In brief: A dedicated (or static) IP address is a publicly routable IPv4 that belongs exclusively to you — no sharing, no crowd to hide in. A shared IP, whether from a home ISP connection behind CGNAT or from a standard VPN plan, mixes your traffic with many other users, which is better for privacy but blocks all incoming connections. A dedicated IP matters when you need stable access for IP whitelisting, remote desktop, banking logins that flag new addresses, or a self-hosted server. For anonymity, a shared VPN IP is the better choice — dedicated and static IPs reduce it.
What is a dedicated, shared, static, and CGNAT IP address
Every internet-connected device has an IP address, but not all IP addresses are equally reachable from outside. The key concept is routability: can another device on the internet initiate a connection directly to your address, or are you hidden behind someone else's equipment?
A public IP address is a globally routable IPv4 that the internet can reach directly. If your router's WAN interface has a public IP, any server or device worldwide can in principle connect to an open port on your network.
A CGNAT IP — called a "grey IP" in Russian-speaking regions — is what most home ISPs hand out today. CGNAT stands for Carrier-Grade NAT (also known as Large-Scale NAT or NAT444): the ISP places thousands of subscribers behind a single shared public IPv4, while each subscriber's router WAN gets a private address from the RFC 6598 range (100.64.0.0/10). From the internet's perspective you have no unique address — no incoming connection can reach you. The NAT444 name describes exactly this: three levels of network addresses (your LAN → provider CGNAT space → real public IP) with NAT translation at each boundary.
With the global IPv4 address pool exhausted, CGNAT has become the default for residential broadband in 2026. A public IP is increasingly a paid add-on rather than the default.
Static vs dynamic: a public IP can be dynamic (it changes when your router reconnects) or static (permanently assigned). A dynamic public IP still allows incoming connections — DDNS (Dynamic DNS) solves the address-changed problem by mapping a fixed hostname to your current IP automatically.
Dedicated, shared, static, dynamic and CGNAT: comparison
Here is how the main IP address types compare across the dimensions that matter most in practice:
| IP Type | Reachable from internet | Address stability | Anonymity | Typical use case |
|---|---|---|---|---|
| CGNAT (shared ISP) | No | N/A | High (shared) | Standard home broadband |
| Dynamic public IP | Yes | Changes on reconnect (DDNS helps) | Medium | Home server with DDNS |
| Static public IP | Yes | Permanent | Low (unique to you) | Business office, permanent server |
| Shared VPN IP | No* | Session-dependent | High (traffic mixed) | Private browsing, anonymity |
| Dedicated VPN IP | Yes (via VPN server) | Permanent | Lower (unique to you) | Whitelisting, banking, remote work |
* A shared VPN IP does not accept incoming connections. You need a dedicated IP or a VPN tunnel into your own network for that.
The key takeaway: dedicated, public and static IPs are about accessibility and stability. Anonymity requires a shared IP. These are different goals. Do not pay for a dedicated IP expecting privacy — it reduces it.
How to check whether you have a public IP or are behind CGNAT
A quick two-step check is all you need:
- Step 1: Find your router's WAN IP. Log into your router admin panel (typically 192.168.0.1 or 192.168.1.1) and look for the WAN or Internet Status section. Note the IP address shown there.
- Step 2: Compare with your visible public IP. Visit any "what is my IP" site and note the IP shown there.
- If both match: you have a public IP — either dynamic or static.
- If they differ: you are behind NAT. If the router WAN starts with 100.64–100.127, that is the RFC 6598 range — a definitive sign of CGNAT.
- Ask your ISP directly. Contact support and ask: "Do I have a public IP? Am I behind CGNAT?" This is the fastest and most reliable way.
What to do with a dynamic public IP
A dynamic public IP is fully functional for incoming connections. The only challenge is that the address changes periodically. The solution is DDNS (Dynamic DNS): a service that maps a fixed hostname (e.g. myhome.ddns.net) to your current IP and automatically updates the DNS record whenever your address changes. Most modern routers support DDNS natively.
When you actually need a dedicated or public IP
A public or dedicated IP is a specific tool for specific needs — not a universal upgrade. Here are the real scenarios where it matters:
- Remote access to your home network. Connecting from a hotel or office to your home NAS, desktop via RDP, or home lab server requires incoming connections — impossible behind CGNAT without extra intermediaries. Learn how to secure this in our article on securing your home network with a VPN.
- Remote IP camera viewing. Watching your security camera feed from anywhere is a classic use case. Without a public IP you need either the camera manufacturer's cloud P2P relay or a VPN tunnel into your home. More on camera security: how to protect your IP camera from hacking.
- Self-hosted game or media server. Running a game server, Minecraft, Jellyfin, or Plex for friends requires that clients can connect to you — that means a public IP and an open port.
- Site-to-site VPN between locations. Joining two offices, or an office and a home, into one network via a VPN tunnel requires at least one side to have a public IP. More details: what is a site-to-site VPN.
- IP whitelisting for work tools. Some corporate VPNs, banking APIs, and SaaS platforms only allow access from approved IP addresses. A static dedicated IP means you configure it once and stop being locked out every time your address rotates.
- Home lab or small web service. Running a dev API, home lab, or test site accessible from the internet requires a public IP.
Dedicated IP and privacy: the honest trade-off
A dedicated or static IP is convenient for incoming access, but it works directly against privacy goals. Understanding this trade-off matters before you commit to one.
De-anonymisation risk. A static dedicated IP belongs exclusively to you. Every request, connection, and server log can be attributed to the same single identifier. ISPs, platforms, and third parties can build a detailed activity profile from one address. A shared VPN IP or CGNAT connection provides "cover in the crowd" — your traffic is indistinguishable from that of many other users behind the same address.
If your goal is to conceal your IP and reduce your digital footprint, see our article on how to hide your IP address — the opposite use case.
Exposure to internet scanners. A public IP is continuously scanned. Tools like Shodan and mass port scanners sweep the entire public IPv4 range looking for open ports and vulnerable services. Behind CGNAT, your router has no unique public address — it is invisible to these sweeps. A public IP makes you a specific, findable target.
This is not a reason to avoid a public IP if you need one — it is a reason to harden your setup: close all unnecessary ports, keep router firmware updated, use strong passwords on all exposed services, and consider a VPN tunnel rather than opening ports directly.
The honest summary: dedicated IP = accessibility and stability, at the cost of reduced anonymity. Shared IP = privacy and crowd cover, but no incoming connections. Choose based on your actual need.
How to get a dedicated or public IP address: checklist
There are several paths, from the simplest to the most technical:
- 1. Request a static or public IP from your ISP. Contact your ISP support and ask about adding a static public IP to your plan. Many providers offer it as an add-on. This is the simplest path — no extra hardware or complex configuration. Ask whether it will be static or merely a dynamic public (non-CGNAT) IP.
- 2. Rent a VPS with a dedicated IP. A Virtual Private Server gives you a dedicated public IP and full control: you can run your own VPN server, web server, or reverse proxy. A detailed comparison: VPS vs VPN: what is the difference. More flexible but more technical.
- 3. Get a dedicated IP from a VPN provider. Some VPN services, including LiMP VPN, offer a dedicated fixed-IP option on their servers. You get a permanent public address without managing your own server — ideal for whitelisting, banking platforms, and stable remote work connections. See available options at LiMP VPN servers.
- 4. Set up a VPN tunnel into your home network (if remote access is all you need). If you only want to reach your home devices from outside, you do not need a public IP at all. Running WireGuard or OpenVPN on your home router plus DDNS solves the problem: the client initiates an outbound connection, so no incoming public IP is required. Cheaper, more private, and works behind CGNAT.
- 5. Use DDNS if you already have a dynamic public IP. Configure a DDNS client on your router. Most modern models support No-IP, DynDNS, or Cloudflare DNS natively. You get a permanent hostname that always resolves to your current IP.
- 6. Migrate to IPv6. IPv6 was designed with a globally routable address for every device — CGNAT does not exist in a pure IPv6 environment. If your ISP and all your hardware support it, IPv6 is the structural long-term solution.
Which to choose: ISP static IP, VPS, or dedicated VPN IP
The right choice depends entirely on your actual use case:
- Just need to access my home devices remotely → set up a VPN tunnel into your home network (WireGuard + DDNS). No need to buy a public IP — this works even behind CGNAT.
- Need a stable personal address for whitelisting, corporate VPN, or banking → dedicated IP from a VPN provider (e.g. LiMP VPN servers) or your own VPS. Easier to manage than an ISP contract.
- Need full control: own server, web hosting, custom VPN → VPS. More expensive, fully flexible. Compare: VPS vs VPN.
- Business or permanent office use → static IP from your ISP — simplest option if your provider offers it.
For most home users who only need occasional remote access, a VPN tunnel into their own network is sufficient — no public IP purchase needed. A public IP is the right tool when you genuinely need to be reachable from outside.
Frequently asked questions
What is the difference between a dedicated IP and a shared IP?
A dedicated IP belongs exclusively to one subscriber: all connections associated with that address are yours alone. A shared IP is simultaneously used by many users — your traffic is mixed with theirs, giving better anonymity but no incoming connection support. VPN plans use shared IPs by default; a dedicated IP is an add-on.
How do I know if I am behind CGNAT?
Compare the WAN IP shown in your router admin panel with the IP shown on a "what is my IP" website. If they differ, you are behind NAT. If the router WAN address falls in the 100.64.0.0/10 range (100.64.x.x through 100.127.x.x), that is the RFC 6598 range — a definitive sign of CGNAT. When in doubt, ask your ISP directly.
Is a static dedicated IP dangerous for privacy?
Not automatically dangerous, but it does reduce privacy. A static IP is permanently linked to you: every log entry and connection can be attributed to one identifier. It also makes you a specific target for internet scanners sweeping public IP ranges for open ports. Good mitigations: close unnecessary ports, keep firmware updated, use strong passwords, and use a VPN tunnel rather than opening ports directly.
Do I need a public IP to watch my security camera remotely?
Not necessarily. A VPN tunnel into your home network is often sufficient: your device connects outbound to the VPN server and the camera stays behind your router — no incoming public IP needed. A public IP is only required if you want to expose the camera port directly to the internet, which is less secure anyway.
Dedicated VPN IP or static ISP IP — which is better?
It depends on your use case. For remote access to your home: a VPN tunnel without a public IP. For a stable address for whitelisting or corporate tools: a dedicated VPN IP is often easier to manage. For full server control: a VPS. For permanent business use from a fixed location: ISP static IP.
Does a dedicated IP reduce anonymity?
Yes. A static or dedicated IP is uniquely tied to you — all your activity can be associated with one identifier. For anonymity, a shared VPN IP is better: your traffic is indistinguishable from that of many other users behind the same address.
Can I get a public IP address for free?
Rarely in practice. Most ISPs charge extra for a static public IP. VPS and VPN services with dedicated IP options cost money too. The closest to free is IPv6: every device gets a globally routable address by default with no CGNAT. But for many use cases — particularly remote access to your own home — you do not need a public IP at all; a VPN tunnel handles it.