs.
5. Add a programmable USIM or a properly provisioned eSIM.
6. Configure a Baicells LTE base station and connect a test phone.
7. Check Internet access, privacy boundaries and recovery after a restart.
8. Add an encrypted tunnel for a remote radio site, then explore voice, messaging and ongoing operation.

The main worked example uses Ubuntu Server 24.04 LTS on an x86-64 PC, an Ethernet-connected LTE Band 40 eNodeB, a private PLMN of 999/99, one Internet APN and IPv4. Two wired interfaces keep the radio separate from the home network. Choose the all-in-one Open5GS path or the separate VectorCore path linked from the chapter list. The main Open5GS configuration follows the 2.8 configuration family. Record the package version you actually install because repositories change.

Three milestones

A working data connection does not automatically provide VoLTE, SMS, roaming, public telephone numbers or emergency calling. Those are additional engineering and service projects. The voice chapter explains the dependencies and the checks that prove each part works.

How to follow the examples

Read a whole step before using its commands. Commands are entered in Ubuntu's Terminal. A line beginning with sudo asks for administrator rights. Your password will not appear while you type it. Do not type a leading dollar sign from another tutorial. In an editor, Ctrl means hold the Control key while pressing the named letter.

Addresses and names in this guide are examples. Replace interface names with the names on your PC. Replace the home management subnet if yours differs. Example public addresses in 192.0.2.0/24 are reserved for documentation and cannot be used as real Internet endpoints. Never copy Lodestar's subscriber identity, private addresses or credentials.

Configuration blocks described as extracts belong inside an existing file. They are not complete replacements. YAML uses spaces for indentation. Tabs, duplicate top-level keys and removing unrelated sections can prevent a service from starting.

A realistic first project

Plan several sessions for the first build. Licensing and equipment delivery can take longer than the software work. Complete the Ubuntu and core chapters while the transmitter stays silent. First make the local system work on a bench. Add a remote site only after the local tests pass. Add IMS after reliable data, because faults are much easier to locate when one layer changes at a time.

Use the equipment checklist to collect quotations. Include annual spectrum fees, broadband, electricity, replacement parts and your own time. A refurbished PC can be a good starting point, but buying the wrong radio or a locked SIM usually costs more than checking compatibility first.

What we checked

This guide was prepared on 1 November 2026 using a read-only SSH review of Lodestar's security gateway, mobile core and IMS edge, plus the primary documentation linked throughout the chapters. The production review confirms the architecture and running software roles. The public Open5GS and VectorCore builds below are educational reference designs. These example installations have not been completed from scratch or tested over the air on a new Baicells as part of this publication.

Model-specific menus, handset behaviour and your issued radio licence must be checked on your own equipment. Each chapter gives an expected result and a reason to stop if it is missing. The final chapter compares the audited Lodestar deployment with the public Open5GS and VectorCore paths. Running production binaries are not proof of which public commit was deployed.

Follow the complete guide