Starlink does not offer a true static IP address on any plan. What it does offer — a public IPv4 on Priority/Business plans — is close, but not the same thing. Whether you need it for remote access, security cameras, gaming, hosting a server, or running a VPN, the answer depends entirely on your plan and what you’re trying to accomplish. This guide covers all of it plainly.
These are the questions people ask after getting Starlink and discovering their old port forwarding setup no longer works. Answered without the runaround.
No. Starlink does not offer a true static IPv4 address on any plan — residential, Priority, Business, or otherwise. What it does offer on the Priority and Business tiers is a public IPv4 address, which behaves somewhat like a static IP in practice but is technically dynamic. Starlink reserves the right to change it at any time. In real-world use, the public IP on a Priority plan often stays the same for months unless you restart the dish or Starlink reconfigures its network. But it is not guaranteed, and you cannot depend on it for anything that requires an address that must never change.
A CGNAT address — Carrier-Grade Network Address Translation. Your router’s WAN IP will show something in the 100.64.x.x range, which is a private address block reserved by RFC 6598 specifically for this purpose. Multiple Starlink customers share a single public-facing IP address, multiplexed by port. The practical consequence: you cannot receive any inbound connections from the internet on a Residential plan. Port forwarding does not work. Remote access to a NAS, security cameras, game servers, or a home VPN endpoint is not possible through standard methods. The internet sees a shared address, not yours specifically.
The Starlink Priority plan (starting at $65/month for 50GB of priority data) gives you the option to enable a public IPv4 address from your account dashboard. It is off by default — you must turn it on manually, which triggers a dish reboot. Once enabled, you receive a real, routable IPv4 address that the internet can send traffic to directly, and port forwarding through a third-party router becomes possible. The address is not static — it can change when Starlink reconfigures its network or if you get a new gateway — but many users report the same address holding for a year or longer without changing on its own. A third-party router is required for port forwarding because the Starlink-supplied router does not support it on any plan.
Three solid paths exist that don’t require upgrading your plan. Tailscale (free for personal use) installs on both your home device and your phone or laptop, creates a private encrypted mesh network between them using the WireGuard protocol, and routes traffic peer-to-peer — completely bypassing CGNAT without any ISP cooperation needed. Tailscale is the most recommended solution in the Starlink community for exactly this use case. Cloudflare Tunnel (also free) creates a secure outbound connection from your home network to Cloudflare’s edge, so inbound requests arrive through Cloudflare without needing any public IP or port forwarding at home. IPv6 is a third option — Starlink assigns a public /56 IPv6 prefix to every customer on every plan, meaning your devices already have publicly routable IPv6 addresses. This requires a third-party router with firewall rules configured to allow specific inbound traffic.
For most games — no. Outbound gaming traffic works normally under CGNAT; you can connect to game servers, play multiplayer, use voice chat, and stream content without issue. The situations where CGNAT causes real gaming problems are narrower: hosting a game server that other players must connect to directly (your IP), NAT type warnings in games that require open NAT (like some Call of Duty titles or peer-to-peer matchmaking systems), and services that IP-whitelist your connection for security. If your games show “Strict NAT” or “NAT Type 3,” that is a CGNAT symptom. Tailscale resolves this for hosted servers; for NAT type specifically, upgrading to Priority with a public IP and a third-party router set to DMZ mode is the most reliable fix.
Yes, Starlink is fully dual-stack — it supports both IPv4 and IPv6 on all plans, including Residential. Every Starlink customer receives a /56 IPv6 prefix via DHCPv6 Prefix Delegation, which means each device on your network can receive its own globally routable IPv6 address. This effectively solves the “I can’t receive inbound connections” problem — but only if the device you’re trying to reach also supports IPv6, and only if you configure your third-party router’s firewall to allow inbound IPv6 traffic to that device. The Starlink-provided router blocks all outside traffic by default and has no configurable firewall settings, so a third-party router is required here too. IPv6 addresses on Starlink can also change when the /56 prefix is reassigned, though this happens less frequently than IPv4 changes under CGNAT.
Yes — with an important limitation. VPN providers like Private Internet Access (PIA) offer plans with a dedicated IP address as an add-on, typically $5–$8 per month extra. Your traffic exits through that fixed IP, which satisfies IP-whitelisting requirements and gives you a stable identity on the internet. What it does not solve: using a commercial VPN’s dedicated IP for inbound connections back to your home network, like remote access to a NAS or camera system. Commercial VPN dedicated IPs work in one direction — outbound. For true inbound remote access through CGNAT, Tailscale, Cloudflare Tunnel, or a self-hosted VPS reverse proxy are the correct tools. Many users confused by this distinction end up paying for a VPN dedicated IP and still can’t reach their home devices.
Starlink has publicly acknowledged that static IPv4 addresses may be offered in the future as a paid add-on, but no timeline has been announced. The constraint is technical and economic: IPv4 addresses are genuinely scarce globally, and reserving one permanently per customer is costly. The long-term trajectory of the internet is toward IPv6, which eliminates the scarcity problem entirely. Practically speaking, most users who think they need a static IP actually need one of two things: a reliably reachable home network (solved by Tailscale or Cloudflare Tunnel), or a stable outbound identity (solved by a VPN with a dedicated IP). True static IPs are primarily needed for specialized business infrastructure — IP-locked software licensing, BGP routing, or hardcoded enterprise firewall rules — and for those use cases, the Priority plan’s persistent public IP is often sufficient.
Not all Starlink plans handle IP addresses the same way. Here is exactly what each plan gives you for IP addressing, inbound connections, and port forwarding — the information Starlink’s marketing page doesn’t make obvious.
| Plan | IP Type | Inbound Connections? | Port Forwarding? | Public IPv4? | Best For IP Needs |
|---|---|---|---|---|---|
| Residential (Standard) | CGNAT (shared) | ✗ Blocked | ✗ Not possible | ✗ No | General browsing, streaming, gaming (outbound only) |
| Priority (Local) | Public IPv4 (dynamic, opt-in) | ⚠ With 3rd-party router | ⚠ With 3rd-party router | ✓ Enable in dashboard | Home servers, remote access, open NAT gaming |
| Business / Enterprise | Public IPv4 (dynamic, opt-in) | ⚠ With 3rd-party router | ⚠ With 3rd-party router | ✓ Enable in dashboard | Business infrastructure, multi-site connectivity |
| All Plans — IPv6 | /56 prefix (public) | ⚠ With 3rd-party router + firewall rules | ✓ Native (no NAT) | ✓ All devices | IPv6-capable devices with compatible router |
| True Static IPv4 | — | ✗ Not available | ✗ Not available | ✗ Not offered | Use Tailscale, Cloudflare Tunnel, or VPS instead |
CGNAT is the technical reason your old port forwarding setup stopped working when you switched to Starlink. Understanding it takes two minutes and makes every workaround easier to choose correctly.
IPv4 addresses — the traditional four-number addresses like 192.168.1.1 — are a finite resource. The internet exhausted its available pool of public IPv4 addresses years ago. To keep assigning internet connections without running out, Starlink (like most large ISPs) uses Carrier-Grade NAT, which lets hundreds of customers share a single public-facing IP address. Each customer’s router gets a private address in the 100.64.0.0/10 range, which is reserved by RFC 6598 specifically for this purpose. Starlink’s network sits in front of all those private addresses and translates outbound traffic — which works fine — but has no way to route unsolicited inbound traffic to any specific customer, because it doesn’t know which of hundreds of customers a packet should go to.
Open your Starlink router’s admin page (192.168.100.1 by default) and look at the WAN IP address it shows. If it starts with 100.64 through 100.127, you are behind CGNAT. A second method: visit whatismyip.com from a browser on your network, then compare that IP to what your router shows. If the two addresses are different, CGNAT is in place — your router has an internal address and Starlink’s infrastructure holds the public one. If you’re on a Residential plan, you will almost certainly see a CGNAT address. This is not a misconfiguration or a problem with your hardware — it is how Starlink’s Residential service is designed to work.
CGNAT breaks:
- Port forwarding — inbound traffic can’t reach your home network
- Remote access to home devices — cameras, NAS, home assistant, Plex (without a relay)
- Hosting a game server that other players connect to via your IP
- Running a web, email, or application server at home
- IP whitelisting — your address changes and you can’t guarantee which IP you’ll appear from
- Strict NAT gaming on platforms that require open NAT or peer-to-peer connections
CGNAT does not break: general web browsing, video streaming, video calls, outbound VPN connections, online gaming (as a client, not a server), or any activity that you initiate from your side. The vast majority of home internet use works fine under CGNAT.
Each of these solves a specific version of the static IP problem. Match the workaround to your actual need — most people only need one.
Tailscale is consistently the top recommendation in the Starlink community for anyone who needs to reach home devices remotely. It installs on both ends — your home server or NAS, and your phone or laptop — and uses the open-source WireGuard protocol to build a private encrypted network between them. Traffic routes peer-to-peer without needing any public IP, port forwarding, or ISP cooperation at all. CGNAT becomes irrelevant. The free personal plan supports up to 100 devices and three users. Setup takes roughly 15 minutes: install Tailscale on the device you want to reach (NAS, camera system, a Raspberry Pi, a PC running Plex) and on the device you’ll be connecting from. Log in with the same account on both. They find each other automatically through Tailscale’s coordination server and communicate directly thereafter. No router changes needed, no firewall rules, no third-party router required.
Cloudflare Tunnel (formerly Argo Tunnel) works differently from Tailscale and solves a different problem: making a web service running on your home network accessible from any browser on the internet, without any public IP or port forwarding. A lightweight agent called cloudflared runs on your home machine, opens an outbound connection to Cloudflare’s edge network, and Cloudflare routes incoming HTTPS requests through that tunnel to your service. The free tier is sufficient for personal use. What it’s best for: a self-hosted web app, a home media server accessible via browser, a locally hosted dashboard. What it isn’t designed for: general-purpose peer-to-peer connections or non-web protocols (those need Tailscale). A Cloudflare account and a domain name you control are required. The tunnel itself is free; the domain registration costs roughly $10–$15 per year.
If your need is a consistent, stable IP address that the outside world sees when you connect to it — for IP-whitelisted services, work VPNs that verify your source IP, or banking portals that lock to a specific address — a commercial VPN service with a dedicated IP add-on solves that cleanly. Providers including Private Internet Access (PIA) and NordVPN offer dedicated (non-shared) IP addresses as an add-on for $5–$8 per month. All your outbound traffic exits from that fixed IP, and it remains yours as long as you maintain the subscription. Important distinction: this does not allow other people to connect inbound to your home — it only stabilizes what IP address you appear to come from. If your actual need is reaching your home from outside, Tailscale is the right tool, not a VPN with a dedicated IP.
A Virtual Private Server (VPS) from providers like Linode (now Akamai Cloud), DigitalOcean, or Vultr costs $4–$12 per month for the smallest tier and gives you a static public IP address in the cloud that you fully control. You set up a reverse proxy or SSH tunnel from your home network to the VPS, and all inbound traffic to the VPS’s static IP gets forwarded to your home devices. This is the most powerful workaround: it handles any protocol, supports any port, and gives you a genuinely static IP that never changes. The tradeoff is complexity — it requires comfort with Linux command line, SSH, and basic networking concepts. Tools like Pangolin (a self-hostable Cloudflare Tunnel alternative) have simplified the setup considerably. For technically comfortable users managing multiple home services, this approach is more flexible than any other option.
Starlink assigns every customer a /56 IPv6 prefix on every plan — residential or Priority. This means each device on your network already has a globally routable public IPv6 address. The static IP problem essentially disappears for IPv6: there are enough IPv6 addresses that ISPs can assign them without the sharing that creates CGNAT problems with IPv4. The catches: you need a third-party router to configure firewall rules that let inbound IPv6 traffic reach specific devices (the Starlink router blocks everything by default with no configurable settings), and the service or device you’re trying to reach from outside must also support IPv6. Client support for IPv6 has improved significantly — most modern operating systems, browsers, and smart home platforms support it — but some older devices and services remain IPv4 only. For those that work, IPv6 is the cleanest solution because it uses infrastructure already in place.
IPv6 is the long-term solution to the IP scarcity that causes CGNAT. Starlink implemented it across all plans. Here is what it means in practice.
Starlink gives every customer a /56 IPv6 prefix via DHCPv6 Prefix Delegation (DHCPv6-PD). Without getting deep into subnet math: a /56 prefix gives you 256 separate /64 subnets, and each /64 subnet can contain 18 quintillion device addresses. In practice, you have essentially unlimited IPv6 addresses — enough for every device in your home to have its own permanent public address without any sharing whatsoever. Unlike IPv4 under CGNAT, these are real, routable addresses that the internet can send traffic to directly. No NAT layer sits between your device and the outside world.
Three things are required:
- A third-party router — the Starlink router has no configurable firewall settings and blocks all inbound traffic by default. A router running OpenWrt, pfSense, UniFi, or any consumer router with IPv6 firewall support is needed. Configure it to allow inbound IPv6 traffic to specific devices on specific ports.
- A stable way to find your device’s IPv6 address — IPv6 addresses can use SLAAC (which generates a stable address from your device’s hardware) or DHCPv6. Using a Dynamic DNS service that supports IPv6 (like Dynu, Duck DNS, or Hurricane Electric’s free tunnel broker) gives you a consistent hostname to reach your device even if its IPv6 address changes.
- IPv6 support on both ends — the remote device or service connecting to your home must also support IPv6. This is increasingly common but not universal.
Most modern equipment handles IPv6 without extra configuration. This includes Windows 10 and 11, macOS Monterey and later, iOS and Android, Linux with any recent kernel, Synology and QNAP NAS devices, Home Assistant, UniFi and Ubiquiti networking gear, and most current smart home hubs. Services including Google, Cloudflare DNS, and most major CDNs are fully IPv6-capable. What may still be IPv4-only: some older NAS firmware, certain IP camera brands, legacy industrial or medical equipment, and a small number of regional ISPs whose customers can’t receive inbound IPv6 traffic. Test before committing to an IPv6-only solution by visiting test-ipv6.com from both ends of the connection.
Install Tailscale on the device running your camera system or NAS, and on whatever you’ll use to access it (phone, laptop, work computer). This is the fastest path — roughly 15 minutes of setup, no router changes, no additional hardware, free. If your NAS or camera system doesn’t support Tailscale directly, install it on a Raspberry Pi or always-on PC on the same network and use it as a subnet router, which extends Tailscale access to other local devices. If you’re running a Synology NAS specifically, Tailscale has a native package in the Synology Package Center. Do not spend money upgrading to Priority just for camera access — Tailscale solves this completely at zero cost on any plan.
Strict NAT on a Residential Starlink plan is expected behavior under CGNAT — you’re not misconfigured, the plan simply doesn’t support open NAT by design. For games that only need “Moderate” NAT (NAT Type 2), some improvement is possible by putting your router in bypass mode (Starlink bypass mode, also called bypass mode or DMZ). For games that require “Open” NAT (NAT Type 1) because they use peer-to-peer matchmaking or host peer sessions, the only Starlink-native fix is upgrading to Priority, enabling the public IP, and setting your third-party router to DMZ mode toward your gaming device. For most multiplayer games — as a player joining servers rather than hosting them — Strict NAT causes no actual gameplay problems. Warnings in game menus look alarming but often have zero practical effect on connection quality.
Three approaches in order of difficulty. Easiest: use Cloudflare Tunnel to expose your web service publicly through Cloudflare’s edge — free, works on Residential, no public IP needed, requires a domain name you control. You get HTTPS automatically through Cloudflare’s certificates. Middle option: a VPS ($5–$12/month) with a reverse proxy forwarding traffic to your home via an SSH tunnel or Wireguard — more control, genuinely static IP, any protocol. Most complex: Priority plan with public IP plus a third-party router with port forwarding — works, but the IP isn’t truly static and costs significantly more per month. For most small self-hosted services, Cloudflare Tunnel is the right answer — it handles HTTPS, protects your home IP from exposure, and scales to surprisingly high traffic on the free tier.
This is the one scenario where a commercial VPN with a dedicated IP add-on is the correct tool. Your company’s VPN checks that your source IP is on an approved list — under Residential CGNAT, your IP appears to change, and you can’t guarantee which address you’ll come from. A dedicated IP from PIA, NordVPN, or a similar provider ($5–$8/month extra) gives you one fixed IP that your employer’s IT team can add to the whitelist permanently. Connect to your dedicated VPN IP first, then connect to the company VPN on top of it. Check with your IT department before purchasing — some corporate VPNs use certificate-based authentication instead of IP whitelisting, in which case no workaround is needed and you’re already connecting fine without realizing it.
Only if your specific need requires it and the free workarounds don’t solve your problem. Priority starts at $65/month and includes 50GB of priority data plus the option for a public IPv4. If you routinely need port forwarding for multiple services, host a game server, run a home business needing a stable IP, or manage infrastructure that requires inbound connections on specific ports — Priority with a third-party router is the cleanest native solution. If your only need is remote access to a NAS or cameras, Tailscale handles that for free on a Residential plan. Run through the free workarounds first. Most people who upgrade for the IP situation later realize Tailscale would have done the job for nothing.
Bypass mode (also called bypass mode on Starlink, or pass-through mode) disables the Starlink-supplied router’s NAT so your third-party router handles everything directly. On the Starlink app under Settings → Router → Bypass Mode, toggle it on. Your third-party router plugs into the Starlink dish’s Ethernet adapter (sold separately for Gen 2 and Gen 3 dishes) and takes over routing. With a Priority plan and public IP enabled, configure port forwarding rules in your third-party router’s interface as you normally would on any ISP. For IPv6, configure DHCPv6-PD on the WAN interface with a /56 prefix delegation, then set up firewall rules allowing specific inbound IPv6 traffic to individual devices. Popular router choices for Starlink use: pfSense, OPNsense, GL.iNet travel routers, Asus routers with Merlin firmware, and UniFi gateways — all have documented Starlink-specific setup guides in their communities.
This guide covers network configuration concepts and available options as of current Starlink service terms. IP addressing policies, plan availability, and pricing are subject to change by Starlink at any time — verify current details at starlink.com before making purchasing decisions. Third-party service recommendations (Tailscale, Cloudflare, etc.) are informational and not endorsements. Network configuration involves technical risk; consult a qualified professional if you are uncertain. This content is entirely original.