Plus
$2/mo
- 1 dedicated IP address
- 10 devices
- 5 open ports
- 100 GBbandwidth
- 20 Mbpsspeed
If your ISP uses CGNAT, port forwarding can't work. GetAStatic gives you a dedicated public IPv4 over WireGuard. Pro ($4/mo) fits most game servers, media servers and remote desktops: 100 Mbps, 1 TB a month. Plus ($2/mo) is 20 Mbps, for light use.
Not affiliated with Cloudflare, Tailscale, playit.gg, ngrok, Comcast or any other ISP. Prices as listed on their sites, checked 2026-10-06.
Updated
The usual fixes, side by side. A dedicated IP over WireGuard is the one that gives you a real public address without a new ISP plan or a server to run.
| Feature | GetAStatic | ISP static IP | Cloudflare / Tailscale | playit / ngrok | VPS + WireGuard |
|---|---|---|---|---|---|
| Price | From $2/mo | ~$20/mo (reported) | Free | Free tiers | VPS rent |
| Your own public IPv4 | Yes, dedicated | If the ISP sells | No, shared hostname | No, shared address | Yes, the VPS IP |
| Any port, TCP and UDP | Yes, ports you open | Yes | Web ports, no UDP | Assigned ports | Yes, your own rules |
| Software your visitors need | None | None | None for websites | None | None |
| Setup time | About 5 minutes | Days, if allowed | Minutes per hostname | Minutes, agent always on | An hour, then upkeep |
An ISP static IP usually needs a business plan; the figure is Comcast Business static IP, from third-party reports. Plus opens 5 ports, Pro and Ultra unlimited. Checked 2026-10-06.
Carrier-grade NAT (CGNAT) means your ISP shares one public IPv4 address among many homes. Your router gets an address from the shared range 100.64.0.0/10 (RFC 6598), not a public one. A NAT system inside the ISP's network turns it into the shared public address.
ISPs do this because IPv4 addresses ran out. New addresses cost money to buy or lease, and 5G home internet, satellite and many fiber and cable networks have far more customers than addresses.
Outbound traffic works as normal, so browsing and streaming feel fine. Inbound traffic does not. A connection to the shared IP stops at the ISP's NAT, which does not know which home it is for, so it drops it. A port forward on your router never sees the packet. Dynamic DNS does not help either: the name points to an address you do not own. Port forwarding not working? walks through every cause.
Plus for light use, Pro for most people, Ultra for full gigabit.
5× speed · 10× bandwidth · 2 IPs — only $2/mo more
Pricing based on crypto.
Use the Free CGNAT check, or check by hand. It takes two minutes and needs no tools.
If the WAN IP is a public address, CGNAT is not the cause. Check your router, a firewall or a blocked port.
A dedicated IP over WireGuard is its own kind of fix. You rent a static public IPv4 that lives on a server outside your ISP. Your device or router keeps a WireGuard tunnel open to that server. The tunnel starts from your side, so CGNAT lets it through like any other outgoing connection.
With GetAStatic, the server side is ours. Your IP sits in Kansas City, Missouri or San Jose, California. Every new IP starts with all inbound ports closed. You open the TCP or UDP ports you need in the dashboard, and connections to those ports come down the tunnel to your device. Outbound traffic leaves from the same IP, so it also works as a fixed address for allowlists.
You get the result of a VPS running WireGuard without the VPS: no server to rent, secure or update, and no forwarding rules to write.
Run WireGuard on the machine that hosts the service, or on your router to cover the whole network.
The tunnel connects out on UDP 1194 or 443, so it works on almost any network. If a network blocks WireGuard, switch the IP to AmneziaWG in the dashboard. It is on every plan.
It is the shared address space set aside for CGNAT in RFC 6598: 100.64.0.0 to 100.127.255.255. If your router's WAN IP is in it, your ISP runs CGNAT, and nothing on the internet can reach your router directly.
Sometimes. Some ISPs move you to a public IP on request or sell a static IP add-on. Many 5G and satellite plans do not, and others sell it only with a business plan. Starlink and T-Mobile Home Internet have their own guides. If the answer is no, a tunneled IP gives you the same result.
Partly. If your ISP gives you IPv6, your device may be reachable over IPv6. But each visitor needs IPv6 too, and many networks, games and apps still connect over IPv4. A public IPv4 reaches everyone.
A tunnel can serve a simple website, but it stops there. Cloudflare Tunnel carries web traffic and gives you no public UDP. Tailscale Funnel only uses ports 443, 8443 and 10000. playit and ngrok give you shared addresses and assigned ports, and their agent must keep running. A dedicated IP serves websites and every other TCP or UDP port at one fixed address, so it is the simpler, complete fix. See the Cloudflare Tunnel alternative and playit.gg alternative pages.
No. A VPS running WireGuard gives the same result, but you rent it, secure it and keep it updated. GetAStatic runs the server side for you. Compare the two.
Yes, through your router. Put the config on a router that runs WireGuard, such as GL.iNet, OpenWrt, pfSense, OPNsense or MikroTik, and point each open port at the right device. Router setup.
Have more questions? See the full FAQ →