What Is a Static IP Address? Do You Need One for Your Server?

CodexFuse Team · 2026-11-06T10:03:07.198Z · 26 min read min read

What Is a Static IP Address? Do You Need One for Your Server?

When you set up a server, a home lab, or a VPN, someone will eventually tell you to "get a static IP." A static IP address is an internet address assigned once that does not change. Your device keeps the same address through reboots, across days and months, until someone deliberately changes it. That is the whole idea, and it is also the whole test for whether you need one: does anything on the internet need to find you at the same address tomorrow that it found you at today?

If the answer is no, a dynamic IP is fine, and most people never need to pay for anything else. This guide answers what is a static IP address in plain English, compares static vs dynamic IP, explains what a static IP address costs, warns you about the CGNAT trap that can make a paid static IP useless, and shows the free alternatives that solve the same problem. As of November 2026, the facts below come from ISP pages, hosting-provider documentation, and networking guides fetched for this article.

If you are setting up a server, start with the bigger decision first: what is VPS hosting explains the server itself, and a static IP is only one small part of that setup. A VPS already comes with a public address you control, so the "do I need a static IP" question matters most for a home connection, where your ISP controls the address.

What Is a Static IP Address?

A static IP address is a fixed internet address that stays the same over time. It is assigned once, either by your internet provider or by manual configuration, and it does not change when your router restarts, when a lease expires, or when days pass. Other computers, servers, and services can always reach you at that same address, which is why static addresses are the standard choice for anything that accepts incoming connections.

The opposite is a dynamic IP address. A dynamic address is leased automatically by a DHCP server, which stands for Dynamic Host Configuration Protocol. Your router hands out private addresses to devices inside your home, and your ISP hands out your public address.

When the lease expires, the equipment restarts, or the provider changes its network, you may receive a different address. The address can stay the same for days or months, but nothing guarantees it, and that missing guarantee is the entire difference.

One distinction matters more than any other in this guide. Your public IP is the address the outside internet sees, and it is assigned by your ISP. Your private IP is the address your router gives each device inside your home network, such as 192.168.1.42.

You can make a private address static for free on your own router with a DHCP reservation, even while your public address stays dynamic. When people talk about paying for a static IP, they almost always mean a static public address, so this guide says static public IP whenever the paid ISP product is meant.

Static vs Dynamic IP: What's the Difference?

The difference between static and dynamic IP addresses is one thing: whether the address is guaranteed to stay the same. Everything else, speed, security, and cost, follows from that one fact, and most of what people assume about those follow-on effects is wrong.

Here is the honest line, stated once and plainly: a static IP does not make your connection faster or more secure. Speed comes from your plan and your equipment. A static address only changes how findable you are, not how much bandwidth you have.

The FTC, itself a US internet provider, puts it the same way: a static IP address does not automatically make an internet connection faster, more reliable, or more secure, and its primary benefit is consistency.

The security side cuts both ways. A fixed address is a fixed target, so an exposed and unpatched service is easier to probe over time. That is a configuration concern, not a flaw in the address itself.

A static IP address alone does not make your services secure. You still need properly configured firewalls, strong authentication, encryption, software updates, and the other protections that actually do the securing.

How Does a Static IP Address Work?

A static IP address works by skipping the automatic lease process entirely. Instead of your router or ISP handing out an address that may change, the address is reserved for you and written into the configuration. Your device uses that address every time it connects, and the rest of the internet can rely on it staying put.

Dynamic addresses work through DHCP leases. The DHCP standard, RFC 2131 from March 1997, sets the renewal rules: a device tries to renew its lease at 50 percent of the lease time, and broadcasts to any DHCP server at 87.5 percent if the first attempt fails. Those two checkpoints are why a dynamic address often survives for weeks, and also why it can change without warning when a lease is not renewed.

There is no flag on your connection that says "static" or "dynamic." The behavioural test is simple: record your current public IP, reboot your router, check again, and check once more after a few days. If it is identical every time, it is behaving as static. If it changed, it is dynamic.

But many ISPs keep handing you the same dynamic address for long stretches, so "it has not changed yet" is not proof that it is guaranteed static. Ask your ISP for a definitive answer before you build anything that depends on the address staying put.

Dynamic is the default for a reason. The vast majority of home and mobile connections use dynamic addresses because they let providers reuse a limited pool of IPv4 addresses efficiently and require zero configuration from the user. Static addresses are the exception, reserved for the cases where something needs to find you.

Do I Need a Static IP?

Most people do not need a static IP. If you only browse, stream, shop, and use apps, a dynamic IP is fine. You are the one starting connections outward, and nothing needs to find you at a fixed address.

The FTC says the same for businesses: many companies that rely on cloud applications, hosted email, and standard web browsing may never need a static address.

The decision is a test, not a guess. Run through the three real use cases in the next section. If none of them applies to you, the answer is no, and the free alternatives later in this guide cover the edge cases you might be worried about.

Notice what is missing from that table. Gaming, video calls, and streaming never need a static IP, because they are outbound connections your device starts. A static address will not lower your ping, sharpen a video call, or speed up a download.

If a provider or a forum post tells you otherwise, it is selling you something.

What Is a Static IP For? The 3 Real Use Cases

A static IP for server hosting is the first real use case. If you run a website, a mail server, a game server, or any service that other people connect to directly, they need an address that does not move. A domain name can only point at a fixed target, and every time your address changes, the domain points at the wrong place until DNS catches up.

A VPS solves this by default, since its public address is yours to keep, which is one more reason a home server is rarely the right first choice.

The second use case is VPN endpoints and remote access. Reaching your home or office network from elsewhere, through remote desktop, SSH, or a self-hosted VPN endpoint, needs a stable address to dial into. Site-to-site VPN connections between two locations need the same stability at both ends.

If you are building a VPN endpoint, a WireGuard setup guide walks through the modern way to do it, and the static IP is what lets your devices find the endpoint after a reboot.

The third use case is IP allowlisting. Some cloud platforms, financial systems, vendor portals, and cybersecurity tools restrict access to approved public IP addresses. If your work system only accepts traffic from your office address, that address has to stay the same, or your entry goes stale and you get locked out.

Allowlisting should be used with authentication and other controls, not treated as a complete security solution on its own.

Sources also name a few secondary uses: security cameras and home automation checked remotely, remote monitoring systems, and VoIP or SIP systems that require a static IP for authentication or firewall rules. The same honesty rule applies to VoIP. A static address does not improve call or video quality, so do not buy one for a clearer call.

How Much Does a Static IP Address Cost?

Static IP address cost is the hardest number in this guide to pin down, because the big US ISPs do not publish a residential static IP price. They quote through sales, usually only on business plans, and the price depends on your region, your plan, and whether you buy a single address or a block. Price-guide sites list numbers that disagree widely, so this section gives only figures fetched from named sources with their dates, and says plainly where no price exists.

The cloud figures are the most useful, because they are the only ones with a public price list. An AWS Elastic IP is a static public IPv4 address, and at $0.005 per hour it costs about $3.65 in a 730-hour month. A Vultr reserved IP is $0.004 per hour, about $3 per month.

DigitalOcean does not charge at all while the address is attached to a Droplet, and charges $5 per month only while it sits reserved and unassigned. Those three numbers are why a VPS is usually the cheapest honest way to get a fixed public address: the server and the static IP come as one package.

The home-broadband picture is thinner. Metronet's $10 per month add-on is the only current residential ISP price fetched for this article. Comcast's $19.95 per month figure is a 2021 quote, five years old, and should never be presented as today's price.

AT&T sells blocks rather than single addresses, starting at 8 addresses with 5 usable, and asks you to contact them for pricing. No current published price was found for Spectrum Business, Xfinity residential, or Verizon, so this guide states no number for them. And one figure to never repeat: AT&T's $3.00 per month figure is a 2017 wireless and IoT attachment, not home broadband, and quoting it as the AT&T Fiber static IP price would be wrong.

One more warning belongs in this section. Static does not mean public, and it does not mean permanent. A static IP can be private, which is free on your own router, or public, which is the paid ISP product.

It can still be replaced by the ISP or the provider. Always say static public IP when the paid product is meant, and always read the price as ISP-specific, dated, and quoted, never as one universal monthly number.

The CGNAT Trap: When a "Static" IP Isn't Reachable

The CGNAT trap is the single most important thing in this guide, and it has to come before any advice about how to get a static IP. Carrier-Grade NAT, or CGNAT, is a second layer of address translation run by your ISP. The ISP shares one public IPv4 address among several customers, and your router sits behind a second NAT that you cannot log in to or configure.

The cause is the IPv4 shortage: the global registries exhausted IPv4 space in 2011 and 2012, and RFC 7021 documents the carrier-grade approach that followed.

Behind CGNAT, a "static" IP may not be publicly reachable at all. Inbound connections stop at the provider's carrier-grade NAT, because there is no rule there pointing at your router. Port forwarding on your own router never sees the traffic, so the server you just set up is invisible from the internet.

CGNAT completely breaks traditional port forwarding, and no router setting fixes it. Dynamic DNS does not defeat CGNAT either: it only tracks a changing address, and it cannot open inbound reachability when the carrier's NAT blocks unsolicited connections.

The trap is that "static" only means the address does not change. It does not mean the address is yours, public, or reachable. If your ISP cannot take your line off carrier NAT, the static IP fee buys nothing, so check for CGNAT before you pay.

Ask for a public IPv4 address that is not behind carrier-grade NAT, and say public explicitly, because "static" alone does not promise it.

CGNAT is now standard on Starlink residential and on 5G home internet from T-Mobile and Verizon, and it is common on smaller fiber and wireless networks. Most large cable and fiber providers, including Xfinity, Spectrum, AT&T Fiber, and Verizon Fios, still give home customers their own public IPv4 address. T-Mobile Home Internet cannot provide a static IP at all, and its gateways cannot port forward.

Starlink offers an optional public IPv4 address only on its Local and Global Priority plans, and truly static IPs are not available on any Starlink plan. Those are the providers to check first if your connection is not a traditional cable or fiber line.

How to Check If You're Behind CGNAT in 3 Minutes

You can check for CGNAT with a three-minute test that needs no tools and no phone call. It compares the address your router thinks it has with the address the internet sees, and the mismatch tells you everything.

1. Open your router's status page and find its WAN or internet IPv4 address. Write it down exactly.
2. Turn off any VPN, then open a "what is my IP" site and note the IPv4 address it shows.
3. Compare the two. If they match, you have a public address and no CGNAT. If they differ, keep reading the rules below.
4. If the router's WAN address starts with 100.64 through 100.127, you are behind CGNAT. That range, 100.64.0.0 to 100.127.255.255, is the Shared Address Space reserved by RFC 6598, about 4 million addresses, and it is not globally routable.
5. If the WAN address starts with 10, 172.16 to 172.31, or 192.168, something in front of your router is doing its own routing, usually your ISP gateway running in router mode. Fix that first with bridge mode or passthrough, then test again.
6. If the WAN address looks public but still does not match the "what is my IP" result, you are still being translated upstream. Treat it like CGNAT and call your ISP.

One trap inside this test deserves its own sentence. A 100.64 address on a device running Tailscale is the tailnet address, not CGNAT, because Tailscale assigns private addresses from the same 100.64.0.0/10 range. Read the address on the router, not on a device running a VPN, or you will misread the result.

CGNAT is a reachability problem, not usually a speed problem. Browsing, streaming, calls, VPN clients, and email all still work, because they are outbound connections. What breaks is everything inbound: port forwarding, hosting a game or web server, a VPN server at home, reaching cameras or a NAS directly, and dynamic DNS plus port forwarding.

A shared address can also trigger CAPTCHAs or rate limits meant for someone else on the same public IP.

Dynamic DNS vs Static IP: The Free Alternative

Dynamic DNS vs static IP is the comparison that saves most people the monthly fee. Dynamic DNS, or DDNS, keeps a DNS hostname pointed at whatever IP you currently have. A small client, often built into your router, checks your public IP on a schedule and calls the provider's API to update the DNS record when it changes.

DNS TTL is kept short, usually 60 to 300 seconds, so changes propagate quickly. In one tester's October 2026 measurements, end-to-end updates typically took 5 to 60 seconds, with DuckDNS and the Cloudflare API consistently under 10 seconds.

The trade is simple. DDNS gives you a stable name instead of a stable number. Your friends, your domain, and your scripts use a hostname like home.example.com, and DDNS keeps that name pointed at the right address.

It costs nothing on the free tiers, and it works for a home server, a game server, or remote access. What it cannot do is beat CGNAT. If the router's WAN IP is private or behind carrier-grade NAT, port forwarding and DDNS will not work, because the address DDNS tracks is not reachable from the internet in the first place.

Two warnings belong here. First, dynamic DNS is not a static IP and it does not beat CGNAT, so run the three-minute check from the previous section before you build on DDNS. Second, the old go-to DynDNS dropped its free tier in 2014, so do not present it as a free option.

If you use No-IP's free tier, set a reminder for the 30-day confirmation, because the hostname is deleted if you miss it.

DNS is the piece that makes all of this work, so if the record types feel unfamiliar, a DNS beginner guide explains A records, AAAA records, and TTL in plain language. And if you use Cloudflare for your DNS, the Cloudflare beginner guide covers the dashboard where those records live.

Tailscale: The No-Open-Ports Alternative

Tailscale is a mesh VPN built on WireGuard that puts all your devices on one private network, called a tailnet, with stable private addresses. Your devices reach each other directly with no port forwarding, no static IP, and nothing listening on the public internet, and it works behind CGNAT. That last point is what makes it the right answer for the remote-access use case that sends most people shopping for a static IP.

Each device connects to the others over an encrypted WireGuard tunnel. A coordination server hands out keys and addresses but never sees your traffic. NAT traversal is attempted first, falling back to encrypted DERP relays when a direct connection is not possible.

Devices get stable IPs in the 100.64.0.0/10 range and hostnames through MagicDNS, so your laptop is always reachable at the same private address and the same name, wherever it is.

That is also why the 100.64 range appears twice in this guide. On a router's WAN page it means CGNAT. On a device running Tailscale it is the tailnet address.

Same numbers, opposite meanings, and the only way to tell them apart is where you read the address.

The free tier is the one number this guide deliberately does not state. Different secondary sources report different device and user limits for Tailscale's Personal plan after its April 2026 pricing rework, so the count is left out rather than guessed. Check Tailscale's own pricing page if the limit matters to your setup.

A Tailscale beginner guide walks through installing it and joining your first device.

RouterHaus names two other CGNAT workarounds for completeness. Cloudflare Tunnel runs an outbound-only connection from your network, so nothing inbound needs to open. A commercial VPN with port forwarding can also work, with limits: Proton VPN, for example, picks a random port that usually changes on reconnect, which suits torrents but not a fixed-port game server.

Static IP vs IPv6: Does IPv6 Make This Obsolete?

IPv6 changes the question, but it does not erase it. With IPv6, devices get globally routable addresses, so a connection can reach a device at home without any NAT at all, provided the router's IPv6 firewall allows it and the network connecting from also has IPv6. CGNAT is IPv4-only by definition, so the whole trap disappears on a pure IPv6 path.

Starlink, for example, delegates a /56 IPv6 prefix on every plan.

The catch is that IPv6 stability is conditional. Under SLAAC with EUI-64, a device builds its IPv6 address from its MAC address, so the address is effectively a permanent hardware identifier that stays stable for months or years. But most modern operating systems also generate temporary, random IPv6 addresses under the Privacy Extensions, RFC 4941, that rotate about every 24 hours and are used for outbound connections.

The stable address is kept for inbound and server functions, while the address websites see on outbound traffic keeps changing. So "IPv6 addresses never change" is only half true, and the stable half is the one that matters for hosting.

For a server owner, the practical read is this. IPv6 is the long-term fix for the address shortage that created CGNAT, and a VPS with IPv6 gives you a stable, reachable address without paying for a static IPv4 add-on. But the internet is still mixed, most visitors still arrive over IPv4, and your ISP's IPv4 path is the one with the CGNAT question.

Until your audience and your ISP are both fully on IPv6, the static IPv4 question stays relevant.

How to Get a Static IP Address

Getting a static IP address starts with the check, not the purchase. Run the three-minute CGNAT test first, because a paid static IP is worthless for hosting if the line stays behind CGNAT. If the test shows CGNAT, call your ISP and ask for a public IPv4 address that is not behind carrier-grade NAT, using exactly those words.

Ask whether the static IP add-on moves you off CGNAT before you pay, and get the answer in writing with the price, the plan change, and any setup fee.

On a home connection, the path is usually a business plan. Most ISPs sell static IPs only on business plans, quoted through sales, and AT&T sells them in blocks starting at 8 addresses with 5 usable. If your ISP cannot offer a public address at all, as with T-Mobile Home Internet, no amount of asking will change it, and the DDNS or Tailscale route is your answer instead.

On a VPS, the path is a reserved IP. DigitalOcean calls it a Reserved IP, free while attached to a Droplet and $5 per month while reserved and unassigned. Vultr charges $0.004 per hour, and AWS charges $0.005 per hour for an Elastic IP.

You reserve the address, attach it to the server, and it stays yours until you release it. That is the route this guide recommends for anyone whose real goal is a server: the static IP arrives with the server, the price is public, and there is no CGNAT in the way.

aws_hourly = 0.005
vultr_hourly = 0.004
hours_per_month = 730
print("AWS public IPv4 per month (USD):", aws_hourly * hours_per_month)
print("Vultr reserved IP per month (USD):", vultr_hourly * hours_per_month)
print("Metronet static IP per year (USD):", 10 * 12)
print("PureVPN dedicated IP, 2-year plan, 24 months (USD):", 4.45 * 24)
print("PureVPN dedicated IP, monthly plan, 24 months (USD):", 15.95 * 24)
print("No-IP Enhanced DDNS per year (USD):", 2.99 * 12)
print("No-IP Pro DDNS per year (USD):", 14.99 * 12)
print("Usable addresses in an 8-address AT&T block:", 8 - 3)
print("Addresses in the 100.64.0.0/10 shared range:", 2 ** 22)

The numbers above are the worked arithmetic behind this guide. An AWS public IPv4 address costs $3.65 per month, and a Vultr reserved IP costs $2.92 per month. Metronet's $10 per month add-on is $120 per year.

A PureVPN dedicated IP costs $106.80000000000001 over two years on the 2-year plan and $382.79999999999995 on the monthly plan, which is why the long plan exists. No-IP Enhanced DDNS is $35.88 per year and Pro is $179.88 per year. An 8-address AT&T block gives 5 usable addresses, and the 100.64.0.0/10 shared range holds 4194304 addresses.

Every figure in the code block was computed this run, and the prices it uses come from the sources listed below.

Sources

1. ShowMyIP, "What Is a Static IP Address?", last reviewed June 2026 — https://www.showmyip.com/learn/what-is-a-static-ip-address/
2. FTC, "What Is a Static IP Address?", published 8 September 2026, updated 18 September 2026 — https://www.ftc.net/business/blog/what-is-a-static-ip-address-and-why-would-a-business-need-one/
3. NATChecker, "Static IP Address Cost", checked 31 October 2026 — https://natchecker.com/blog/static-ip-address-cost
4. RouterHaus, "CGNAT Explained", published 29 October 2026 — https://www.routerhaus.com/assets/blog/cgnat-explained
5. DigitalOcean Docs, "Reserved IP Pricing", last verified 26 October 2026 — https://docs.digitalocean.com/products/networking/reserved-ips/details/pricing/
6. Proxymint, "Static vs Dynamic IP" — https://proxymint.com/static-vs-dynamic-ip/
7. Vultr Docs, "Reserved IP Pricing" — https://docs.vultr.com/public/doc-assets/pdfs/collection_item/support-products-network.pdf
8. RSINC, "Which ISPs Use CGNAT?", updated 19 October 2026 — https://www.rsinc.com/which-isps-use-cgnat.php
9. No-IP Blog, "Free Dynamic DNS: What You Get", published 8 October 2026 — https://blog.noip.com/blog-free-dynamic-dns-what-you-get
10. No-IP Blog, "Dynamic DNS and Managed DNS Product Lineup Explained", updated 18 September 2026 — https://blog.noip.com/no-ips-dynamic-dns-and-managed-dns-product-lineup-explained
11. wu-ftpd.org, "Best Free Dynamic DNS Service for a Home Server Compared", October 2026 — https://www.wu-ftpd.org/best-free-dynamic-dns-service-for-a-home-server-compared/
12. VoidInsider, "Tailscale: The Complete Mesh VPN Guide", October 2026 — https://voidinsider.com/blog/tailscale-the-complete-mesh-vpn-guide
13. Internet Society, "Privacy Extensions for IPv6 SLAAC" — https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/
14. ippriv.com, "IPv6 Privacy Extensions Explained" — https://www.ippriv.com/blog/ipv6-privacy-extensions-explained
15. Starlink public IP guide, updated 16 October 2026 — https://salecode.cc/starlink/public-ip/

Frequently Asked Questions

What is a static IP address in simple terms?

A static IP address is an internet address that never changes. It is assigned once and stays the same through reboots and across months, so anything that needs to reach you can always find you at the same address. A dynamic IP, by contrast, is leased automatically and can change when the lease expires or the equipment restarts.

Do I need a static IP for my home internet?

Most people do not. Browsing, streaming, gaming, video calls, and cloud apps all work fine on a dynamic IP, because your device starts those connections. You need a static IP only if something has to connect to you: a server you host, a VPN endpoint, or a system that allowlists your address.

How much does a static IP cost?

There is no single price: the big US ISPs quote through sales, usually on business plans only. Verified figures fetched for this article include Metronet at $10 per month, an AWS public IPv4 address at about $3.65 per month, a Vultr reserved IP at about $3 per month, and a DigitalOcean reserved IP free while attached to a server. A 2021 Comcast quote of $19.95 per month is five years old and is not today's price.

Does a static IP make my internet faster?

No. A static IP does not make your connection faster, more reliable, or more secure, because speed comes from your plan and your equipment. A static address only changes how findable you are, and it can make an exposed service a more fixed target, so it is not a security upgrade either.

Why doesn't my static IP work behind CGNAT?

Behind carrier-grade NAT, your ISP shares one public address among several customers, and inbound connections stop at the provider's NAT before they ever reach your router. Port forwarding on your router cannot fix it, and dynamic DNS cannot fix it either. Run the three-minute WAN-versus-public-IP check first, and ask your ISP for a public IPv4 address that is not behind carrier-grade NAT before you pay for anything — that is the cgnat static ip trap in one line: the address is fixed, but nothing on the internet can reach it.