A public IP address lets a home server receive connections from anywhere. That matters for a personal website, a game server, a VPN endpoint, a Git forge, or a service that needs a stable DNS record. Many residential lines cannot accept those connections because the ISP places subscribers behind carrier-grade NAT, often called CGNAT.
This guide gives one Linux server its own routed public IPv4 address through WireGuard. The server opens the encrypted tunnel from the home network, so the ISP router never needs an inbound port forward. The public address stays on the server and each service can use its usual port.
wg0 to the service. Replies sourced from that address return through the same tunnel.Check that a public IPv4 solves the problem
First, compare the WAN address shown by the home router with the result from a site that reports the current public address. A mismatch commonly points to CGNAT. Addresses in 100.64.0.0/10 are reserved for shared address space, so a router WAN address in that range also confirms it. The earlier guide on hosting a server behind CGNAT covers the check and the alternatives in detail.
A public IPv4 address is worth adding when visitors need a normal Internet destination. Tailscale, ZeroTier, a commercial VPN, and reverse proxies can be useful for narrower jobs. They change the access model, the supported protocols, or the address a visitor reaches. A routed IPv4 keeps direct TCP and UDP connectivity available to the server.
| Need | Suitable path |
|---|---|
| Private remote administration | A mesh VPN is often enough. |
| One HTTP application | A reverse proxy can work if its limits fit the application. |
| Direct TCP and UDP services | A routed public IPv4 address preserves the usual port model. |
| Several services under one hostname | Use a routed address and place a reverse proxy on the server when appropriate. |