If you run a small business, manage a home lab, or just want reliable remote access, you’ve probably hit the same wall: “Can I get a static IP on 5G home internet?” For most consumer 5G plans, the answer is “not really,” because carriers put you behind CGNAT (Carrier-Grade NAT). That blocks inbound connections and breaks classic port forwarding. The good news: you still have solid, affordable paths to host services, get whitelisted by vendors, and manage your network from anywhere even without a “true” static IP.

This guide explains, in plain language, who actually offers static IP on 5G, where the gotchas are, and the practical workarounds that work today. We’ll keep things simple, actionable, and tuned for SMBs and home-labbers.

Key Takeaways

True static IP on 5G is mainly a business feature. Verizon Business can provision a public static (with the right APN/router), while T-Mobile Home Internet is typically CGNAT-only so no classic port forwarding.
A static IP lets you host and get whitelisted, but it won’t fix weekly dropouts. For reliability, add a dual-WAN/failover router or a second link so your site stays up when the 5G gateway hiccups.
If static isn’t available or is pricey, use overlays a VPS + WireGuard + reverse proxy for full inbound access, Cloudflare Tunnel for web UIs, dedicated-IP VPN for outbound whitelisting, or Tailscale/ZeroTier for private remote control.
For your Arris on Verizon: confirm the static is active at the account/APN level, put the gateway in IP Passthrough/bridge, assign the provided subnet on your router, and test inbound reachability then lock down firewall rules and uptime monitoring.

What “Static IP” Really Means (and Why CGNAT Gets in the Way)

A static IP is an internet address that doesn’t change. With a static, you can host services (VPN, web, VoIP, cameras) and reach them from anywhere. A dynamic IP can change at any time. A public IP is routable on the open internet; a private IP isn’t and must be translated by NAT. CGNAT gives many customers one shared public IPv4 at the carrier core, which blocks unsolicited inbound traffic to your gateway so simple port forwarding won’t work. That’s why so many 5G home users find “open ports” and “DMZ” toggles useless for hosting.

Many 5G home products also enable IPv6, but carriers may filter inbound v6 or omit port-open features at the gateway, so you still can’t host the old-school way. On T-Mobile Home Internet, for example, users report IPv6 inbound blocked and IPv4 placed behind CGNAT; the practical fix is “use a tunnel or host on a VPS.”

Quick Self-Check: Do You Really Need a True Static IP?

Before we get into providers and plans, ask:

Is your need inbound or outbound?
- Inbound (publicly reachable server at home/office): You need either a public IP (static or dynamic) or a tunnel/reverse proxy solution.
- Outbound (vendor requires an IP to whitelist) You don’t need your ISP to give you a static IP you just need a stable egress IP (For example, a dedicated IP from a VPN provider or traffic egressing through a small VPS).
Do you only need secure remote management?
Tailscale or ZeroTier gives you a stable private overlay without exposing services to the whole internet.

Knowing this keeps you from overpaying for a business plan when a $5/mo VPS or a modest VPN add-on solves it.

📖 Also Read: Best Backup Internet Under $20/Month (Failover Guide)

Who Actually Offers Static IP on 5G in 2025?

Carriers change offers by region and account type. Here’s what’s consistent right now:

T-Mobile

T-Mobile Home Internet (consumer): Uses CGNAT; port forwarding isn’t supported in the normal way. Expect to rely on tunnels or reverse proxies for inbound access.

T-Mobile Business Internet: Reported support for public static IPv4 on certain business accounts/hardware via a business APN (often discussed as b2b.static). The path is through business support/sales, not consumer care. Availability, routers, and setup steps can vary, but multiple T-Mobile community threads and posts describe static IP provisioning for business lines. (Plan on calling a business rep and confirming for your location and device.)

Tip: If you’re moving from Home Internet (consumer) to Business Internet just for static IP, confirm in writing that public static IPv4 is included for your account and that your router is supported.

Verizon

Verizon 5G Home (consumer): In practice, many customers are behind CGNAT and can’t rely on ordinary port forwarding for inbound hosting. Some users can open ports in the gateway UI, but that doesn’t guarantee true public reachability. For a guaranteed public static IPv4, you generally need a Verizon Business Internet plan.

Verizon 5G Business Internet: Public Static IP is an add-on feature you can request via Business/Government Customer Operations or your account manager. Verizon’s own business welcome materials and guides note this option explicitly.

AT&T

AT&T Internet Air (consumer): This fixed-wireless product typically behaves like other consumer 5G offerings expect NAT/CGNAT and no guarantee of inbound reachability. (Community reports vary, but AT&T doesn’t advertise static on the residential product.)

AT&T Internet Air for Business / AT&T Business Wireless: AT&T’s Private Mobile Connection (PMC) and related business offerings support public static IP addressing (via dedicated or custom APN), with published terms and per-IP monthly charges in AT&T’s official legal attachments. If you need a true public static IPv4 on AT&T’s wireless network, this is the proper channel.

UScellular

UScellular Home/Small Business Internet: Their own FAQ says some services that require a fixed/static IP are not supported—a clear heads-up for those hoping to host services directly.

Starlink (not 5G, but often the same question)

Starlink Business/Priority can provide a public IPv4 (reachable from the internet), but not a true static it’s dynamic with reservation, and addresses may change after moves or software updates. IPv6 is available by default. If you must have a fixed, dedicated IPv4, consider a third-party SD-WAN/overlay provider that delivers static IP to your site over Starlink.

Example of a third-party approach: delivering “true static” to a site by tunneling over Starlink and terminating on the provider’s edge (Peplink/SpeedFusion-style). This isn’t Starlink’s own feature; it’s an overlay solution offered by vendors.

Bottom line on “who offers it”: consumer 5G home plans generally don’t. Business 5G plans from Verizon and AT&T do (as an add-on), and T-Mobile Business Internet can subject to account/hardware and provisioning. Always confirm with a business rep for your address and device.

📖 Also Read: Starlink RV vs Residential Portability (2025)

If You Can’t Get Static IP: The Workarounds That Actually Work

You do not need to throw out your 5G gateway. Here are proven patterns that work great for SMBs and home labs.

Use a Dedicated-IP VPN Add-On (Outbound Whitelisting, Some Inbound)

If your goal is outbound (For example, your payroll vendor needs to whitelist an IP), buy a dedicated IP from a reputable VPN provider and route your traffic through it. Your egress will always appear from the same IP even if your carrier uses CGNAT. This is simple to manage on a router that supports OpenVPN or WireGuard.

Some providers let you forward ports to your dedicated IP, but performance varies. For heavy or complex inbound hosting, use a VPS or reverse proxy (below) instead.

Cloudflare Tunnel (Great for Web Apps, Dashboards, SSH)

Cloudflare Tunnel (free tier available) lets you publish HTTPS services without opening inbound ports. You run cloudflared on your LAN host; Cloudflare handles the internet side. It’s great for home-lab dashboards, Grafana, Home Assistant, Proxmox, and even SSH (via Cloudflare Access). No public IP required, works fine behind CGNAT.

This is my favorite “it just works” fix for most homelab web UIs.

DIY Reverse Proxy on a $5–$10 VPS (Full Control for Any Port)

This solves everything inbound. Steps:

Rent a small VPS (choose a region close to you).
Install WireGuard on the VPS and on your on-prem router/server.
Bring your LAN services into the tunnel.
Run Nginx/HAProxy/Caddy on the VPS to terminate TLS and proxy to services over WireGuard.
For non-HTTP services (RDP, game servers, VoIP/SIP), create DNAT / iptables rules on the VPS to forward specific ports over the tunnel.

Result: you get a stable public IP (the VPS’s) and full control over what you expose—without touching carrier NAT.

Mesh VPN (Tailscale / ZeroTier) for Private Remote Access

If all you need is secure remote management, a mesh VPN is fast to deploy and easy to use. Tailscale gives you stable device names (MagicDNS), ACLs, and “exit node” options when you need to browse from home. No public IP required. It won’t give you a public-facing website, but it’s perfect for admin access, file shares, and SSH.

IPv6-Only Hosting (Niche Today)

Some carriers provide native IPv6. You could publish services over IPv6 and use a DNS AAAA record. Just remember many clients still rely on IPv4, and some carriers filter inbound v6. Consider this an add-on, not a primary path.

“Static IP Over Cellular” via SD-WAN Providers

Vendors can overlay a static public IPv4 onto your cellular link using tunnels and SD-WAN. This works with 5G FWA or Starlink and gives you the compliance-friendly, fixed IP you need—often with QoS and bonding options. Expect higher costs and managed hardware.

Dynamic DNS (when you do have a public IP)

If your ISP gives you a public, dynamic IPv4 (rare on consumer 5G), Dynamic DNS helps you keep a stable hostname. Pair it with router-level port forwards. (On many 5G home plans, you won’t get this, so prefer the VPS/reverse-proxy approach.)

📖 Also Read: AT&T Internet Air vs T-Mobile Home Internet

Recipes You Can Copy (SMB & Home-Lab)

Recipe 1: Publish a Single Web App (Home Assistant, Grafana) from T-Mobile Home Internet

Keep the T-Mobile gateway as is.
Register a domain (or subdomain) with Cloudflare DNS.
On the Home Assistant box: install cloudflared, authenticate once, and create a tunnel for https://ha.yourdomain.com to http://localhost:8123.
Add Cloudflare Access for SSO (optional).
You’re live, safely, with no open inbound ports—CGNAT doesn’t matter.

Recipe 2: Host Multiple Services (HTTP and non-HTTP) on Verizon 5G Home

Done. Even though Verizon 5G Home may sit behind CGNAT, your services are reachable through the VPS.
Rent a small VPS; install WireGuard.
Install WireGuard on your on-prem router (Ubiquiti/MikroTik/OPNsense/GL.iNet all work well).
Reverse proxy web apps on the VPS with Nginx and Let’s Encrypt.
For RDP or a game server, add DNAT rules on the VPS that forward TCP/UDP ports through the WireGuard tunnel to your LAN host.
Set DNS records to the VPS IP.
Done. Even though Verizon 5G Home may sit behind CGNAT, your services are reachable through the VPS.

Recipe 3: Need a Whitelisted IP for a SaaS (Payroll, Banking, SFTP) on AT&T Internet Air

Purchase a dedicated IP add-on from a VPN provider and configure your router to send that app’s traffic over the VPN (policy-based routing).
If the vendor insists the IP be yours alone and tied to your circuit, talk to AT&T Business about PMC with public static IP on a business wireless plan. Expect per-IP monthly fees and one-time setup.

Hardware Notes (5G Gateways and Your Router)

IP Passthrough ≠ Public IP. Even if your 5G gateway offers “bridge” or “IP passthrough,” you’re still behind carrier CGNAT unless your plan includes a public IP. Use passthrough to put your own router in charge, but don’t expect it to magically fix inbound access. (Verizon’s gateway docs describe local DHCP/static assignments, but that’s not the same as a routable public static.)

Choose a router with WireGuard/OpenVPN. Ubiquiti, MikroTik, OPNsense/pfSense, GL.iNet, and many Peplink models make tunnels easy. This is the heart of the VPS reverse-proxy design.

If you purchase a business static IP, confirm the device and APN requirements with your carrier (e.g., T-Mobile Business APN differences). Provisioning details matter.

Security Checklist (Whether You Have Static or Not)

Segment your network (VLANs) so a compromised service doesn’t reach your crown jewels.
Put exposed services behind SSO or MFA (Cloudflare Access, Authelia, ZTNA).
Keep services patched; don’t expose raw admin UIs.
Use fail2ban/geo-filters/rate limits on your VPS or reverse proxy.
Prefer SSH keys over passwords; disable password auth if possible.

FAQs

Can I get a true static IP on consumer 5G home internet?
Usually no. Consumer 5G home plans from major carriers are behind CGNAT. To get a public static IPv4, move to a business fixed-wireless plan where offered (Verizon, AT&T), or use an overlay/tunnel approach.

Does T-Mobile offer static IP on 5G?
Not on Home Internet (consumer). On Business Internet, customers report being able to request public static IPv4 via business support and specific APNs/hardware. Availability varies; confirm with a business rep.

What about Verizon 5G Home can’t I just enable port forwarding in the router?
Some router UIs show port-forwarding options, but if your plan is behind CGNAT, inbound traffic still won’t reach you. For a guaranteed static, Verizon’s Business Internet offers a Public Static IP add-on.

Does AT&T offer static IP on 5G fixed wireless?
On consumer Internet Air, don’t count on it. On business wireless, AT&T’s Private Mobile Connection (Dedicated/Custom APN) supports public static IPs for eligible devices this is the official route for wireless static IP with AT&T.

Starlink says “public IP” is that static?
Starlink Business/Priority can give you a public IPv4, but it’s not truly static; it’s dynamically assigned with reservation and can change after moves or updates. If you need a fixed static, use an overlay/SD-WAN provider or a VPS/tunnel design.

Can IPv6 fix everything?
Not today. Some carriers filter inbound IPv6 or don’t expose the controls you need. Many users and services still depend on IPv4. Plan for tunnels or a VPS if you must host reliably.

The Bottom Line

Most 5G home internet plans don’t hand you a true static public IP. They sit behind carrier-grade NAT, which blocks simple port forwarding and breaks old-school hosting at home. If you absolutely need a fixed, public IPv4 for servers, whitelisting, or compliance, your cleanest path is a business wireless plan that includes a public static IP and you should confirm device and APN details before you switch.

If a business plan is too costly or not available, you still have strong, affordable options. For public-facing apps, a $5–$10 VPS with WireGuard and a reverse proxy gives you a stable internet address and full control over what you publish. For dashboards and admin tools, Cloudflare Tunnel is simple, secure, and works great behind CGNAT. If a vendor only needs to see one steady egress IP, a dedicated-IP VPN add-on solves that without changing your ISP. And for private, day-to-day remote access, Tailscale or ZeroTier gives you a fast, safe overlay with no open ports.

Whatever you choose, keep security tight: use MFA/SSO, patch often, and avoid exposing raw admin pages to the open web. Remember that “IP passthrough” on the gateway doesn’t create a public IP by itself; it just lets your own router take the lead. Decide based on your real goal public hosting, vendor whitelisting, or private management and pick the path that matches your budget and risk. With the right setup, 5G home internet can power your small business or home lab without the headaches.

TL;DR:

You’re setting up an Arris 5G modem with a static IP from Verizon. On 5G, true static IPs aren’t standard for consumers T-Mobile is typically dynamic/CGNAT while Verizon Business Internet can provide a public static IP for its 5G gateway. If a carrier static isn’t available (or priced well), use workarounds: a dedicated-IP VPN, a VPS + reverse proxy/WireGuard tunnel, or even a second ISP for devices that must be reachable. A static IP enables reliable remote access and hosting, but it won’t fix weekly connection drops that’s a stability issue you’ll need to troubleshoot separately.