A Fixed Outbound IP for Vendor and API Allowlisting
When a vendor says "give us the IP address you will call from", a home connection cannot answer: the address is shared, it changes, and it belongs to your ISP. A fixed outbound address solves that specific problem and nothing else. Here is what allowlisting actually requires, the three ways to get a stable egress address, and how to tell whether you need one at all.
The problem, stated exactly
Somebody — a payment processor, a bank's API, a customer's firewall team, a database provider — asks you for the IP address your traffic will arrive from, so they can permit it and reject everything else. It is one of the oldest access controls there is and it is still everywhere, because it is simple and it works.
From a home or small-office connection you cannot answer honestly. The address you egress from is your ISP's, it is shared with other customers under CGNAT or rotated on a lease, and it can change without warning. You can look it up today and give them a number; it will be wrong eventually, and the failure arrives as an outage in production at whatever hour the lease renewed.
Note what is being asked for. This is outbound identity — the address you appear to come from — which is a different thing from being reachable at an address. Most of our guides are about inbound. This one is not, and the distinction matters because the cheap answers to one are useless for the other.
What actually satisfies an allowlist
A stable address, not a stable name. Firewall rules and API allowlists take addresses. Some vendors accept a hostname and resolve it periodically; most do not, and the ones that do usually cache the result for longer than you would like. Dynamic DNS does not solve this.
An address you control the use of. A shared address technically satisfies the rule and defeats its purpose: anyone else behind the same address inherits your access. Some vendors explicitly forbid it, and a security review will find it.
An address you can give them in advance, once, that stays true. That is the whole requirement. It does not need to be fast, it does not need to be nearby, and it does not need to accept inbound connections at all.
Three ways to get one
Ask your ISP for a static address. The direct answer, and worth one phone call before anything else. Business plans often include one; residential plans sometimes offer it for a small monthly fee. If you get it, you are done and everything below is unnecessary. The catch is that many modern connections — fibre-to-the-home, fixed wireless, satellite — no longer sell it at any price on a residential account.
Route your outbound traffic through a VPS you rent. A few dollars a month gets a server with a stable address. Put WireGuard on it, send the traffic that needs the fixed identity through it, and the vendor sees the VPS. This is the standard DIY answer and it works well. What you are buying is not the five dollars; it is the ongoing operation of a second machine — updates, keys, a routing configuration whose details you will have forgotten in six months when it breaks at 2am. If you are comfortable with that, it is the cheapest correct answer.
Lease an address that is routed to your machine. This is what we sell. Your machine dials out to our network, we assign it one of our addresses, and outbound traffic from that machine leaves as that address rather than as your ISP's. You give the vendor the number once. There is no second machine to operate.
What our version does and does not do
Outbound identity is our $20/month Full plan, not the $10 base plan. The base plan is inbound only: it routes traffic to you at your address, while your own outbound still leaves through your ISP. If a fixed egress address is the entire reason you are here, the base plan will not do it and you should not buy it expecting otherwise.
On the Full plan you choose which of our locations your traffic exits from, and it is per-machine rather than per-account — you can have one machine egressing through us and others untouched, which is usually what you want, because sending a whole house through a tunnel is rarely the goal.
Three honest limitations.
It takes a few minutes to become true after setup. The address is assigned at enrolment; the routing that makes your outbound traffic use it is applied shortly afterwards. If you check your egress address in the first minutes and see something unexpected, wait and check again before concluding it is broken.
Port 25 is excluded. Outbound mail is dropped at our edge regardless of plan, for reasons covered in the mail guide. If the allowlisted service you are calling is an SMTP server, this is not the product for you.
It is a shared block, not a shared address. Your address is yours alone. But it sits in a range we announce, and range-level reputation is a real thing on the internet — some aggressive blocklists and geolocation databases operate on blocks. If your vendor's own filtering is that coarse, no dedicated address from anyone solves it.
Verify it before you give anybody the number
Check what the internet actually sees, from the machine itself, rather than from the dashboard:
curl -4 https://ifconfig.me
That should return your leased address. If it returns your ISP's, the egress routing has not taken effect yet — wait a few minutes and try again — or the machine is not on the plan you think it is.
Two things worth knowing before you hand the number to a counterparty. Check from the machine that will make the calls, not from your laptop, because egress is per-machine and a different box on the same account may leave by a different path. And check the IPv6 answer too with curl -6 https://ifconfig.me: if your machine has IPv6 and the vendor's endpoint does too, the connection may prefer v6 and arrive from an address you never told them about. That is one of the most common reasons a correctly-configured allowlist rejects traffic that looks right in every log you control.
How to tell whether you need this at all
Three questions, in order.
Has anyone actually asked you for an address? If not, you probably do not need one. A stable egress identity is a specific requirement imposed by a specific counterparty; it is not general hygiene, and buying it speculatively is buying nothing.
Would a credential do instead? Many vendors offer mutual TLS, signed requests, or OAuth as an alternative to IP allowlisting, and every one of those is a better control — it authenticates the caller rather than the network path. If your vendor supports one, use it. It costs nothing and survives you changing connections.
Is it one machine or all of them? If it is one machine making one integration's calls, the tunnel is small and cheap. If your answer is "the whole office", you are describing a business internet connection with a static allocation, and that is a different purchase.
Where TunnelNet fits
We are a good answer when a counterparty needs one stable address for one machine you own, when your ISP will not sell you a static address, and when you would rather not operate a VPS to get one. The address is yours, it is not shared, and it does not change.
We are the wrong answer if a credential would do, if you need the address to be in a particular country we do not have, or if outbound mail is the traffic in question.
Plans and prices lay out what the two tiers include. If you also want the machine reachable from outside — the inbound half — that is the base plan and the CGNAT guide covers the mechanics.