Static IP for a Home Server
"Static IP" gets used for two different things: an address that does not change, and an address the internet can actually reach. Most home-server problems are the second one. Here is what each option really gives you, what it costs, and how to tell which one you need.
Two different problems wearing one name
When someone says they need a static IP for a home server, they usually mean one of two things, and the fix is different for each.
The first is instability: you have a public address, it works, but your ISP changes it every few days or after every reboot, so whatever you pointed at it stops resolving. This is an annoyance with a free solution.
The second is unreachability: nothing outside your house can open a connection to you at all, no matter what address you use, because you are behind carrier-grade NAT or a firewall you do not control. A static address would not help, because the problem is not that the address moves. We wrote about that case separately, and if curl -4 https://ifconfig.me disagrees with your router's WAN address, that is the page you want.
Everything below assumes the first problem, or a mix of the two.
Dynamic DNS, which is free and usually enough
A dynamic DNS client runs on your network, notices when your public address changes, and updates an A record to match. Your address still moves; the name stops moving with it. Duck DNS, No-IP, Cloudflare's API and most router firmwares will all do this, and for a home server the total cost is zero.
The reason to reach for it first is that it solves the actual complaint in most cases. If what you want is home.example.com to keep working when your ISP hands you a new address on Tuesday, dynamic DNS is the correct tool and buying an address is overkill.
Its limits are specific rather than general. Propagation is not instant: your record has a TTL, resolvers cache it, and there is a window after every address change where some clients still hold the old answer. That window is minutes with a short TTL, but it is not zero, and a service that must never blink will notice.
More importantly, dynamic DNS updates a name. If something on the other side needs an address — a vendor's allowlist, a corporate firewall rule, an SPF record, a game server browser that stores an IP — a name that resolves to a moving target does not help. Allowlists are checked against the address the connection actually came from, and that address keeps changing.
And dynamic DNS does nothing at all under CGNAT. It will faithfully publish an address that no one can reach.
A static address from your ISP
If your ISP will sell you one, this is the cleanest possible answer and it should be the second thing you try. The address is yours, it is on your own line, there is no tunnel, no third party, and no extra hop to add latency or fail. Nothing in this article beats it on simplicity.
Availability is the whole question. Residential plans frequently do not offer it; business plans usually do, sometimes for a modest monthly fee and sometimes only as part of a much more expensive circuit. It is worth asking explicitly and worth asking twice, because front-line support often hears "static IP" and quotes a business installation when what you want is a five-dollar line item on the plan you already have.
The trade-off is that the address is tied to the line, and therefore to the address of your house. Move, or switch provider, and you start again — new address, new DNS, new allowlist entries at every vendor who has your old one. For a server that will sit in one building for years, that is fine. For a machine that travels, or a setup you expect to move, it is a real cost that shows up later.
IPv6, if your clients have it
IPv6 addresses did not run out, so ISPs hand out real ones freely — often a /56 or /64 delegated to your router, with every device holding a globally routable address and no translation layer in the way. Inbound works natively once you open the firewall, the addresses are typically stable, and it costs nothing.
For a service whose users are you and your own devices, this is frequently the right answer and it is under-used. The catch sits entirely on the client side: whoever connects must have IPv6 themselves. A meaningful share of the internet still does not, including a lot of corporate networks and some mobile carriers, and the failure is silent — you will not get a log line telling you which visitor could not reach you. If the audience is the general public, treat IPv6 as an addition rather than a replacement.
Check with curl -6 https://ifconfig.me from the server. An answer means you already have this and it is free.
Rent a small VPS and route through it
A few dollars a month buys a virtual machine with a genuinely static public address. Run WireGuard on it, dial in from home, and forward the ports you care about across the tunnel with nftables. You now have a stable address that works from behind CGNAT, carries arbitrary TCP and UDP, and answers to nobody's product decisions but yours.
This is a legitimate and popular answer, and if you like operating infrastructure it is the cheapest real address available. What it actually costs is not the rental. You are now responsible for a second internet-facing machine: patching it, firewalling it, rotating tunnel keys, and remembering in eighteen months exactly why the forwarding rules are shaped the way they are when something stops working. Some people find that fun. If you are one of them, stop reading here.
Lease an address that is routed to your own machine
The remaining option removes the middle machine. A network that holds its own address space assigns you one address out of it, announces that address to the internet by BGP, and routes everything destined for it down a tunnel to hardware you already own. Your machine dials outbound, so CGNAT is bypassed the same way it is with any tunnel, but what lands on the far end is a whole address rather than a hostname or a handful of forwarded ports.
Practically, it behaves like the ISP static address — a fixed, public, attributable address you can hand to a vendor — except that it follows the machine rather than the building. Change ISP, move house, put the laptop on a hotel network, and the address comes with you.
Which one you actually want
If your address changes but the internet can reach you, and what you need is a working hostname, use dynamic DNS. It is free, it is five minutes of work, and it is the right answer more often than anything else on this page.
If your ISP will sell you a static address at a sane price and the machine is not going anywhere, buy it from them. One less moving part than any tunnel, ours included.
If the people who need to reach the server are you and your own devices, you may not need a public address at all — a private mesh exposes nothing to the internet and is free at that scale. That comparison is here. If the service is HTTP and a hostname is acceptable, Cloudflare Tunnel is free and very good.
You want a leased address when something on the other side insists on an address rather than a name, when the protocol is not HTTP, or when the address must survive a change of building or provider. If none of those apply, one of the free options above is a better use of your money.
Where TunnelNet fits
We lease one public IPv4 address out of our own 23.187.152.0/24, announced by BGP from AS396500, and route it to a machine you already own — a home server, a laptop, a Windows box, WSL, a Mac, or a phone. It is $10 per month for one address, an IPv6 /56 comes with it, and setup is a token from your dashboard and one install command. We announce from two US cities, Chicago and Newark, on anycast, so the internet reaches you through whichever is closer. SSH is open by default and everything else stays closed until you open it, enforced at our edge rather than on your machine.
The limits, stated plainly because you will meet them otherwise. The base plan carries inbound traffic only — your outbound still leaves through your ISP unless you take the $20 plan. Outbound port 25 is blocked, so you cannot run a mail server on it. Hub failover is automatic but takes minutes rather than seconds, because the WireGuard rekey dominates recovery. And we do not publish an availability figure, because we have not been running long enough to have measured one honestly, and quoting a number we have not earned would be worse than admitting that.
It is not a VPN and we do not sell anonymity. The address is permanently attributable to you, which is the entire point of it. Plans and prices are here.