This is an important point re: static vs public IPs.
IP addresses in the 10.x.x.x CGNAT/private range can absolutely technically be static or dynamic.
IP address in a public range like the 20.x.x.x one mentioned can absolutely technically be static or dynamic.
For easiest external access, that means you want a static, publicly routable, IP address in the 20.x.x.x range (or whatever range AGL is on in the future). But you’ll have to do router port forwarding (and perhaps other configuration) to allow access to “internal” services/devices.
Alternatively, if you don’t need public (i.e. devices you don’t control) access (i.e. you’re not running a mail server, or a public Minecraft server), but just want to access, say, your own media server or file server when remote, you can use solutions like WireGuard/Tailscale or ZeroTier (all available free for personal use) to create your own VPN.
These set up a discrete network of devices accessible to each other over another set of IP addresses (e.g. Tailscale uses 100.x.x.x) allowing you to directly connect between devices, even if one is on a publicly routable IP address network, while others are on the AGL 10.x.x.x dynamic private range (exactly my setup, I use Tailscale).
They have additional benefits.
- Because only your own devices can see each other, you can avoid port forwarding rules on your router exposing ports to the wider Internet where that’s not necessary/advisable (port 22, anyone?)
- Many Tailscale devices (I haven’t tried with WireGuard or ZeroTier) can act as an “exit node” for others through the VPN, i.e. basically what most people use commercial VPNs for – your local traffic seems to originate from the exit node’s network, and return traffic goes back to the exit node’s network, and the exit node forwards it to the remote device
- You don’t have to worry about dynamic DNS (DDNS) for dynamic external network addresses, and you don’t have to worry about private addresses on individual devices/routers (my Tailscale traffic goes: computer ⇄ internal NAT on my router with DHCP reservation IP ⇄ external/CG NAT on AGL routers with dynamic IP ⇄ ☁️Internet☁️ ⇄ router on other network with publicly routable static IP address ⇄ internal NAT with DHCP (reserved and not) and static) ⇄ computer/server, but it feels like the computer and server could be next to each other on the same physical network
- You can access non-Tailscale devices on other physical networks using their local IP address by having a Tailscale device “advertise subnet routes” – i.e. it acts as a router between the local network and the remote network. This allows me to print to my printer on another network using the same IP-based configuration I would use if I were physically co-located with the printer.
Note: Bonjour/mDNS does not work over Tailscale, so you need to address devices by IP address (local or Tailscale) or Tailscale MagicDNS hostname.
I chose Tailscale in the end as its configuration on all platforms is easier than what I’ve seen in a trial of ZeroTier, and what I read on the website of WireGuard (Tailscale is built on WireGuard). Anything I’ve said I do in Tailscale may be achievable with the other solutions.
I have Linux, macOS, iPadOS, iOS, tvOS and Home Assistant devices (16 in total, on 7 separate networks [plus mobile data]) all happily talking to each other over Tailscale, have reduced my port-forwarding setup dramatically, limited some services in their config only to the Tailscale subnet (Webmin on my Linux servers, for example), use an exit node on my “base” network to ensure certain streaming service/s don’t think I’m sharing my account with others when I have extended stays away from home (also useful for holiday homes, I guess), and have better functionality and security overall to boot (yes, I’m a fan).
Anyway, just my $0.02 worth!
Sean
PS I tried to include lots of links, but although they’re available in the editor, they aren’t allowed by policy on this site. You’ll have to google them.
