Fixed IP, CGNAT, and Why Your Business Fiber Hits a Ceiling
Your fiber tests fine on a speed test, yet the site-to-site VPN drops, remote access is flaky and your emails land in spam. The bottleneck is often not bandwidth. It is how your operator hands you an IP address.
What CGNAT Actually Is
IPv4 addresses ran out, so most consumer and low-cost pro offers put hundreds of customers behind a single public IPv4 using Carrier-Grade NAT (CGNAT). Your router gets a private address (typically in 100.64.0.0/10) and shares its public identity with strangers.
Outbound browsing works. Everything that requires being reachable from outside, or being identifiable as you, degrades or fails.
The Symptom List
Inbound connections fail
Site-to-site VPN endpoints, RDP gateways, self-hosted services and camera systems cannot receive connections: there is no port of yours to open.
VoIP and video degrade
SIP and media streams behind double NAT lose registration and drop audio. Keep-alives paper over it until they do not.
Shared reputation
You share your public IP with unknown parties. If one of them spams or scrapes, you inherit the blacklisting, the captchas and the rate limits.
Sessions time out
CGNAT gateways hold state tables. Long-lived connections (databases, monitoring, SSH tunnels) get cut when the table evicts you.
Step One: a Real Fixed IP
A fixed public IPv4 (and a /48 of IPv6) puts you back on the internet as a first-class endpoint: inbound flows work, PTR records are yours, reputation is yours alone. On a dedicated line this is not an add-on: our enterprise fiber (FTTO) includes static IPv4 and a /48 IPv6 by default.
Be precise when comparing offers: "IP fixe" sometimes means a fixed private address still behind CGNAT. The question to ask is: do I get a public IPv4 routed to my interface, with reverse DNS delegation?
When a Fixed IP Is Not Enough
One fixed IP still ties you to one operator. If your business cannot tolerate single-operator failure, or you need to keep your addresses when you change providers, you are describing multihoming.
BGP and multihoming
Announce the same addresses over two links or two operators, and let routing converge around failures. See BGP peering.
Your own ASN
Provider independence starts with an AS number registered to you. Our ASN registration service handles the RIPE procedure.
Your own address space
Portable addresses that survive an operator change: leased quickly, or allocated permanently. Start with IPv4 leasing.
Fixed IP and CGNAT FAQ
Compare the WAN address on your router with the address a what-is-my-ip service reports. If they differ, or the WAN address is in 100.64.0.0/10, you are behind CGNAT.
Partly. Native IPv6 restores end-to-end reachability between IPv6 hosts, but most business constraints (partner VPNs, legacy systems, allowlists) still assume IPv4. You need both: a public IPv4 and routed IPv6.
For one operator and standard availability, yes. If the VPN must survive an operator outage, you need two links and dynamic routing (BGP) on top, not just fixed addressing.
Diagnose Your Connectivity Ceiling
Describe your setup and constraints. A network engineer tells you whether the fix is a fixed IP, a dedicated line or a BGP design, and quotes accordingly.