Can I host a server through a VPN?

Not through a consumer privacy VPN. Your traffic leaves through the provider's gateway, which is doing network address translation for thousands of subscribers at once. An inbound packet arriving at that gateway has no way to know which subscriber it belongs to, so it is dropped. Some providers sell port forwarding as an add-on, which does work, but many also prohibit running services in their terms.

Why can't Tailscale host a public server?

A mesh VPN builds a private network across your own devices, and a stranger's browser is not on that network. Funnel and similar relay features bridge the gap, but they are generally HTTP-shaped, so a game server or a mail daemon on its own port does not fit, and the address visitors reach belongs to the provider rather than to you.

Does a VPN give me a static IP address?

A consumer VPN gives you a shared exit address, not a static one you control. It is stable in the sense that it does not change often, but it is used simultaneously by many other customers, so it cannot be used for inbound connections and is a poor answer for vendor allow-listing.

What do I need if I want both a private network and a public IP?

Two different things at once: an overlay network with its own addressing so your devices can reach each other privately, and a routable public address that is announced to the internet with no NAT in front of it. The overlay is the easy half; the routable address is what most setups lack.

One Provider for IP, Mail, Alerting and Monitoring

20 September 2026

We did not set out to build four products. We set out to build one: a real public IPv4 address for a machine you already own, routed from our own address block and our own network number. Everything else exists because running that one thing properly required it.

You cannot operate a network service without knowing when it breaks. You cannot know when it breaks without something watching from outside. You cannot be told it broke without a way to send mail that arrives. Each of those was a thing we needed, could not buy in a shape that fitted, and ended up building.

What we run

TunnelNet is the original: a routable public IPv4 address assigned to a machine you own, with no port forwarding, no ISP static IP and no business internet contract. Inbound connections reach the machine on any port, and outbound traffic leaves from the same address, which is the part vendor allow-lists care about. Ten dollars a month for inbound, twenty with outbound egress, one hundred for Business.

Mail sends from your own domain through our relay, signed. Five dollars a month.

Alerting is email and API alerts with hard spend caps, because the failure mode of an alerting system is not silence, it is a bill. Twelve dollars a month.

Monitoring watches an HTTPS URL, a TCP port, or a heartbeat you ping on a schedule, from a machine that is deliberately not part of anything it measures. It is in beta and it does not have a price yet, so it is not something you can buy today. It is listed here because it exists and it runs, not because we are selling it.

Why one provider is actually different here

Bundling is usually a billing arrangement. Four logos on one invoice, four unrelated companies behind them.

These run on the same network. The addresses your machine gets, the address our relay sends from, and the vantage our monitoring probes from are all inside infrastructure we operate under our own network number. When something is wrong we are not opening a ticket with a supplier; we are looking at our own routers.

That is the honest version of the advantage. It is not magic and it does not make anything immune. It means fewer parties have to agree on what happened.

What we deliberately do not claim

This section is here because its absence is usually the interesting part of a page like this.

We do not publish an availability percentage. Several of these services are weeks or days old. Any figure would be arithmetic over a window too short to mean anything.

We do not offer an SLA. Not yet. We are not going to promise a number we have not had long enough to keep.

We do not claim mail lands in an inbox. We can show that our relay sent it and that the receiving provider accepted custody. Where a message goes after that — inbox, spam, a rule someone wrote in 2019 — is not observable from the sending side, and anyone who tells you otherwise is describing something they cannot see.

SMS alerting is not live. US carriers require every business sending application-to-person messages to register a campaign, and ours is in review. Until it clears, an SMS alert is accepted and held rather than dropped, and we do not bill for it.

Monitoring is not for sale. It works, it is in beta, and it has no price. When it has one, it will say so.

Support, as one number

Everyone gets a reply within one business day.

On the Business plan the commitment is tighter: a reply within eight working hours.

That is the whole promise. It is not 24/7 and it is not weekend cover, and we would rather say so here than have you find out on a Saturday.

Where to start

If what you need is a real address on a machine you own, start at pricing. If you want mail from your own domain, Mail is five dollars. If you want to be told when something breaks, Alerting is twelve.

If you only need your own devices to reach each other, you do not need us — Tailscale is free and a better fit, and we say so in our guides too.