How Private 5G Networks Work
The architecture, the components, the choices that matter — in plain English.
Private 5G network architecture looks more complicated than it is. Strip away the acronyms and you have four parts: a radio that broadcasts the signal, a core that runs the network, some spectrum for the radio to use, and devices with SIMs that connect. That's it.
This page walks through each component, an architecture diagram of how they connect, the choices behind a typical UK deployment, and the questions worth asking before you commission one. If you want the procurement view instead, namely what you buy and what it costs, see our guide to private 5G equipment.
The four building blocks
Every private 5G network — whether it covers a single warehouse or a 200-acre site — uses the same four pieces.
5G Radio (gNodeB)
The base station that transmits and receives the wireless signal. Can be a small indoor unit the size of a smoke alarm, or an outdoor mast-mounted radio for wider coverage.
5G Core
The software that authenticates devices, manages sessions, applies policy, and routes traffic. Can run on a small on-premise server or in the cloud — Aerix supports both.
Spectrum
The radio frequencies the network uses. In the UK, Ofcom Shared Access spectrum (typically 3.8–4.2 GHz) is the standard band for private 5G. The licence is part of the service.
Devices & SIMs
Routers (CPE), modems, smartphones, sensors and IoT devices with a SIM provisioned for the private network. Devices can be customer-owned or supplied by Aerix.
What does a private 5G network look like?
The same four building blocks, drawn as a network engineer would draw them, with the backhaul that joins them up.
Read the diagram left to right. On site, every device (a phone, a camera, a sensor, or a router serving a building's own Wi-Fi) carries a SIM issued for the private network rather than a public operator's. It talks to the 5G radio, known as the gNodeB, over the spectrum licensed for the site, which in the UK is usually Ofcom Shared Access spectrum between 3.8 and 4.2 GHz.
The radio does very little thinking of its own. It passes everything over the backhaul to the 5G core, and the core does two distinct jobs, which is why the diagram uses two line styles. Firstly, on the control side, the AMF and the UDM/AUSF check the SIM, decide whether the device is allowed on, and track it as it moves. Secondly, on the user side, the SMF sets up a session and the UPF carries the actual traffic out to the internet or into the organisation's own systems.
Note that the backhaul is the one link in the chain you cannot buy off a shelf. Where the core runs in the cloud, a backhaul failure takes the whole network down; where it runs on site, devices keep talking to each other and to local systems, and only the internet goes. That is the principal trade-off between a cloud and an on-premise core, and it is worth deciding deliberately rather than by default.
Private 5G network architecture: a worked example
Take a 50-hectare holiday park as a typical Aerix deployment.
We mount one or two outdoor 5G radios on existing site structures — a barn, a poletop, the side of a clubhouse. Each radio covers a few hundred metres of open ground and feeds traffic over a backhaul link (fibre where available, microwave or satellite where it isn't) to our cloud-hosted 5G core.
Each pitch or building gets a small indoor or outdoor router. The router has a SIM that's authenticated by our core; once authenticated, devices on the local Wi-Fi behind the router get a fast, dedicated connection to the internet.
From the customer's perspective it looks like a normal broadband router. From the network's perspective every connection is on a private cellular network we own and operate end-to-end.
If you want the order we do this in, from survey and spectrum licence through to the first SIM going live, see our guide to how to build a private 5G network.
Common questions
What does a 5G private network look like?
Physically, less than most people expect: one or more small radios on a wall, pole or roof, a router or SIM in each connected device, a backhaul link off site, and a 5G core running either on a small server in a comms cabinet or in the cloud. Logically, it is a chain from device to radio to core to the internet, with the core checking every SIM before any traffic flows. The architecture diagram on this page shows the whole chain on one sheet.
What are the main components of a private 5G network?
Four building blocks: a 5G radio (the cell site that broadcasts signal), a 5G core (the brain that authenticates devices and routes traffic), spectrum (the radio frequencies the network uses — typically Ofcom shared access spectrum in the UK), and end-user devices or routers (CPE) that connect via SIM.
What is a 5G core network?
The 5G core is the software that handles authentication, mobility, billing, security, and routing of user traffic. In a private deployment it can run on-premise (a small server in a comms cabinet) or in the cloud. Aerix typically uses a cloud-hosted core for smaller sites and on-premise cores for industrial or air-gapped deployments.
What spectrum do private 5G networks use in the UK?
Ofcom's Shared Access Licence framework provides spectrum in three bands suitable for private networks: 1800 MHz (paired), 2300 MHz, and 3.8–4.2 GHz. The 3.8–4.2 GHz band is the most common for new private 5G deployments because it offers high capacity and is widely supported by 5G equipment. Aerix arranges the licence as part of the service.
Standalone (SA) vs Non-Standalone (NSA) 5G — which do private networks use?
Modern private 5G deployments are almost always Standalone (5G SA), meaning both the radio and the core are pure 5G. Non-Standalone (NSA) 5G is a transition technology used by public operators that bolts a 5G radio onto an existing 4G core — useful for mobile operators reusing infrastructure, less relevant for fresh private builds.
Do private 5G networks support roaming?
They can. A neutral host private network can roam users from public mobile operators back to their home networks. A dedicated private network typically doesn't roam — devices either work on the private network (with a private SIM) or on public mobile (with a public SIM), depending on which SIM is provisioned.
Is private 5G more secure than Wi-Fi?
Generally yes. Cellular networks use SIM-based authentication (every device is cryptographically tied to a known SIM), encrypt traffic on the radio interface by default, and isolate user traffic on the core network. Wi-Fi can be made secure but the default posture of cellular is stronger.
Want to see one in action?
We can walk you through a live deployment — Llanthony Valley, a holiday park, or one of our city centre rollouts — and answer the architecture questions specific to your site.