Static/Dedicated IP and “Open NAT”

D

Static/Dedicated IP and “Open NAT”

Reaching a device at your home from the Internet

Static IP, dedicated IP, port forwarding, “open NAT,” remote access

Our network is designed for your security first

On the Further Reach network, nothing on the Internet can start a connection to your home. Your devices reach out, and the replies come back. Uninvited traffic never arrives. There is no door for anyone to try.

This matters more every year. According to the 2026 Imperva Bad Bot Report, bots now generate more than half of all web traffic, malicious bots alone account for 40% of all traffic, and AI-driven bot attacks grew more than twelve-fold in a single year. Every home with a public IP address is scanned around the clock by automated tools looking for an open port, an old camera, or a router with a default password. Staying ahead of that means running and maintaining your own firewall, forever.

We handle that for you. Because your home is not reachable from the Internet, you don’t have to outsmart the bots. This protection is part of every Further Reach subscription. Your devices and passwords are still yours to keep updated.

Disclaimer: read before continuing

It is a best practice to employ an Internet firewall that blocks inbound Internet traffic – that is, traffic initiated from outside your home or office network to your home network. Firewalls block this inbound traffic but allow outbound traffic like when you browse the Internet, stream, send/receive emails.

Hence, services such as gaming, business or industrial applications that require a static or dedicated IP often do so because those “SERVICES” initiate traffic from a location on the Internet to the devices on your home network. Allowing inbound Internet traffic originating from the public Internet is inherently dangerous because it could enable attacking devices on your home network.

BY FOLLOWING THESE INSTRUCTIONS, YOU AGREE THAT TO THE FULLEST EXTENT PERMITTED BY LAW, FURTHER REACH DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE REGARDING THESE INSTRUCTIONS. YOU ACKNOWLEDGE THE INHERENT RISKS OF BYPASSING THE FURTHER REACH FIREWALL AND RELEASE FURTHER REACH OF ANY AND ALL DAMAGES OR LIABILITY ASSOCIATED WITH YOUR DOING SO.

Getting Internet traffic to your home anyway

Sometimes you do want something at home reachable from outside: a camera, a file server, a website, a game server. Each method below works around the protection described above, which is why the disclaimer applies. They go from easiest to most involved. Pick the first one that fits.

  • Option 0 Use a product you bought from away: cameras, doorbells, smart home, NAS.
  • Option 1 Let only yourself and people you trust reach your home devices: Plex or Jellyfin, remote desktop, Home Assistant, a NAS at full speed, a 3D printer.
  • Option 2 Let anyone reach a website, blog, or web app you host.
  • Option 3 Have a fixed IP address, or open ports other than web ports: game server, mail server, SSH, industrial equipment.

Option 0: The product already does it

Usually free or included with the product. Nothing to set up on our network.

Most products sold today connect out to the manufacturer’s cloud and let you reach them through it. Look in the product’s app or settings for “remote access,” “cloud access,” or “relay” and turn it on.

Products known to work this way

Home Assistant Cloud (paid subscription), Synology QuickConnect, UniFi Remote Access, Ring, Nest, Wyze, Eufy, and most NAS and camera brands. Xbox and PlayStation online play works for most games; party chat and hosting features that need an “open” NAT type may not.

Plex is the exception: its Remote Access feature falls back to a slow relay on our network. Use Option 1 for Plex.

Option 1: Private access to your home network

Free. About 15 minutes.

For when only you and people you choose need in: watching your Plex or Jellyfin library from away, remote desktop to a home computer, Home Assistant, full-speed access to a NAS, checking on a 3D printer. Nothing is visible to the public. Uses Tailscale, free for personal use.

Requirement: a computer at your home that stays powered on and connected to the Internet whenever you want to reach your home network remotely. If it’s asleep or off, nothing works. A desktop, a mini PC, a Raspberry Pi, or a NAS that supports Tailscale all work. A laptop that gets closed does not.

Show the steps
  1. Create a Tailscale account.
  2. Install Tailscale on the always-on home computer. Sign in.
  3. Install Tailscale on your laptop and phone. Sign in with the same account.
  4. You can now reach that home computer from anywhere by the name Tailscale shows.
  5. To reach everything on your home network (printers, cameras, NAS), turn on “subnet router” on the home computer and enter your home network range (usually 192.168.x.0/24; ask us if unsure). Approve it in the Tailscale admin page. Now every device at home is reachable from your laptop and phone.
  6. To let a friend or family member in, invite them to your Tailscale network from the admin page.

Limit: only devices signed into Tailscale can connect. The public cannot.

Option 2: A public website or web app

Free. About 30 minutes.

For when anyone on the Internet should be able to open your site or app in a browser, without installing anything.

How it works: a small program on your home computer opens a connection out to a service on the Internet and keeps it open. Visitors go to that service, which passes their traffic down the open connection to your computer. The Internet never connects to your home directly.

Requirement: the computer running your site must stay powered on and connected whenever you want the site reachable.

2A. Tailscale Funnel — no domain name needed
  1. Do steps 1–2 of Option 1 on the computer running your site.
  2. In the Tailscale admin page, enable Funnel for that computer (the first time you run the command below, it prints a link that does this).
  3. On that computer run: tailscale funnel --bg 8080 (replace 8080 with the port your site runs on).
  4. Your site is now at https://..ts.net. Tailscale provides the HTTPS certificate.

Limits: HTTPS only. The address ends in .ts.net; you cannot use your own domain. Fine for personal and small-group use.

2B. Cloudflare Tunnel — use your own domain name
  1. Own a domain (about $10/year from Cloudflare or any registrar) and put its DNS on Cloudflare (free plan).
  2. In Cloudflare, go to Zero Trust → Networks → Tunnels → Create a tunnel. Cloudflare shows a one-line install command for cloudflared.
  3. Run that command on the computer hosting your site.
  4. In the tunnel’s “Public Hostname” tab, add home.yourdomain.com → https://localhost:8080 (your site’s port).
  5. Your site is now at https://home.yourdomain.com, with Cloudflare providing the certificate.

Limits: web traffic only. Cloudflare decrypts traffic at its edge, so don’t use it for anything you need kept private from Cloudflare.

Stuck on either of these? Ask us. We can help.

Option 3: Your own public IP address, through a cloud server

About $6/month. An afternoon.

For when you need a fixed IP address you can point anything at, or ports other than 80 and 443: SSH, a mail server, a game server, VPN, industrial or monitoring equipment.

How it works: you rent a small server on the Internet that has a public IP. A router at your home keeps an encrypted WireGuard tunnel open to it. Anything sent to the server’s IP travels down the tunnel to your router, which forwards it to the device you choose. The server’s IP is, in effect, your public IP.

What you need and the steps

What you need:

  • A cloud server: DigitalOcean’s smallest droplet (about $6/month), Ubuntu.
  • Your own router that runs WireGuard, plugged into the Further Reach equipment we installed. GL.iNet, OPNsense, pfSense, UniFi, MikroTik, or a Raspberry Pi all work.

Outline of the steps:

  1. Create the droplet. Install WireGuard on it and set it up as the tunnel hub.
  2. On your router, add a WireGuard interface pointing at the droplet, with persistent keepalive set (25 seconds). Without keepalive the tunnel drops behind our network. Confirm the tunnel is up.
  3. On the droplet, forward the ports you want (for example 80, 443, 22) down the tunnel to your router.
  4. On your router, forward those ports to the device that should receive them, and route the replies back through the tunnel rather than out your normal connection. This is the step most people get wrong.
  5. Test from a phone on cellular data.

The same droplet can also be a private VPN entry point to your home network, or a hub for site-to-site VPN between locations, using standard WireGuard configuration.

Limits: this one is fussy to set up and needs someone comfortable with router configuration. Monthly cost. If the droplet is down, you are unreachable until it’s back. Whatever ports you forward are open to the entire Internet, so only forward what you need and keep those devices updated.

Getting help

  • Do it yourself. Options 0, 1, and 2 need no hardware, and we’re glad to answer questions along the way. Option 3 needs a WireGuard-capable router ($30–200 if you don’t have one) plus the cloud server. Support for a self-built Option 3 setup is billed on a time-and-materials basis.
  • Have Further Reach do it. We can build and manage it for you. Contact us and we’ll send you a proposal.

Questions: support@furtherreach.net.

Updated September 2026.

Posted on September 3, 2024
Permalink
Back to Top