free5GC

Search the Azure Marketplace for free5GC 4.2.3 (5G Core) on Ubuntu 24.04, and create the VM with an NSG that allows the following inbound traffic:

• TCP 22 (SSH) from your management network
• TCP 443 (the WebConsole over TLS) from your admin network
• SCTP 38412 (N2 / NGAP) and UDP 2152 (N3 / GTP-U) from the network your RAN lives on (needed only once you attach an external gNB)

RG="free5gc-lab"; LOCATION="eastus"; VM_NAME="free5gc-01" IMAGE_URN="sac1647283583153:free5gc:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name f5gc-vnet --address-prefix 10.90.0.0/16 --subnet-name f5gc-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name f5gc-nsg az network nsg rule create -g "$RG" --nsg-name f5gc-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name f5gc-nsg --name allow-webconsole --priority 110 \
  --source-address-prefixes "<your-admin-cidr>" --destination-port-ranges 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:free5gc:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name f5gc-vnet --subnet f5gc-subnet --nsg f5gc-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Every network function, MongoDB and the WebConsole are systemd services that start automatically after first-boot provisioning completes. Confirm that they are running:

for s in mongod free5gc-nrf free5gc-amf free5gc-smf free5gc-upf free5gc-ausf \
  free5gc-udm free5gc-udr free5gc-pcf free5gc-nssf free5gc-webconsole nginx; do printf ' %s = %s\n' "$s" "$(systemctl is-active $s)" done modinfo -F version gtp5g mongosh free5gc --quiet --eval 'db.NfProfile.countDocuments()'
# NFs registered with the NRF

The per-VM WebConsole admin administrator password is generated at first boot and written to a root-only file. There is no shared or default login in the image, and the upstream admin/free5gc default is never a working credential. Read the file with:

sudo cat /stage/scripts/free5gc-credentials.log

# free5GC v4.2.3 — Per-VM Credentials
#
# WebConsole (HTTPS via nginx): https://<vm-ip>/
# Sign in: admin / <password below>
# FREE5GC_WEBUI_USER=admin FREE5GC_WEBUI_PASSWORD=<unique-per-VM-password> FREE5GC_URL=https://<vm-ip>/

Browse to https://<vm-ip>/ and sign in as admin with the per-VM password from Step 5.

The WebConsole is served on the VM's loopback interface and fronted by nginx TLS on 443. The raw console port is never directly reachable.

The WebConsole's Subscribers view lists the SIM identities the core will authenticate. Each subscriber is a SUPI (IMSI) with its permanent key (K), operator code (OPc), PLMN, network slice and DNN. This is where you provision the SIMs that your RAN and devices use.

Open a subscriber to see its full 5G-AKA security configuration: the SUPI, GPSI, authentication method, key material, slice and data network.

The image ships UERANSIM, a software gNB and UE, at /opt/ueransim, so you can prove that the core works end to end with no radio hardware.

The one-shot self-test below provisions the default test subscriber (through the WebConsole API, using your per-VM admin), starts the software gNB and UE in the background, and shows the UE getting a data-plane IP:

# Provision the default test subscriber (idempotent) and run the software RAN self-test
sudo /opt/ueransim/provision-test-subscriber.sh || true cd /opt/ueransim
sudo nohup ./bin/nr-gnb -c ./config/free5gc-gnb.yaml >/tmp/gnb.log 2>&1 & sleep 5
sudo nohup ./bin/nr-ue -c ./config/free5gc-ue.yaml >/tmp/ue.log 2>&1 & sleep 20 grep -E 'NG Setup procedure is successful' /tmp/gnb.log || true grep -E 'Registration is successful|PDU Session establishment is successful' /tmp/ue.log || true ip addr show uesimtun0 || true

When the UE registers and the SMF and UPF establish the session, the UE gets an IP on the uesimtun0 tunnel interface from the UPF's DNN pool (10.60.0.0/16). You can then route application traffic through the 5G user plane:

# route an application's traffic through the 5G tunnel (source IP = the UE's 10.60.x address):
cd /opt/ueransim/bin && sudo ./nr-binder 10.60.0.1 curl -s https://ifconfig.me || true

To stop the self-test, run sudo pkill -f nr-ue; sudo pkill -f nr-gnb.

The built-in self-test runs the RAN on the same host over loopback. To attach an external gNB (real hardware or a remote UERANSIM), rebind the AMF's N2 address and the UPF's N3 GTP-U address to the VM's own IP, and point your gNB at it:

# AMF N2 (NGAP) — set ngapIpList to the VM's private IP sudo sed -i "s/127.0.0.18/<private-ip>/" /opt/free5gc/config/amfcfg.yaml # UPF N3 (GTP-U) — set the gtpu addr to the VM's private IP
sudo sed -i "s/127.0.0.8/<private-ip>/" /opt/free5gc/config/upfcfg.yaml
sudo systemctl restart free5gc-amf free5gc-upf

Then open SCTP 38412 (N2) and UDP 2152 (N3) in the NSG from your RAN's network, and set your gNB's AMF address to the VM IP.

Provision each device's SIM (SUPI, K, OPc, slice, DNN) in the WebConsole so that it matches the SIMs in your handsets or test UEs.

# The whole core is enabled and starts at boot. To inspect or restart a function:
sudo systemctl status free5gc-amf
sudo systemctl restart free5gc-smf free5gc-upf
sudo journalctl -u free5gc-amf -f
# follow a network function's log

The UPF data-path module gtp5g is registered with DKMS, so it is rebuilt automatically when Ubuntu ships a new kernel. Run dkms status to see it installed for the running kernel.

• Restrict the WebConsole (443) to your admin network in the NSG. It manages SIM credentials and must not be exposed to the internet.
• Open the RAN ports (SCTP 38412, UDP 2152) only to the networks your gNBs live on. The N2 and N3 interfaces have no application-layer authentication and rely on network isolation.
• MongoDB is bound to loopback in this image. Keep it that way, because the network functions and console reach it locally.
• Rotate the WebConsole admin password from the console's user management, and provision one SIM per device rather than sharing a single test SIM in production.

free5GC is licensed under Apache-2.0; UERANSIM under GPL-3.0 (shipped as an optional self-test tool). SecureAnyCloud provides this image with 24/7 support and a 24-hour response SLA.

Need Help?

Contact SecureAnyCloud support through the Azure Marketplace listing or at secureanycloud.com.

Deploy on Azure

Launch free5GC 4.2.3 (5G Core) on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com