Plus
$2/mo
- 1 dedicated IP address
- 10 devices
- 5 open ports
- 100 GBbandwidth
- 20 Mbpsspeed
Verizon's 5G gateways have a Port Forwarding page. A rule works only if the gateway's WAN address is a public IPv4. If it is, you are done. If not, GetAStatic gives you a static IPv4 over WireGuard with your chosen ports open, from $2/mo.
Not affiliated with Verizon. Facts as listed on Verizon's support pages, checked 2026-10-07.
Updated
| Port forwarding on the gateway | Yes. Advanced > Security & Firewall > Port Forwarding in the admin page |
|---|---|
| Admin page | mynetworksettings.com, or 192.168.1.1 (ARC-XCI55AX, WNC-CR200A) and 192.168.0.1 (ASK-NCQ1338, ASK-NCQ1338FA) |
| IP passthrough | Yes. The address Verizon assigns goes to the device on the LAN2 port, and Wi-Fi turns off |
| Public IPv4 on the WAN | Not documented by Verizon. Check your gateway (steps below) |
| Static IP | Not listed for 5G Home. Verizon Business Internet lists a reserved public static IP |
| GetAStatic | A static IPv4 and the ports you open, on any WAN address, from $2/mo |
Checked .
Verizon documents port forwarding on its 5G Home equipment. On the Internet Gateway models (ARC-XCI55AX, ASK-NCQ1338FA and WNC-CR200A), open the admin page, click Advanced, then Security & Firewall > Port Forwarding. A rule takes an application name, the inbound and outbound ports, the destination device and the protocol, then Apply Changes. On the 5G Home Router, use System Settings > Port Forwarding.
A rule tells the gateway one thing: when a connection arrives on its WAN side on port X, send it to this device on your network. That is ordinary router NAT, and it is the part you control.
The rule only acts on traffic that reaches the gateway, and that depends on the IPv4 address Verizon gives the gateway's WAN side. If it is public, the rule does its job. If it is shared or private, a second NAT inside Verizon's network sits in front, with no rule for your home. The connection ends there, and your rule looks broken even though every field is right.
Many users report a shared address on 5G Home, but Verizon's support pages do not say which kind of address a line gets. Check your own before you change anything. A WAN address in 100.64.0.0/10 (100.64.0.0 to 100.127.255.255) is carrier-grade NAT (CGNAT, RFC 6598). A 10.x, 172.16.x to 172.31.x or 192.168.x address is private. With nothing of yours in front of the gateway, that NAT is Verizon's too.
Your own static IP over WireGuard. No VPS.
Dedicated IPv4 from $2/mo →Do these in order. The first two tell you whether the block is at your end or at Verizon's.
If the WAN address is public and the port check shows the port open, Verizon's own port forwarding works and you probably do not need GetAStatic for this.
If your WAN address is public, fix the local cause the checks point to. Verizon does not list a static IP for 5G Home, so the address may change; a dynamic DNS name that follows it is enough for most home servers.
If the WAN address is not public, no setting on the gateway helps. DMZ Host sends inbound traffic to one device and IP passthrough hands the WAN address to your router, but both still wait for connections that cannot reach that address. One way out is a Verizon business plan: Verizon lists a reserved public static IP for its Business Internet (5G and LTE). The other is an address from outside Verizon's network.
GetAStatic is that address: a VPN with a dedicated static IPv4 in Kansas City, Missouri or San Jose, California. Your host or your own router connects out to our node over WireGuard on UDP 1194 or 443. Outgoing connections pass through any NAT, so the tunnel is not blocked. Connections to your IP on the ports you opened come back down it, and the gateway's forwarding rules no longer matter.
Run WireGuard on the machine that hosts the service, or on your own router behind the gateway.
Plus includes 5 open ports; Pro and Ultra have unlimited open ports. A port range counts as its size.
Plus for light use, Pro for most people, Ultra for full gigabit.
5× speed · 10× bandwidth · 2 IPs — only $2/mo more
Verizon's support pages do not say, so do not assume it either way. If the gateway's WAN IPv4 matches what a what-is-my-IP site shows, your address is public and port forwarding on the gateway can work.
Only if the address is public. IP passthrough hands the address Verizon assigns to the device on the LAN2 port, so your own router can do the forwarding. If that address is shared or private, your router gets the same unreachable address and its rules fail the same way.
Usually not. DMZ Host sends every unsolicited inbound connection to one device, which exposes all of its ports. It has the same limit as a forward: if the WAN address is not public, nothing arrives. Forward only the ports you need.
Probably not for this problem. If the WAN address is public and an outside test reaches your service, Verizon's own forwarding is enough. GetAStatic helps when the address cannot accept connections, or when you want an IP that does not change.
Connecting to your own public IP from inside your network needs NAT loopback, and some gateways do not do it. Test from outside: the port check, or a phone with Wi-Fi turned off.
Have more questions? See the full FAQ →