Guides
Guides on getting a machine you own reachable from the internet. Each one answers the question fully, including when the answer is a free tool rather than us.
Start here
If something outside your network cannot reach a machine you own, the first thing to establish is why — the fix for an address that keeps changing is different from the fix for an address nothing can route to. These pages are ordered roughly the way the problem usually unfolds.
Synology NAS remote access behind CGNAT
Do not put DSM on the internet — Synology says so, and 2026 gave three unauthenticated reasons. QuickConnect is free and built for this. Where it runs out, and why a NAS deserves more caution than a web server. Read it.
Home Assistant remote access behind CGNAT
For most people the official Cloud subscription is cheaper than we are and comes with voice. When it is not the right answer, and the two settings that make a working tunnel still fail. Read it.
Access an IP camera or NVR without port forwarding
Forwarding a camera to the internet is the advice that gets people watched. Why cameras are the worst thing to expose, three safer ways ranked, and the hardening that makes the last one defensible. Read it.
Reach a Raspberry Pi behind CGNAT
The thirty-second check that tells you whether CGNAT is really your problem, then the four things that work, with the commands as they run on Raspberry Pi OS — and how to harden the Pi before you put it on a public address. Read it.
1 · Reach a home server behind CGNAT
Why carrier-grade NAT breaks inbound connections specifically, a thirty-second test to confirm you are behind it, and every option that works — starting with the two that are free. Read it.
2 · Hosting a server on Starlink, T-Mobile or 5G home internet
All three put you behind CGNAT, so port forwarding cannot work. The two-minute check that settles it for your own line, why IPv6 is often enough and free, and the two wrinkles specific to mobile and satellite links. Read it.
3 · Hosting a game server from home
The one case where the free tunnels do not fit: players type an address and a port, the traffic is UDP, and you cannot ask strangers to install a VPN. What to open, why your upload speed decides the player count, and when to just rent a host. Read it.
4 · Is a VPN the same as a public IP?
No — close to opposites. A VPN changes the address you come from and shares it with everyone else. A public IP gives you one people can reach. Which one you actually want, and the four different answers to “what is my IP”. Read it.
5 · Static IP for a home server
“Static IP” means two different things and most people need the other one. Dynamic DNS, an ISP static address, IPv6, a VPS, or a leased address — what each actually gives you. Read it.
6 · A fixed outbound IP for vendor and API allowlisting
When a vendor asks which address you will call from, a home connection cannot answer honestly. What an allowlist actually needs, three ways to get it, and how to check it is true before you give anyone the number. Read it.
7 · An ngrok alternative that gives you a real IP
ngrok is the best tool there is for an afternoon and the wrong one for a year. What replaces it, including three replacements that cost nothing. Read it.
8 · Cloudflare Tunnel vs a dedicated IP
For a web service Cloudflare Tunnel beats buying an address on most axes that matter, and the page says so. Also the four specific places it stops fitting. Read it.
9 · Tailscale Funnel vs a public IP
Most people who think they need a public address need a private network instead. Where that stops being true. Read it.
10 · Can you run a mail server from home?
You can receive mail on one of our addresses. You cannot send it — we drop outbound port 25 on purpose, and no address in our range has a PTR record yet. Why both are true, and what to use instead. Read it.
11 · Using TunnelNet with a corporate VPN
TunnelNet egress works alongside most split-tunnel corporate VPN clients on desktop. Inbound does not work under a full-tunnel VPN. Phones allow one VPN at a time. And we will not help you bypass a control on hardware you do not own. Read it.
For businesses and developers
These four are about outbound identity — the address you appear to come from — rather than about being reachable. If somebody is asking you for an IP to put on a list, start here.
12 · Your vendor asked for a static IP for whitelisting — what to send them
The four things to put in the reply, the answers that get rejected in a security review, and how to verify your own egress address before you put a number in writing. Read it.
13 · A static outbound IP for AWS Lambda
Lambda egresses from shared AWS addresses that change. The NAT Gateway route, what it costs at AWS's own published rates, and when routing one partner call through an address you hold is cheaper and simpler. Read it.
14 · Locking a payment API key to an IP address
Stripe recommends an access policy on every live key, and the strong version of that control needs an address that is stable, dedicated and attributable. How to turn it on without an outage. Read it.
15 · Dedicated IP vs shared proxy
Most static-IP proxy plans sell a slot on a shared exit, and their own pricing pages say so. What changes when the address is yours alone, what the market charges for each, and the cases where shared is the right answer. Read it.
16 · A static outbound IP for Supabase Edge Functions
Supabase documents that Edge Functions cannot have a static egress IP. Why the Dedicated IPv4 add-on solves the opposite problem, when to change the architecture instead, and how to route one allow-listed call through an address you hold. Read it.
17 · A static outbound IP for Heroku
Common Runtime dynos change address on every restart, deploy and daily cycle. What Private Spaces fix, what the proxy add-ons actually sell you, and when a dedicated address is the better trade. Read it.
18 · A static IP for GitHub Actions
Hosted runners share IP ranges with every GitHub Actions user, so allow-listing them admits all CI. Larger runners, the free self-hosted answer, and when one fixed source address is worth it. Read it.
19 · A static outbound IP for Vercel
Vercel sells Static IPs at $100/month per project and documents that the addresses are shared with a small group of customers. When that is the right buy, and the two cases where an address you hold wins. Read it.
20 · A static IP for Zapier
Zapier includes a static IP on Professional and above, but not on Free and not for every app. Which direction your problem actually runs, and when one address across Zapier and everything else is worth it. Read it.
21 · A static outbound IP for Render
Render services already egress from static addresses, but the default ranges are shared with other Render services in the same region. What Dedicated IPs give you, and the one case an unattached address still wins. Read it.
22 · A static outbound IP for Railway
Railway has a Pro-plan toggle for static outbound IPs, and states the addresses may be shared with other customers. When that is fine, and the three cases where it is not. Read it.
23 · A static outbound IP for Netlify Functions
Netlify staff say there is no list of Netlify IP addresses for allowlisting. The free alternatives worth trying first, and how to route one allow-listed call through an address you hold. Read it.
What we sell, in one line
One public IPv4 address from our own 23.187.152.0/24, announced by BGP from AS396500
and routed to a machine you already own, from $10/month. It is inbound-only on the
base plan, outbound port 25 is blocked, failover between our two hubs takes about 25 seconds when a
hub fails completely and does not happen automatically at all when a hub stays up but stops
forwarding, and we publish our measured availability rather than an
SLA. It is not a VPN, and the address is attributable to you.
Plans and prices.